Table Of ContentLecture Notes in
Computer Science
Edited by G. Goos and J. Hartmanis
473
I.B. DamgArd (Ed.)
Advances in CrvDtoloav -
U J
EUROCRYPT 90
Workshop on the Theory and Application
of Cryptographi c Techniques
Aarhus, Denmark, May 21-24, 1990
Proceedings
Sp rin ger-Verlag
Berlin Heidelberg New York London
Paris Tokyo Hong Kong Barcelona
Editorial Board
D. Barstow W. Brauer P Brinch Hansen D. Gries D. Luckham
C. Moler A. Pnueli G. Seegmuller J. Stoer N.W irth
Volume Editor
Ivan Bjerre Damg5rd
Maternatisk Institut, Arhus Universitet
Ny Munkegade, DK-8000 Arhus C, Denmark
CR Subject Classification (1987): D.4.6?E .3,H .2.0
ISBN 3-540-53587-XS pringer-Verlag Berlin Heidelberg New York
ISBN 0-387-53587-XS pringer-Verlag New York Berlin Heidelberg
This work is subject to copyright All rights are reserved, whether the whole or part of the material
is concerned, specifically the rights of translation, reprinting, re use of illustrations, recitation,
broadcasting, reproduction on microfilms or in other ways, and storage in data banks Duplication
of this publication or parts thereof is only permitted under the provisions of the German Copyright
Law of September 9, 1965, in its current verslon, and a copyright fee must always be paid
Violations fall under the prosecution act of the German Copyright Law
0 Springer-VerlagB erlin Heidelberg 1991
Printed in Germany
Printing and binding Druckhaus Beltz, HemsbachIBergstr
2145/3140-543210 - Printed on acid free paper
Preface
ELROCRYPTi s a conference devoted to all aspects of cryptologic research, both theoretical
and practical. In the last 7 years, the meeting has taken place once a year at various places in
Europe. Both these meetings and the annual Crypto meetings in California are sponsored by
The International Association for Cryptologic Research (IACR). Most of the proceedings
from these meetings are, like this one, published in Springer-Verlag’s Lecrure Notes in Com-
puter Science series.
EuroCrypt 90 took place on May 21-24 at conference center Scanticon, situated in Arhus,
Denmark. There were more than 250 participants from all over the world. It is a pleasure to
take this opportunity to thank the general chairman Peter Landrock, Arhus Congress Bureau,
Scanticon, and the organizing committee, who all contributed with hard work and dedication
to make a well organized and successful conference.
A total of 85 papers from all over the world were submitted to the conference. This number
marks a continuation of the steady growth of interest in the EuroCrypt meetings. Out of the
papers submitted, 41 were rejected, 1 was withdrawn, and 2 papers were asked to merge. This
resulted in a set of 42 papers presented at the conference. The submissions were in the form of
extended abstracts. All program committee members received a full set of submissions, and
each submission was refereed independently by at least two members of the program
committee (not including the program chairman). The experiment from Crypto 89 with blind
refereeing was continued at this conference, and has now become standard policy at IACR
conferences. The final papers appearing in these proceedings were not refereed, and the au-
thors retain, of course, full responsibility for the contents. Several of the papers can be expect-
ed to appear in various journals in more polished forni. There will a special issue of the
Journal of Cryptology containing selected papers from the conference.
In addition to the formal contributions, a number of informal talks were given at the tradition-
al rump session. These proceedings include short abstracts of some of these impromptu talks.
Finally, it is a pleasure to acknowledge all those who contributed to putting together the pro-
gram of EuroCrypt 90 and making these proceedings a reality.
First of all, thanks to the program committee. All of its members put a tremendous amount of
hard work into the refereeing, and many of them even took the time to make detailed
comment on other papers than the 20 they were asked to read carefully. Also some of my col-
leagues at Arhus University kindly offered their help on various technical questions; among
these were Torben Pedersen and J~rgenB randt.
Of course, no conference could have taken place without the authors’ contribution. I would
like to thank all those who submitted papers, also those whose submissions could not be ac-
cepted because of the large number of high quality submissions we received. Many of the au-
thors have been extremely cooperative in changing the format of their papers to fit into the
proceedings. Were it not for this attitude, these proceedings would have been significantly de-
layed.
Arhus, September 1990 Ivan Bjerre Damgird
EUROCRYP9T0
A conference on the theory and application of cryptology
Sponsored by The International Association for Cryptologic Research (IACR)
and
CRYPTOMATHIC AS, DATACO AS, Den Danske Bank AS,
Jutland Telephone Company AS
General Chairman: Peter Landrock (Aarhus Ilniversity)
Organizing Committee:
Jwgen Brandt (Aarhus University)
Palle Brandt Jensen (Jutland Telephone Company)
Torben Pedersen (Aarhus University)
Arhus Congress Bureau
Program Chairman: Ivan Damgbd (Aarhus University)
Program Committee:
Ueli Maurer (ETH, Zurich)
Andrew J. Clark (Computer Security Ltd., Brighton)
Claude Crkpeau (LRI, Pans)
Thomas Siegenthaler (AWK, Zurich)
Joan Boyar (Aarhus University)
Stig Frode Mjdsnes (ELAB, Trondheim)
Marc Girault (SEPT, Caenj
Walter Fumy (Siemens AG, Erlangen)
Othmar Staffelbach (Gretag, Regensdorf)
Contents
Session 1: Protocols
All languages in NP have divertible zero-knowledge proofs and urguments
under cryptographic assumptions
M.V.D. Burrnester (University of London) and Y. Desmedt (University of
Wisconsin, Milwaukee). .............................................................................................................. 1
On the importance of memory resources in the security of key exchange protocols
G. Davida, Y. Desmedt and R. Peralta (University of Wisconsin, Milwaukee) ...................... 11
Provably secure key-updating schemes in identity-based systems,
S. Shinozaki, T. Itoh, A. Fujioka and S. Tsujii (Tokyo Institute of Technology) ..................... 16
Oblivious transfer protecting secrecy
. .
Bert den Boer (Philips Crypto B.V.) ......................................................................................... 31
Public-randomness in public-key cryptogruphy
A. De Santis (University of Salerno) and G. Persian0 (Harvard University) ........................... 46
An interactive identification scheme based on discrcte logarithms and factoring
E.F. Brickell and K.S. McCurley (Sandia National Laboratories). ........................................... 63
Session 2: Number-Theoretic Algorithms
Factoring with two large primes
A.K. Lenstra (Bell Corn. Research) and M.S. Manasse (Dig. Equip. Corp.). ........................... 72
Which new RSA signatures can be computed from some given RSA signatures?
J.-H. Evertse (University of Leiden) and E. van Heyst (CWI, Amsterdam) 83
Implementation of a key exchange protocol using real quadratic fields
R. Scheidler (University of Manitoba), J.A. Buchman (University of Saarland)
and H.C. Williams (University of Manitoba). ........................................................................... 98
Distributed primality proving and the primality of (23539+ 1)13
F. Morain (INRIA, Le Chesnay) ..........................................................................
Session 3: Boolean Functions
Properties of binary functions
S. Lloyd (H.P. Laboratories, Bristol) ..................................................................................... 124
How to construct pseudorandom permutations from single pseudorandomf unctions
J. Pieprzyk (University of New South Wales) 140
Constructions of bent functions and difference sets
K. Nyberg (University of Helsinki) ........................................................................................ 151
Propagation characteristics of boolean functions
B. Preneel, W. V ekwijk, L. Van Linden, R. Govaerts and J. Vandewalle
............................................................................................................ 161
VI
Session 4: Binary Sequences
The linear complexity profile and the jump complexity of keystream sequences
H. Niederreiter (Ausman Academy of Sciences). ................................................................... 174
Lower bounds for the linear complexity of sequences over residue rings
Z. Dai (University of Linkoping), T. Beth and D. Gollmann (University
of Karlsruhe) ........................................................................................................................... 189
On the construction of run permuted sequences
C.J.A. Jansen (Philips Crypto B.V.) ........................................................................................ 196
Correlation properties of combiners with memory in stream ciphers
W. Meier (HTL Brugg-Windisch) and 0. Staffelbach (Gretag). ........................................... 204
Correlation functions of geometric sequences
A.H. Chan, M. Goresky and A. Klapper (Northeastern University) ....................................... 214
Session 5: Implementations
Exponentiating faster with addition chains
Y. Yacobi (Bellcore) ............................................................ ..................... 222
A cryptographic library for the Motorola DSP 56000
S.R. Dusse and B.S. Kaliski Jr. (RSA Data Security Inc.).. ...., 230
VICTOR - an eflcient RSA hardware implementation
H. Orup, E. Svendsen and E. Andreasen (Aarhus University) ................................................ 245
Experimental quantum cryptography
C.H. Bennett (IBM Yorktown) F. Bessette, G. Brassard, L. Savail (University
of Montreal) and J. Smolin (UCLA). ...................................................................................... 253
Session 6: Combinatorial Schemes
A protocol to set up shared secrer schemes without the assistance of a mutually
trusted party
I. Ingemarsson (Linkoping University) and G. J. Simmons (Sandia Nat. Labs.) ................... 266
Lower bounds for authentication codes with splitting
A. Sgarro (University of Udine) .............................................................................................. 283
Essentially l-fold secure authentication systems
A. Beutelspacher (University of GieBen) and U. Rosenbaum (Siemens AG) ........................ 294
On the construction of authentication codes with secrecy and codes whithstanding
spoofing attacks of order L22
B. Smeets, P. Vanrose and Z. Wan (University of Lund) ....................................................... 306
VII
Session 7: Cryptanalysis
Cryptanalysis of a public-key cryptosystem based on approximations by
rational numbers
J. Stern (University of Paris) and P. Toffin (University of Caen) ........................................... 313
A known-plaintext attack on two-key triple encryption
P.C. van Oorschot and M.J. Wiener (BNR, Ottawa) .............................................................. 318
Confirmation that some hash functions are not collision free
S. Miyaguchi, K. Ohta and M. Iwata (NTT Labs). ................................................................. 326
inverting the pseudo exponentiation
F. BauspielJ, H.-J. Knobloch and P. Wichmann (University of Karlsruhe) ............................ 344
Session 8: New Cryptosystems
Crypt osystemf or 8 ro up oriented cryptography
. .
T. Hwang (Nat. Cheng Kung University) .............................................................. 352
A provably-secure strongly-randomized cipher
U. Maurer (Swiss Fed. lnst. of Tech.). ................................................................................... 361
General public key residue cryptoqstems and mental poker protocols
K. Kurosawa, Y. Katayama, W.Ogata and S. Tsujii (Tokyo Inst. of Tech.). .......................... 374
A proposal for a new block encryption standurd
X. Lai and J. Massey (Swiss Fed. Inst. of Tech.) .................................................................... 389
A new trapdoor in knapsacks
V. Niemi (University of Turku) ..................... ................................................. ,405
Session 9: Signatures and Authentication
On the design of provably secure cryptographic hash functions
A. De Santis (University of Salerno) and M. Yung (IBM Yorktown) .................................... 412
Fast signature generation with a Fiat Shamir-like scheme
H. Ong (Deutsche Bank AG) and C.P. Schnorr (University of Frankfurt) ............................. 432
A remark on a signature scheme where forgery can be proved
G. Bleumer, B. Pfitzmann and M. Waidner (University of Karlsruhe) ............................ 441
Membership authenticationf or hierarchical multigroups using the extended
Fiat-Shamir scheme
K. Ohta, T. Okamoto and K. Koyama (NTT Laboratories) .............. ....... ... ,446
Zero-knowledge undeniable signatures
D. Chaum (CWI, Amsterdam). ....................................................................... 45 8
Precautions taken against various potential attacks in ISOIIEC DIS 9796
L. C. Guillou (CCETT), J.-J. Quisquater (Philips Research), M. Walker
(Racal Research), P. Landrock (Aarhus University) and C. Shaer (Racal Research) .............4 65
Vlll
Rump Session: Impromptu Talks
Software run-time protection: A cryptographic issue
J. Domingo-Ferrer (University of Barcelona) ............................................. ..474
An identiv-based identification scheme based on discrete logarithms
modulo a composite number
M. Girault (SEPT) ............................................................................................ 481
A noisy clock-controlled shift register cryptanalysis concept based on sequence comparison
approach
J.D. Colic and M.J. Mihaljevic (University of Belgrade) ................................................ 487
The MD4 message digest algorithm
B.S. Kaliski Jr. (RSA Data Sec. Inc.) ................................................................................
A remark on the efliciency of identification schemes
M. Burmester (University of London). ................................................................................... 493
On an implementation of the Mohun-Adigu ulgorithm
Gisela Meister (GAO). ............................................................................................................ 496
ALL LANGUAGES IN NP HAVE DIVERTIBLE
ZERO-KNOWLEDGE PROOFS AND ARGUMENTS UNDER .
CRYPTOGRAPHIC ASSUMPTIONS·
(Extended Abstract)
Mike V. D. Burmester t Yvo Desmedt t
Dept. of Mathematics Dept. EE & CS
RHBNC - University of London Univ. of Wisconsin - Milwaukee
Egham, Surrey TW20 OEX P.O. Box 784
U.K. WI 53201 Milwaukee
U.S.A.
Abstract
We present a divertible zero-knowledge proof (argument) for SAT under the as
sumption that probabilistic encryption homomorphisms exist. Our protocol uses a
simple 'swapping' technique which can be applied to many zero knowledge proofs
(arguments). In particular we obtain a divertible zero-knowledge proof for graph
isomorphism. The consequences for abuse-free zero-knowledge proofs are also con
sidered.
I. Introduction
Okamoto-Ohta defined divertible zero-knowledge proofs in [0089] and showed that com
mutative random self-reducible relations have such proofs, provided certain conditions are
satisfied. The first divertible zero-knowledge proof was given in [DGB88, pp. 37-38] in
the context of an abuse-free zero-knowledge proof.
In this paper we generalize this result to all problems in NP under cryptographic
assumptions and consider the consequences for abuse-free proofs. We also remark that
most divertible zero-knowledge proofs of membership presented here will not convince
unconditionally two (independent) verifiers simultaneously. So the framework of divertible
zero-knowledge has to be modified if it is to be used for this purpose.
This paper is organized as follows. We first state our results. Then we present the
protocol and finally we sketch the proofs.
"Research done while visiting the EISS, University of Karlsruhe, West Germany.
tResearch partially supported by SERC Grant GR/F 5700.
tResearch is being supported by NSF Grant NCR-9004879.
I.B. Damgard (Ed.): Advances in Cryptology -EUROCRYPT '90, LNCS 473, pp. 1-10, 1991.
© Springer-Verlag Berlin Heidelberg 1991
2
II. Main results
11.1. Notation and Definitions
(A, B, C) is a divertible interactive triple of Turing machin~ [0089). For the definition of
divertible proofs and abuse-free systems see [0089,Des90]; for the SAT proo~ (argument)
see [BCC88,BC89]. A probabilistic encryption function f.(.) satisfies the properties that
fr(b) can be computed in polynomial time when r, b are given, and that frCb) = fTI(b') =>
=
b b'. Here r, r' are any random bit strings and b, b' are bits. f is a probabilistic
l
homomorphism if frCb) . frl(b ) = frll(b 6) b'), where r'1 can be computed from r, r', band
11 in polynomial time, and $ is exclusive-or. A well-known example of an encryption
homomorphism [GM84} is given by fT(b) == sbr2(modn), where n is a Blum integer and
s is an appropriate quadratic non-residue. (It is instructive to compute r" in this case,
given s, n, and r, r', b = b' = 1.) The modulus nand s parameterize f. We shall assume
that all the probabilistic encryption functions considered in this paper are parameterized,
but for simplicity we ignore this in our notation.
We denote by {z} a string which is a concatenation of strings of type z with delimiters.
II.2. Theorems and implications for abuse-free proofs
Theorem 1 If probabilistic encryption homomorphisms exist and are provided by an or
acle, then all languages in NP have divertible zero-knowledge proofs.
Corollary 1 If probabilistic encryption homomorphisms exist then all languages in NP
have conditional abuse-free zero-knowledge proofs.
Theorem 2 If probabilistic encryption functions exist then all languages in NP have
unconditional abuse-free zero-knowledge proofs.
Theorem 3 Given an oracle similar to the one in Theorem 1: If factoring is hard then
all languages in NP have divertible statistical zero-knowledge arguments.
Corollary 2 If probabilistic blob functions exist then all languages in NP have abuse-free
zero-knowledge arguments.
Theorem 4 There exists an 'unconditional' 1 divertible zero-knowledge proof for graph
isomorphism.
Remarks: We will describe a protocol which ca.n be used for many zero-knowledge
proofs with slight modifications. This protocol does not require tha.t the structures in
volved are commutative. Furthermore it can easily be adapted to make the authentication
system [Des88} unconditionally divertible (so that two or more independent wardens can
be used).
lThe quotation marks are due to the unnatural condition (iii) of Definition 1 in [0089], which implies
that the protocol is only divertible when graph isomorphism is not decidable in probabilistic polynomial
time. In the final paper we will restate this definition but without this property.
