Recently the use of public key encryption to provide secure network communication has received considerable attention. Such public key systems are usually effective against passive eavesdroppers, who merely tap the lines and try to decipher the message. It has been pointed out, however, that an improperly designed protocol could be vulnerable to an active saboteur, one who may impersonate another user or alter the message being transmitted. Several models are formulated in which the security of protocols can be discussed precisely. Algorithms and characterizations that can be used to determine protocol security in these models are given.

/pdf/on-the-security-of-public-key-protocols-piwr7z9kcr.pdf

On the security of public key protocols

Model Checking

In many cases tests of a program that uncover simple errors are also effective in uncovering much more complex errors. This so-called coupling effect can be used to save work during the testing process.

Hints on Test Data Selection: Help for the Practicing Programmer

1 Introduction.- 2 Definitions and First Properties of Computation.- 3 Computation over a Ring.- 4 Decision Problems and Complexity over a Ring.- 5 The Class NP and NP-Complete Problems.- 6 Integer Machines.- 7 Algebraic Settings for the Problem "P ? NP?".- 8 Newton's Method.- 9 Fundamental Theorem of Algebra: Complexity Aspects.- 10 Bezout's Theorem.- 11 Condition Numbers and the Loss of Precision of Linear Equations.- 12 The Condition Number for Nonlinear Problems.- 13 The Condition Number in ?(H(d).- 14 Complexity and the Condition Number.- 15 Linear Programming.- 16 Deterministic Lower Bounds.- 17 Probabilistic Machines.- 18 Parallel Computations.- 19 Some Separations of Complexity Classes.- 20 Weak Machines.- 21 Additive Machines.- 22 Nonuniform Complexity Classes.- 23 Descriptive Complexity.- References.

Complexity and Real Computation

Mutation Testing is a fault-based software testing technique that has been widely studied for over three decades The literature on Mutation Testing has contributed a set of approaches, tools, developments, and empirical results This paper provides a comprehensive analysis and survey of Mutation Testing The paper also presents the results of several development trend analyses These analyses provide evidence that Mutation Testing techniques and tools are reaching a state of maturity and applicability, while the topic of Mutation Testing itself is the subject of increasing interest

An Analysis and Survey of the Development of Mutation Testing

A particular protection mechanism from the protection hterature-the take and grant system--is presented For this particular mechanism, it is shown that the safety problem can be solved in linear time Moreover the security policies that this mechanism can enforce are characterized The theoretical analysis of systems for protectmg the security of reformation should be of interest to the practmoner as well as the theorehctan The practitioner must convince users that the integrity of their programs and files is maintained; Le he must convince them that the operating system and its mechanisms will correctly protect these programs and files Vague or informal arguments are unacceptable since they are often wrong Indeed the folklore is replete with stones of "secure" systems being compromised m a matter of hours A primary reason for the abundance of these incidents is that even a small set of apparently simple protection pnmmves can often lead to complex systems that can be exploited, and therefore compromised, by some adversary But it is preosely this fact, simple primitives with complex behavior, that lures the theoretician Our purpose here is to present a concrete example of a protection system and then to completely analyze its behavior Our motivation for doing this analysis ~s twofold The protection system that we study ~s not one we invented, rather it appears, for example, in Cohen (1) Moreover it is closely related to systems studied m Denning and Graham (2) and Jones (4) This point is most important, for the space of possible protection systems is exceedingly nch and it is trivial to think up arbitrary systems to study We are interested not in arbitrary systems, but in systems that have practical apphcahon The above motivation is necessary but not sufficient for us to establish that these questions should interest the theoreticmn Our second reason for studying these prob- lems is that m a natural way they can be viewed as "generahzat~ons of transitive closure" Informally, our model is:

http://flint.cs.yale.edu/cs428/doc/liptonTG.pdf

A Linear Time Algorithm for Deciding Subject Security

Extending a result of Rabin, It Is shown that the word problem for hnear groups (groups of matrices) over a field of characteristic 0 is solvable in (deterministic) logspace As an apphcatlon of this result, it follows that the word problem for free groups and hence the membership problem for the two-sided Dyck language are solvable in logspace

Word Problems Solvable in Logspace

In testing for program correctness, the standard approaches [11,13,21,22,23,24,34] have centered on finding data D, a finite subset of all possible inputs to program P, such that1) if for all x in D, P(x) = f(x), then P* = fwhere f is a partial recursive function that specifies the intended behavior of the program and P* is the function actually computed by program P. A major stumbling block in such formalizations has been that the conclusion of (1) is so strong that, except for trivial classes of programs, (1) is bound to be formally undecidable [23].There is an undeniable tendency among practitioners to consider program testing an ad hoc human technique: one creates test data that intuitively seems to capture some aspect of the program, observes the program in execution on it, and then draws conclusions on the program's correctness based on the observations. To augment this undisciplined strategy, techniques have been proposed that yield quantitative information on the degree to which a program has been tested. (See Goodenough [14] for a recent survey.) Thus the tester is given an inductive basis for confidence that (1) holds for the particular application. Paralleling the undecidability of deductive testing methods, the inductive methods all have had trivial examples of failure [14,18,22,23].These deductive and inductive approaches have had a common theme: all have aimed at the strong conclusion of (1). Program mutation [1,7,9,27], on the other hand, is a testing technique that aims at drawing a weaker, yet quite realistic, conclusion of the following nature:(2) if for all x in D, P(x) = f(x), then P* = f OR P is "pathological."To paraphrase,3) if P is not pathological and P(x) = f(x) for all x in D then P* = f.Below we will make precise what is meant by "P is pathological"; for now it suffices to say that P not pathological means that P was written by a competent programmer who had a good understanding of the task to be performed. Therefore if P does not realize f it is "close" to doing so. This underlying hypothesis of program mutation has become known as the competent programmer hypothesis: either P* = f or some program Q "close" to P has the property Q* = f.To be more specific, program mutation is a testing method that proposes the following version of correctness testing:Given that P was written by a competent programmer, find test data D for which P(D) = f(D) implies P* = f.Our method of developing D, assuming either P or some program close to P is correct, is by eliminating the alternatives. Let p be the set of programs close to P. We restate the method as follows:Find test data D such that:i) for all x in D P(x) = f(x) andii) for all Q in p either Q* = P* or for some x in D, Q(x) ≠ P(x).If test data D can be developed having properties (i) and (ii), then we say that D differentiates P from p, alternatively P passes the p mutant test.The goal of this paper is to study, from both theoretical and experimental viewpoints, two basic questions:Question 1: If P is written by a competent programmer and if P passes the p mutant test with test data D, does P* = f?Note that, after formally defining p for P in a fixed programming language L, an affirmative answer to question 1 reduces to showing that the competent programmer hypothesis holds for this L and p.We have observed that under many natural definitions of p there is often a strong coupling between members of p and a small subset µ. That is, often one can reduce the problem of finding test data that differentiates P from p to that of finding test data that differentiates P from µ. We will call this subset µ the mutants of P and the second question we will study involves the so-called coupling effect [9]:Question 2 (Coupling Effect): If P passes the µ mutant test with data D, does P pass the p mutant test with data D?Intuitively, one can think of µ as representing the programs that are "very close" to P.In the next section we will present two types of theoretical results concerning the two questions above: general results expressed in terms of properties of the language class L, and specific results for a class of decision table programs and for a subset of LISP. Portions of the work on decision tables and LISP have appeared elsewhere [5,6], but the presentations given here are both simpler and more unified. In the final section we present a system for applying program mutation to FORTRAN and we introduce a new type of software experiment, called a "beat the system" experiment, for evaluating how well our system approximates an affirmative response to the program mutation questions.

Theoretical and empirical studies on using program mutation to test the functional correctness of programs

On the complexity of computations under varying sets of primitives

The accessibility problem for linear sequential machines [12] is the problem of deciding whether there is an input x such that on x the machine starting in a given state q1 goes to a given state q2. Harrison shows that this problem is reducible to the following simply stated linear algebra problem, which we call the "orbit problem":Given (n, A, x, y), where n is a natural number and A, x, and y are nxn, nx1, and nx1 matrices of rationals, respectively, decide whether there is a natural number I such that Aix=y.He conjectured that the orbit problem is decidable. No progress was made on the conjecture for ten years until Shank [22] showed that if n is fixed at 2, then the problem is decidable. This paper shows that the orbit problem for general n is decidable and indeed decidable in polynomial time. The orbit problem arises in several contexts; two of these, linear recurrences and the discrete logarithm problem for polynomials, are discussed, and we apply our algorithm for the orbit problem in these contexts.

Richard J. Lipton

Papers

A Linear Time Algorithm for Deciding Subject Security

Word Problems Solvable in Logspace

Theoretical and empirical studies on using program mutation to test the functional correctness of programs

On the complexity of computations under varying sets of primitives

Polynomial-time algorithm for the orbit problem