From the Publisher:
A valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the area of cryptography, this book provides easy and rapid access of information and includes more than 200 algorithms and protocols; more than 200 tables and figures; more than 1,000 numbered definitions, facts, examples, notes, and remarks; and over 1,250 significant references, including brief comments on each paper.

Handbook of Applied Cryptography

PROBLEM TO BE SOLVED: To solve the problem, wherein it is impossible for an electronic content information provider to provide commercially secure and effective method, for a configurable general-purpose electronic commercial transaction/distribution control system. SOLUTION: In this system, having at least one protected processing environment for safely controlling at least one portion of decoding of digital information, a secure content distribution method comprises a process for encapsulating digital information in one or more digital containers; a process for encrypting at least a portion of digital information; a process for associating at least partially secure control information for managing interactions with encrypted digital information and/or digital container; a process for delivering one or more digital containers to a digital information user; and a process for using a protected processing environment, for safely controlling at least a portion of the decoding of the digital information. COPYRIGHT: (C)2006,JPO&NCIPI

https://apps.dtic.mil/dtic/tr/fulltext/u2/a423264.pdf

Systems and Methods for Secure Transaction Management and Electronic Rights Protection

We will review some of the major results in random graphs and some of the more challenging open problems. We will cover algorithmic and structural questions. We will touch on newer models, including those related to the WWW.

Random graphs

Cryptosystem designers frequently assume that secrets will be manipulated in closed, reliable computing environments. Unfortunately, actual computers and microchips leak information about the operations they process. This paper examines specific methods for analyzing power consumption measurements to find secret keys from tamper resistant devices. We also discuss approaches for building cryptosystems that can operate securely in existing hardware that leaks information.

/pdf/differential-power-analysis-4t7fjmuc7b.pdf

Differential Power Analysis

We study two families of error-correcting codes defined in terms of very sparse matrices "MN" (MacKay-Neal (1995)) codes are recently invented, and "Gallager codes" were first investigated in 1962, but appear to have been largely forgotten, in spite of their excellent properties The decoding of both codes can be tackled with a practical sum-product algorithm We prove that these codes are "very good", in that sequences of codes exist which, when optimally decoded, achieve information rates up to the Shannon limit This result holds not only for the binary-symmetric channel but also for any channel with symmetric stationary ergodic noise We give experimental results for binary-symmetric channels and Gaussian channels demonstrating that practical performance substantially better than that of standard convolutional and concatenated codes can be achieved; indeed, the performance of Gallager codes is almost as close to the Shannon limit as that of turbo codes

/pdf/good-error-correcting-codes-based-on-very-sparse-matrices-3kdz0lhhm4.pdf

Good error-correcting codes based on very sparse matrices

The most significant strategic development in information technology over the past year has been 'trusted computing'. This is popularly associated with Microsoft's 'Palladium' project, recently renamed 'NGSCB'. In this paper, I give an outline of the technical aspects of 'trusted computing' and sketch some of the public policy consequences.

Cryptography and Competition Policy - Issues with 'Trusted Computing'.

PIN entry devices (PEDs) are critical security components in EMV smartcard payment systems as they receive a customer's card and PIN. Their approval is subject to an extensive suite of evaluation and certification procedures. In this paper, we demonstrate that the tamper proofing of PEDs is unsatisfactory, as is the certification process. We have implemented practical low-cost attacks on two certified, widely-deployed PEDs - the Ingenico 13300 and the Dione Xtreme. By tapping inadequately protected smartcard communications, an attacker with basic technical skills can expose card details and PINs, leaving cardholders open to fraud. We analyze the anti-tampering mechanisms of the two PEDs and show that, while the specific protection measures mostly work as intended, critical vulnerabilities arise because of the poor integration of cryptographic, physical and procedural protection. As these vulnerabilities illustrate a systematic failure in the design process, we propose a methodology for doing it better in the future. These failures also demonstrate a serious problem with the Common Criteria. So we discuss the incentive structures of the certification process, and show how they can lead to problems of the kind we identified. Finally we recommend changes to the Common Criteria framework in light of the lessons learned.

/pdf/thinking-inside-the-box-system-level-failures-of-tamper-59f7fgq212.pdf

Thinking Inside the Box: System-Level Failures of Tamper Proofing

Balanced self-checking asynchronous logic for smart card applications

We are generating more data about people’s health and biology, from more sources, than ever before including GP records, hospital notes, laboratory tests, clinical trials, monitoring devices and health apps. Advances in information technology and data science mean that it is becoming easier, cheaper and more valuable to gather, transfer, link, store and analyse these data. This offers significant opportunities to generate new knowledge, improve medical practice, increase service efficiency and drive innovation.

/pdf/the-collection-linking-and-use-of-data-in-biomedical-470d2n2tw0.pdf

The collection, linking and use of data in biomedical research and health care: ethical issues

Previous researchers have designed shared control schemes with a view to minimising the likelihood that participants will conspire to perform an unauthorised act. But, human nature being what it is, systems inevitably fail; so shared control schemes should also be designed so that the police can identify conspirators after the fact. This requirement leads us to search for schemes with sparse access structures. We show how this can be done using ideas from coding theory. In particular, secret sharing schemes based on geometric codes whose dual [n,k,d] codes have d andn as their only nonzero weights are suitable. We determine their access structures and analyse their properties. We have found almost all of them, and established some relations among codes, designs and secret-sharing schemes.

Ross Anderson

Papers

Cryptography and Competition Policy - Issues with 'Trusted Computing'.

Thinking Inside the Box: System-Level Failures of Tamper Proofing

Balanced self-checking asynchronous logic for smart card applications

The collection, linking and use of data in biomedical research and health care: ethical issues

How to Build Robust Shared Control Systems