From the Publisher:
A valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the area of cryptography, this book provides easy and rapid access of information and includes more than 200 algorithms and protocols; more than 200 tables and figures; more than 1,000 numbered definitions, facts, examples, notes, and remarks; and over 1,250 significant references, including brief comments on each paper.

Handbook of Applied Cryptography

RC6 has been submitted as a candidate for the Advanced Encryption Standard (AES). Two important features of RC6 that were absent from its predecessor RC5 are a quadratic function and a fixed rotation. By examining simplified variants that omit these features we clarify their essential contribution to the overall security of RC6.

Fast Software Encryption

This paper describes a new differential-style attack, which we call the boomerang attack. This attack has several interesting applications. First, we disprove the of t-repeated claim that eliminating all high-probability differentials for the whole cipher is sufficient to guarantee security against differential attacks. Second, we show how to break COCONUT98, a cipher designed using decorrelation techniques to ensure provable security against differential attacks, with an advanced differential-style attack that needs just 216 adaptively chosen texts. Also, to illustrate the power of boomerang techniques, we give new attacks on Khufu-16, FEAL-6, and 16 rounds of CAST-256.

The Boomerang Attack

Twofish is a 128-bit block cipher that accepts a variable-length key up to 256 bits. The cipher is a 16-round Feistel network with a bijective F function made up of four key-dependent 8-by-8-bit S-boxes, a fixed 4-by-4 maximum distance separable matrix over GF(2), a pseudo-Hadamard transform, bitwise rotations, and a carefully designed key schedule. A fully optimized implementation of Twofish encrypts on a Pentium Pro at 17.8 clock cycles per byte, and an 8-bit smart card implementation encrypts at 1660 clock cycles per byte. Twofish can be implemented in hardware in 14000 gates. The design of both the round function and the key schedule permits a wide variety of tradeoffs between speed, software size, key setup time, gate count, and memory. We have extensively cryptanalyzed Twofish; our best attack breaks 5 rounds with 2 chosen plaintexts and 2 effort.

/pdf/twofish-a-128-bit-block-cipher-3nyqmnjk4s.pdf

Twofish : A 128-bit block cipher

A catadioptric projection objective for projecting a pattern arranged in the object plane of the projection objective into the image plane of the projection objective, having: a first objective part for projecting an object field lying in the object plane into a first real intermediate image; a second objective part for generating a second real intermediate image with the radiation coming from the first objective part; a third objective part for generating a third real intermediate image with the radiation coming from the second objective part; and a fourth objective part for projecting the third real intermediate image into the image plane.

Catadioptric Projection Objective

In 1990, Merkle proposed two fast software encryption functions, Khafre and Khufu, as possible replacements for DES [l]. In 1991, Biham and Shamir applied their differential cryptanalysis technique to Khafre [2], and obtained an efficient attack of the 16-round version and some bounds on the 24-round version. However, these attacks take advantage of the fact that the S-boxes used for Khafre are public; they cannot be applied to Khufu, which uses secret S-boxes, and no attack of Khufu has been proposed so far. In this paper, we present a chosen plaintext attack of the 16-round version of Khufu, which is based on differential properties of this algorithm. The derivation of first information concerning the secret key requires about 231 chosen plaintexts and 231 operations. Our estimate of the resources required for breaking the entire scheme is about 243 chosen plaintexts and about 243 operations.

/pdf/a-chosen-plaintext-attack-of-the-16-round-khufu-cryptosystem-bv58b3d0md.pdf

A Chosen Plaintext Attack of the 16-round Khufu Cryptosystem

A zero-knowledge identification scheme built upon the so-called Permuted Kernel Problem (PKP) was proposed by Adi Shamir in 1989 [1].In this paper, we present a time-memory trade-off leading to a reduction of the computation time for solving the PKP problem, as compared with the best known attack mentioned in [1].

/pdf/on-the-security-of-the-permuted-kernel-identification-scheme-je89qc8ngv.pdf

On the Security of the Permuted Kernel Identification Scheme

In 1989, Adi Shamir published a new asymmetric identification scheme, based on the intractability of the Permuted Kernel Problem (PKP) [3]. In 1992, an algorithm to solve the PKP problem was suggested by J. Georgiades [2], and also in 1992 T. Baritaud, M. Campana, P. Chauvaud and H. Gilbert [1] have independently found another algorithm for this problem. These algorithms still need huge amount of time and/or memory in order to solve the PKP problem with the values suggested by A. Shamir.In this paper, we will see that it is possible to solve the PKP problem using less time that which was needed in [1] and [2], and much less memory than that needed in [1].First we will investigate how the ideas of [1] and [2] can be combined. This will enable us to obtain a little reduction in the time needed. Then, some new ideas will enable us to obtain a considerable reduction in the memory required, and another small reduction in time.Since our new algorithms are quicker and more practical than previous algorithms they confirm the idea stated in [1] that for strong security requirements, the smallest values (n = 32, m = 16, p = 251) mentioned in [3] are not recommended.

/pdf/improved-algorithms-for-the-permuted-kernel-problem-4s3aky1a4o.pdf

Improved Algorithms for the Permuted Kernel Problem

The invention concerns a method for managing transmission of multimedia contents on a mobile terminal (2) equipped with a security module (3), the multimedia contents being transmitted in encrypted form from a broadcasting server (1) and via a communication network (4). The method includes the following steps: a) sending to the mobile terminal (2) rights of use data for at least one multimedia content; b) storing said rights of use data in the security module (3) of the mobile terminal (2); c) generating a sequence of encryption/decryption keys, the sequence of decryption keys being generated from the rights of use data stored in the security module (3); d) transmitting the multimedia content to the mobile terminal (2), the content being successively encrypted with the keys of the generated sequence of encryption keys; e) receiving the multimedia content by the mobile terminal and decrypting the multimedia content from the decryption keys of the sequence of keys generated in the security module of the mobile terminal.

Security method and device for managing access to multimedia contents

The invention concerns a method whereby the entity starting a communication session generates a session key (KS) using a pseudo-random generator initialised by the secret key (Sa) of the entity and an initial value (VI). The message is encrypted by the session key. The latter can be retrieved by the escrow authority (Ta), which archives the secret key (Sa) and can recover the initial value (VI). The invention is applicable to secure communications.

Pascal Chauvaud

Papers

A Chosen Plaintext Attack of the 16-round Khufu Cryptosystem

On the Security of the Permuted Kernel Identification Scheme

Improved Algorithms for the Permuted Kernel Problem

Security method and device for managing access to multimedia contents

Communication method with encryption key escrow and recovery