This complete guide to physical-layer security presents the theoretical foundations, practical implementation, challenges and benefits of a groundbreaking new model for secure communication. Using a bottom-up approach from the link level all the way to end-to-end architectures, it provides essential practical tools that enable graduate students, industry professionals and researchers to build more secure systems by exploiting the noise inherent to communications channels. The book begins with a self-contained explanation of the information-theoretic limits of secure communications at the physical layer. It then goes on to develop practical coding schemes, building on the theoretical insights and enabling readers to understand the challenges and opportunities related to the design of physical layer security schemes. Finally, applications to multi-user communications and network coding are also included.

Physical-Layer Security: From Information Theory to Security Engineering

A publicly verifiable secret sharing (PVSS) scheme is a verifiable secret sharing scheme with the property that the validity of the shares distributed by the dealer can be verified by any party; hence verification is not limited to the respective participants receiving the shares. We present a new construction for PVSS schemes, which compared to previous solutions by Stadler and later by Fujisaki and Okamoto, achieves improvements both in efficiency and in the type of intractability assumptions. The running time is O(nk), where k is a security parameter, and n is the number of participants, hence essentially optimal. The intractability assumptions are the standard Diffie-Hellman assumption and its decisional variant. We present several applications of our PVSS scheme, among which is a new type of universally verifiable election scheme based on PVSS. The election scheme becomes quite practical and combines several advantages of related electronic voting schemes, which makes it of interest in its own right.

A simple publicly verifiable secret sharing scheme and its application to electronic voting

https://www.asia.edu.tw/Main_pages/about/Former_president_TsaiWH_publications/Journal%20Paper%20PDFs/Lin_&_Tsai_JSS_2004.pdf

Secret image sharing with steganography and authentication

http://msn.iecs.fcu.edu.tw/report/data/ori_paper/2004-2-19/New%20visual%20secret%20sharing%20schemes%20using%20probabilistic%20method.pdf

New visual secret sharing schemes using probabilistic method

Extended capabilities for visual cryptography

The idea of visual k out of n secret sharing schemes was introduced in Naor. Explicit constructions for k = 2 and k = n can be found there. For general k out of n schemes bounds have been described.

Here, two general k out of n constructions are presented. Their parameters are related to those of maximum size arcs or MDS codes. Further, results on the structure of k out of n schemes, such as bounds on their parameters, are obtained. Finally, the notion of coloured visual secret sharing schemes is introduced and a general construction is given.

Constructions and Properties of k out of nVisual Secret Sharing Schemes

Information-theoretic secret key agreement generally consists of three phases, namely, advantage distillation information reconciliation and privacy amplification. Advantage distillation is needed in the case when two legitimate users, Alice and Bob, start in a situation which is inferior to that of the adversary Eve. The aim for them is to gain advantage over Eve in terms of mutual information between each other. Information reconciliation enables Alice and Bob to arrive at a common string by error correction techniques. Finally they distill a highly secret string from the common string in the privacy amplification phase. For the scenario where Alice and Bob as well as Eve have access to the output of a binary symmetric source by means of (three) binary symmetric channels, there are several advantage distillation and information reconciliation protocols proposed.  In this paper, we present a general protocol to implement both advantage distillation and information reconciliation. Simulation results are compared with known protocols. A connection between our protocol and the known protocols is given.

A Practical Protocol for Advantage Distillation and Information Reconciliation

We propose a concept for a worldwide information security infrastructure that protects law-abiding citizens, but not criminals, even if the latter use it fraudulently (i.e. when not complying with the agreed rules). It can be seen as a middle course between the inflexible but fraud-resistant KMI-proposal [8] and the flexible but non-fraud-resistant concept used in TIS-CKE [2]. Our concept consists of adding binding data to the latter concept, which will not prevent fraud by criminals but makes it P t least detectable by third parties without the need of any secret information. In [19], we depict a worldwide framework in which this concept could present a security tool that is flexible enough to be incorporated in any national cryptography policy, on both the domestic and foreign use of cryptography. Here, we present a construction for binding data for ElGamal type public key encryption schemes. As a side result we show that a particular simplification in a multiuser version of ElGamal does not affect its security.

/pdf/binding-elgamal-a-fraud-detectable-alternative-to-key-escrow-5fcp7y0242.pdf

Binding ElGamal: a fraud-detectable alternative to key-escrow proposals

It will be shown that the following binary linear codes are unique: (n, k, d) = (2{suk} − 2u, k, 2{suk−1} − 2u−1} 1 ⩽ u ⩽ k − 1, (2{suk} −2{suk−2} − 3, k,2{suk−1} − 2{suk−3} − 2), k ⩾ 6, and (2{suk−1} + k, k, 2{suk−2} + 2), k ⩾ 3, k ≠ 5. Also there are exactly 2 non-isomorphic (21, 5, 10) codes. Using these results the non-existence of binary linear (n, k, d) codes meeting the Griesmer bound is proved for 2{suk−2} + 3 ⩽ d ⩽ 2{suk−1} − 2{suk−3} − 4.

On the uniqueness resp. Nonexistence of certain codes meeting the Griesmer bound

We introduce new adaptive chosen ciphertext attacks, called Sloppy Alice Attacks, in which a malicious sender or an adaptive eavesdropper Eve has an oracle which allows her to find out whether a sent encrypted message does, or does not, decrypt properly. From this information she can extract the plaintext that was encrypted. In this paper we show that the McEliece public-key cryptosystem is susceptible to Sloppy Alice attacks.

Henk C. A. van Tilborg

Papers

Constructions and Properties of k out of nVisual Secret Sharing Schemes

A Practical Protocol for Advantage Distillation and Information Reconciliation

Binding ElGamal: a fraud-detectable alternative to key-escrow proposals

On the uniqueness resp. Nonexistence of certain codes meeting the Griesmer bound

Sloppy Alice Attacks! Adaptive chosen ciphertext attacks on the McEliece public-key cryptosystem