des block cipher hao qi
DESCRIPTION
DES Block Cipher Hao QiTRANSCRIPT
DESDescription: Feistel, S-box Exhaustive Search, DC and LCModes of Operation
AESDescription: SPN, Branch numberSecurity and EfficiencyModes of Operation
Other CiphersLinear layer Confusion layer
1
2
DES(Data Encryption Standard)
http://en.wikipedia.org/wiki/Data_Encryption_Standard
Confusion: The ciphertext statistics should depend on the plaintext statistics in a manner too complicated to be exploited by the enemy cryptanalyst
Diffusion:Each digit of the plaintext should influence many digits of the ciphertext, and/orEach digit of the secret key should influence many digits of the the ciphertext.
Block cipher: ◦ A repetition of confusion(Substitution) and diffusion(Permutation)◦ Iteration: Weak Strong
3
Claude Shannon
4
Definition: Let Bn denote the set of bit strings of length n. A block cipher is an encryption algorithm E such that EK is
a permutation of Bn for each key K Characteristics
◦ Based on Shannon’s Theorem(1949)◦ Same P => Same C ◦ {|P| = |C|} 64 bit, |P| |K| 56 bit◦ Memoryless configuration◦ Operate as stream cipher depending on mode ◦ Shortcut cryptanalysis (DC, LC etc) in 90’s * DC: Differential Cryptanalysis, LC: Linear Cryptanalysis
5
Provide a high level of security Completely specify and easy to understand Security must depend on hidden key, not
algorithm Available to all users Adaptable for use in diverse applications Economically implementable in electronic
device Efficient to use Able to be validated Exportable * Federal Register, May 15, 1973
6
Based on Lucifer (1972) Developed by IBM and intervened by NSA Adopted Federal Standard by NIST, revised
every 5 years (~’98), 64bit block cipher, 56bit key 16 Round, Nonlinearity : S-box Cryptanalysis like DC, LC, etc. after 1992
* DC:Differential Cryptanalysis, LC : Linear Cryptanalysis
7
If we apply its operation 2 times, it returns to the original value, e.g., f(f(x)) = x.
Type of f-1(x) = f(x)
8
x1 x2
(a) (b)
y1 y2 y1=x1x2
(c)
y1=x1 g(x2)or x1 g(x2,k)
(d)
g
x1 x1 x1x2 x2x2
y2 y2 = x2y1 y2 = x2
9
PK
IP
f
FP
PC-2
C
16 Round
PC-1
Rot RotR0(32)L0(32)
R16 L16
PC-2
64 56
64
Round function
Key Scheduling
10
* Decryption is done by executing round key in the reverse order.
58 50 42 34 26 18 10 260 52 44 36 28 20 12 462 54 46 38 30 22 14 664 56 48 40 32 24 16 857 49 41 33 25 17 9 159 51 43 35 27 19 11 361 53 45 37 29 21 13 563 55 47 39 31 23 15 7
11
cf.) The 58th bit of x is the first bit of IP(x)
40 8 48 16 56 24 64 3239 7 47 15 55 23 63 3138 6 46 14 54 22 62 3037 5 45 13 53 21 61 2936 4 44 12 52 20 60 2835 3 43 11 51 19 59 2734 2 42 10 50 18 58 2633 1 41 9 49 17 57 25
IP & FP have no cryptanalytic significance.
IP FP= IP-1
12
13
8 S-boxes (6 -> 4 bits) each row : permutation of 0-15 4 rows : choose by MSB & LSB of input some known design criteria
◦ not linear (affine)◦ Any one bit of the inputs changes at least two output
bits ◦ S(x) and S(x 001100) differs at least 2bits◦ S(x) S(x 11ef00) for any ef={00.01.10.11}◦ Resistance against DC etc.◦ The actual design principles have never been
revealed (U.S. classified information)
14
Input values mapping order
15
L R 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 150 0 14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7
0 1 0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8 1 0 4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 01 1 15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13
S1(1 0111 0)=11=(1011)2
S1-box 14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7 0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8 4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0 15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13
S2-box 15 1 8 14 6 11 3 4 9 7 2 13 12 0 5 10 3 13 4 7 15 2 8 14 12 0 1 10 6 9 11 5 0 14 7 11 10 4 13 1 5 8 12 6 9 3 2 15 13 8 10 1 3 15 4 2 11 6 7 12 0 5 14 9
16
e.g.) S2(010010)= ?
S3-box 10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8 13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1 13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7 1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12
S4-box 7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15 13 8 11 5 6 15 0 3 4 7 2 12 1 10 14 9 10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4 3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14
17
S4-box is most linear than others.!!!
Short key size : 112 -> 56 bits by NSA
Classified design criteria Revision of standard every 5 yrs after 1977 by NIST
No more standard
18
(P,C) dependency with fixed Key : after 5 round
(K,C) dependency with fixed plaintext : after 5 round
Avalanche effect Cyclic Test : Random function Algebraic structure : Not a group i.e., E(K1, E(K2,P)) E(K3,P)
19
Complementary Prop.If C= E(K,P), C = E(K, P)
Weak Key : 4 keysE(K, E(K,P))=P
Semi-weak Keys : 12 keys (6 pairs)E(K1, E(K2,P))=P
Key Exhaustive Search : 255
20
RSA Data Security Inc’s protest against US’s export control(‘97)◦ $10,000(‘97) award ◦ Key search machine by Internet Loveland’s
Rocker Verser ◦ 60.1 Billion/1 day key search, succeeded in 18
quadrillion operations and 96 days 25% of Total 72 quadrillion (1q=1015 =0.1 kyung)90MHz, 16MB Memory Pentium(700 Million/sec)
◦ http://www.rsa.com/des/
21
Distributed.Net + EFF ◦ 100,000 PC on Network◦ 56hr
EFF(Electronic Frontier Foundation)◦ http://www.eff.org/
DEScracker◦ Specific tools ◦ 22hr 15min◦ 250,000$
22
P. Kocher
Cost-Optimized Parallel Code Breaker Machine by Univ. of Bochum, Germany and Kiel
Commercially available 120 FPGA’s of type XILINX Spartan3-1000 run in parallel
10,000$ of ¼ of EFF project
23
FEAL, GOST, IDEA, LOKI, SKIPJACK, MISTY, SEED
TEA (Tiny Encryption Algorithm) for RFID/USN, XTEA, XXTEA
ARIA, Serpent, Baseking, BATON, BEAR&LION, C2, Camellia, CAST-128,256, CIPHERUNICORN,CMEA, Cobra, Coconut98, Crypton, DEAL, E2, FROG, G-DES, Hasty Pudding Cipher, Hierocrypt,MUITL2, New Data Seal, SAFER-64,128, SHACAL, Square, Xenon, etc….
24
25
Algorithm Year Country Pt/Ct Key Round
DES 1977 USA 64 56 16
FEAL 1987 Japan 64 64 4,8,16,32
LOKI 1991 Australia 64 64 16
SEED 1998 Korea 128
128
16
IDEA 1990 Swiss 64 128 8
MISTY 1996 Japan 64 >8
128
SKIPJACK 1990 USA 64 3280
GOST 1989 Russia 64 256 32
26
AES (Rijndael)
Joan Daemen and Vincent Rijmen, “The Design ofRijndael, AES – The Advanced Encryption Standard”,Springer, 2002, ISBN 3-540-42580-2
FIPS Pub 197, Advanced Encryption Standard (AES),December 04, 2001
Rijndael : variable, AES : fixedVincent
Block cipher ◦128-bit blocks◦128/192/256-bit keys
Worldwide-royalty free More secure than Triple DES More efficient than Triple DES
27
28
◦ Jan. 2, 1997 : Announcement of intent to develop AES and request for comments
◦ Sep. 12, 1997 : Formal call for candidate algorithms◦ Aug. 20-22, 1998 : First AES Candidate Conference and
beginning of Round 1 evaluation (15 algorithms), Rome, Italy
◦ Mar. 22-23, 1999 : Second AES Candidate Conference, NY, USA
◦ Sep. 2000 : Final AES selection (Rijndael !)
Jan. 1997Call for
algorithms
Aug. 1998AES1
15 algorithms
Mar. 1999AES2
5 algorithms selected
Apr. 2000AES3
Announce winner in Sep, 2000
15 algorithms are proposed at AES1 conference
29
After AES2 conference, NIST selected the following 5 algorithms as the round 2 candidate algorithm.
30
Cipher Submitter Structure Nonlinear Component
MARS IBM Feistel structure Sbox DD-Rotation
RC6 RSA Lab. Feistel structure Rotation
Rijndael Daemen, Rijmen SPN structure Sbox
Serpent Anderson, Biham, Knudsen
SPN structure Sbox
Twofish Schneier et. al Feistel structure Sbox
Alg. (Round) Structure Rounds (Key size) Type of Attack Texts Mem.
Bytes Ops
MARS16 Core (C)
16 Mixing (M)Feistel
11C Amp. Boomerang 265 270 2229
16M, 5C16M, 5C
Diff. M-i-MAmp. Boomerang
250
269
2197
273
2247
2197
RC6(20) Feistel14 Stat. Disting. 2118 2112 2122
1215 (256)
Stat. Disting.Stat. Disting.
294
2119
242
2138
2119
2215
Rijndael10 (128)12 (192)14 (256)
SPN
6 Truncated Diff. 232 7*232 272
78 (256)9 (256)
Truncated Diff.Truncated Diff.Related Key
2128~ 2119
2128~ 2119
277
261
2101
NA
2120
2204
2224
Serpent(32)SPN
8 (192,256) Amp. Boomerang 2113 2119 2179
6 (256)6
7 (256)8 (192,256)
9 (256)
Meet-in-MiddleDifferentialDifferentialBoomerang
Amp. Boomerang
512271
241
2122
2110
2246
275
2126
2133
2212
2247
2103
2248
2163
2252
Twofish(16) Feistel 6 (256) Impossible Diff. NA NA 2256
31
32
Proposed by Joan Daemen, Vincent Rijmen(Belgium)Design choices
– Square type – Three distinct invertible uniform transformations(Layers)
Linear mixing layer : guarantee high diffusion Non-linear layer : parallel application of S-boxes Key addition layer : XOR the round key to the intermediate state
– Initial key addition, final key additionRepresentation of state and key
– Rectangular array of bytes with 4 rows (square type)– Nb : number of column of the state (4~8)– Nk : number of column of the cipher key (4~8)– Nb is independent from Nk
33
State (Nb=6) Key (Nk=4)
Number of rounds (Nr)
Block size: 128 Key size: 128/192/256 bit
Component Functions◦ ByteSubstitution(BS): S-
box◦ ShiftRow(SR):
CircularShift ◦ MixColumn(MC): Linear(Branch number: 5) ◦ AddRoundKey(ARK):
Omit MC in the last round.
34
Bit-wise key addition
Shift-Low(SR)
Mix-Column(MC)
Bit-wise key addition
Byte-wise substitution(BS)
BS, SR, ARK
44 bytearray Input
Input whitening
Roundtransformation
Outputtransformation
Output
Substitution-Permutation Network (SPN)◦ (Invertible) Nonlinear Layer: Confusion◦ (Invertible) Linear Layer: Diffusion
Branch Number◦ Measure Diffusion Power of Linear Layer◦ Let F be a linear transformation on n words.◦ W(a): the number of nonzero words in a. ◦ (F) = mina0 {W(a) + W(F(a))}◦ Rijndael: branch number =5
35
K-secure ◦ No shortcut attacks key-recover attack faster than
key-exhaustive search◦ No symmetry property such as complementary in
DES◦ No non-negligible classes of weak key as in IDEA◦ No Related-key attacks
Hermetic ◦ No weakness found for the majority of block
ciphers with same block and key length Rijndael is k-secure and hermetic
36
37
Mode of Operations
38
ECB (Electronic CodeBook) mode
EK
P
C
n
n
DK
C
P
n
n
i) Encryption ii) Decryption
IF Ci = Cj,DK(Ci) = DK(Cj)
CBC (Cipher Block Chaining)
39
P1 P2
IV
E E
C1 C2
E
Pl
Cl
IV
D D
P1 P2
D
Pl
C1 C2 Cl
Ci = EK(Pi Ci-1)
Pi = DK(Ci) Ci-1
IV : Initialization Vector
- 2 block Error Prog.- self-sync- If |Pl| |P|, Padding req’d
K
K
KK
KK
40
m-bit OFB (Output FeedBack)
m-bit
Pi
- No Error Prog.- Req’d external sync- Stream cipher- EK or DK
Ci = Pi O(EK)Pi = Ci O(EK)
I) Encryption II) Decryption
IV
E m-bit
Pi Ci
K
IV
E
Ci
K
41
m-bit CFB (Cipher FeedBack)
IV
E m-bit
Pi Ci
IV
Em-bit
Ci Pi
- Error prog. till an error disappears in the buffer- self-sync- EK or DK
Ci = Pi EK(Ci-1)Pi = Ci EK(Ci-1)
I) Encryption II) Decryption
K K
Counter mode
42
Ci = Pi EK(Ti)Pi = Ci EK(Ti)Ti = ctr+i -1 mod 2m
|P|, |ctr|= m,Parallel computation
P1
ctr
E
C1
C2
P2
Cm-1
K
ctr+1
E
ctr+m-1
EK K
Pm-1
C1
ctr
E
P1 P2
C2
Pm-1
K
ctr+1
E
ctr+m-1
EK K
Cm-1
CCM mode (Counter with CBC-MAC mode) Ctr + CBC Authenticated encryption by producing a
MAC as a part of the encryption process
43
Use of mode◦ ECB : key management, useless for file
encryption ◦ CBC : File encryption, useful for MAC ◦ m-bit CFB : self-sync, impossible to use
channel with low BER ◦ m-bit OFB : external-sync. m= 1, 8 or n◦ Ctr : secret ctr, parallel computation◦ CCM : authenticated encryption◦ Performance Degradation/ Cost Tradeoff
44
45
Differential Cryptanalysis
Introduction◦ Biham and Shamir : CR90, CR92◦ Efficient than Key Exhaustive Search ◦ Chosen Plaintext Attack◦ O(Breaking DES16) ~ 247
◦ Utilize the probabilistic distribution between input XOR and output XOR values Iteratively
◦ Stimulate to announce hidden criteria of DES [Cop92] ◦ Apply to other DES-like Ciphers * E.Biham, A. Shamir,”Differential Cryptanalysis of the Data Encryption Standard”, Springer-
Verlag, 1993
46
Discard linear components(IP, FP) Properties of XOR (X’ = X X* )
◦ {E,P,IP} : (P(X))’=P(X) P(X*)=P(X’)◦ XOR : (X Y)’=(X Y) (X* Y*)=X’ Y’◦ Mixing key : (X K)’=(X K) (X* K)=X’◦ Differences(=xor) are linear in linear operation and in
particular the result is key independent.
47
48
X’ = {0,1,…63}, Y’= {0,1,…15} For a given S-box, pre-compute the number of count of X’ and Y’ in a table * % of entry in DES S-boxes : 75 ~ 80%
X X*
Si-box
Y Y*
Y’
X’
XDTSi-box
49
2-round characteristic in S1 box (0Cx --> Ex with 14/64)
50
F
(00 80 82 00 60 00 00 00x)
F
(60 00 00 00 00 00 00 00x)
a’=60000000x p=14/64A’=00808200x
=P(E0000000x)
b’=0xB’=0x p=1
0110 0C=001100 E=1110
(1) Choose suitable Plaintext (Pt) XOR.(2) Get 2 Pts for a chosen Pt and obtain the
corresponding Ct by encryption (3) From Pt XOR and pair of Ct, get the expected
output XOR for the S-boxes of final round.(4) Count the maximum potential key at the final round
using the estimated key (5) Right key is a subkey of having large number of
pairs of expected output XOR
51
Self-concatenating probability Best iterative char. of DES
52
F
(19 60 00 00 00 00 00 00x)
F
(00 00 00 00 19 60 00 00x)
a’=0x p1=1A’=0x
b’=19 60 00 00x
E(b)=03 32 2C 00 00 00 00 00x
B’=0x p2 =14 x 8 x 10 / 643
= 1/234
53
Linear Cryptanalysis
Introduction◦ Matsui : EC931, CR942
◦ Known Plaintext Attack◦ O(Breaking DES16) ~ 243
12 HP W/S, 50-day operation◦ Utilize the probabilistic distribution between input
linear sum and output linear sum values Iteratively◦ Duality to DC : XOR branch vs.three-forked branch◦ Apply to other DES-like cryptosytems1. M.Matsui,”Linear Cryptanalysis Method for DES Cipher”, Proc. Of Eurocrypt’93,LNCS765, pp.386-397
2. M.Matsui,”The First Experimental Cryptanalysis of the Data Encryption Standard”, Proc. Of Crypto’94,LNCS839, pp.1-11.
54
55
Fi
Y i
X i-1 X i
K i
X i-1 Yi Xi
XOR branch after f-ft. i.e., DC goes downstream through f-ft.Xi = Xi-2 Yi-1 (3 i n)with {i=1}
n pi
Xi : Xi’s Differential value
Xi
Y i
X i
Y i-1
Y i
Y i
K i
Yi-1Xi
3-forked branch before f-ft. i.e.,LC goes upstream through f-ft. Yi = Yi-2 Xi-1 (3 i n)with 2n-1{i=1}
n |pi -1/2| Xi-1 : Xi-1’s Masking value
Fi
DC LC
(Goal) : Find linear approximation P[i1,i2,…,ia] C[j1,j2,…,jb]=K[k1,k2,…,kc]
with significant prob. p ( ½) where A[i,j,…,k]=A[i] A[j] … A[k]
(Algorithm)MLE(Maximum Likelihood Estimation)(Step 1) For given P and C, compute X=P[i1,i2,…,ia] C[j1,j2,…,jb],
let N = # of Pt given,(Step 2) if |X=0| > N/2 K[k1,k2,…,Kc]=0 else 1. if |X=0| < N/2 K[k1,k2,…,kc]=1 else 0.
56
For a S-box Sa,(a=1,2,…,8) of DESNSa(,)= #{x | 0 x < 64, parity(x) = parity(S(x))}
1 63 , 1 15, : dot product (bitwise AND)
Ex) NS5(16,15) =12◦ The 5-th input bit at S5-box is equal to the linear sum of 4 output
bits with probability 12/64. ◦ X[15] F(X,K)[7,18,24,29]=K[22] with 0.19◦ X[15] F(X,K)[7,18,24,29]=K[22] 1 with 1-0.19=0.81
(Note) least significant at the right and index 0 at the least significant bit (Little endian)
57
58
59
F1
F2
[15]
p1=12/64[7,18,24,29]
F3 p3=12/64
PPH
PL
K1
X1
K2
X2
[7,18,24,29] X3
K3[15]
[22]
[22]
C
X2[7,18,24,29] PH[7,18,24,29] PL[15] = K1[22] ---------- (1)
X2[7,18,24,29] CH[7,18,24,29] CL[15] = K3[22] ---------- (2)
CHCL
(1) (2) => X2[7,18,24,29] CH[7,18,24,29] CL[15] X2[7,18,24,29] PH[7,18,24,29] PL[15] = K1[22] K3[22] holding prob. = (p1 * p3 ) + (1 - p1) *(1-p3)* Discard IP and FP like DC
If independent prob. value, Xi ‘s ( 1 i n ) have prob pi to value 0, (1-pi) to value 1, p = {prob(X1 X2 … Xn ) = 0} is
p = 2n-1i=1n(pi - 1/2) +1/2.
The number of known pt req’d for LC with success prob. 97.7% is |p - 1/2|-2
60
Key size expansion◦Double Encryption
ek:E2(K2,E1(K1,P)), dk:D1(K1,D2(K2,C))Meet-in-the-middle attackNo effectiveness
◦Triple Encryption ek:E(K1,D(K2,E(K1,P))), dk:D(K1,E(K2,D(K1,C))) ek:E(K1,D(K2,E(K3,P))), dk:D(K3,E(K2,D(K1,C)))112 or 168 bits
61
62
Side Channel Attack
Traditional Cryptographic Model vs. Side Channel
63
Power Consumption / Timing / EM Emissions / Acoustic
Radiation / Temperature / Power Supply / Clock Rate, etc.
E() D()
Key
Attacker
Ke Kd
C
C=E(P,Ke)P=D(C,Kd)
Insecure channel
Secure channel
P D
☆ J. DAEMEN AND V. RIJMEN. The Design of Rijndael.AES - The Advanced Encryption Standard. Springer, 2002. 배성호 1
PT #1
★ M. E. HELLMAN. A cryptanalytic time-memory trade-off. IEEE Transactions of Information Theory, 26 (1980), 401-406. 임준현 2
☆ E. BIHAM AND A. SHAMIR. Differential cryptanalysis of the full 16-round DES. LNCS 740 (1993), 494-502. (CRYPTO '92) 장래영 3
☆ M. BELLARE AND P. ROGAWAY. Optimal asymmetric encryption. Lecture Notes in Computer Science, 950 (1995), 92-111. (EUROCRYPT '94) 조준희 4
☆ S. GOLDWASSER AND S. MICALI. Probabilistic encryption. Journal of Computer and Systems Science, 28 (1984), 270-299. 황대성 5
★J. H. Moore. Protocol failures in cryptosystems. In Contemporary Cryptology, The Science of Information Integrity, pages 541-558. IEEE Press, 1992.
남궁호 6
PT#2
☆M. BELLARE, J. KILIAN AND P. ROGAWAY. The security of the cipher block chaining message authentication code. Journal of Computer and System Sciences, 61 (2000), 362-399.
장래영 7
★ W. DIFFIE AND M. E. HELLMAN. New directions in cryptography. IEEE Transactions on Information Theory, 22 (1976), 644-654. 조준희 8
★ M. MATSUI. Linear cryptanalysis method for DES cipher. LNCS 765 (1994), 386-397. (EUROCRYPT '93) 배성호 9
☆M. BELLARE AND P. ROGAWAY. Random oracles are practical: a paradigm for designing efficient protocols. In First ACM Conference on Computer and Communications Security, pages 62-73. ACM Press, 1993.
김영삼 10
64
65
☆N. T. COURTOIS AND J. PIEPRZYK. Cryptanalysis of block ciphers with overdefined systems of equations. LNCS 2501 (2002), 267-287. (ASIACRYPT 2002)
조준희 11
PT#3
☆S. C. POHLIG AND M. E. HELLMAN. An improved algorithm for computing logarithms ove GF(p) and its cryptographic significance. IEEE Transations on Information Theory, 24 (1978), 106-110.
황대성 12
☆ M. J. WIENER. Cryptanalysis of short RSA secret exponents. IEEE Transations on Inforamtion Theory, 36 (1990), 553-558. 남궁호 13
★T. ELGAMAL. Apublic key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory, 31 (1985), 469-472.
장래영 14
☆ D. CHAUM AND H. VAN ANTWERPEN. Undeniable signature. LNCS 435 (1990), 212-216. (CRYPTO '89) 신지강 15
☆☆P. BEAUCHEMIN AND G. BRASSARD, C. CREPEAU, C. GOUTIER and C. POMERANCE. The generation of random numbers that are probably prime. Journal of Cryptology, 1 (1988), 53-64.
남궁호 16
PT#4
☆☆M. BELLARE AND P. ROGAWAY. The exact security of digital signatures: how to sign with RSA and Rabin. LNCS, 1070(1996), 399-416. (EUROCRYPT '96)
임준현 17
★A. FIAT AND A. SHAMIR. How to prove yourself: practical solutions to identification and signature problems. LNCS 263 (1987), 186-194. (CRYPTO '86)
김영삼 18
☆☆ M. BELLARE. Practice-oriented provable-security. In Lectures on Data Security, pages 1-15. Springer, 1999. 신지강 19
★ A. FIAT AND M. NAOR. Broadcast encryption. LNCS 773 (1994), 480-491. (CRYPTO '93) 황대성 20
66
☆ M. BURMESTER AND Y. DESMEDT. A secure and efficient conference key distribution system. LNCS 250 (1994), 275-286 (EUROCRYPT '94) 김영삼 21
PT#5★ U. FEIGE, A. FIAT AND A. SHAMIR. Zero-knolwedge proofs of identity. Journal
of Cyrptology, 1 (1988), 77-94 신지강 22
☆ C. P. SHNORR. Efficient signature generation by smart cards. Journal of Cryptology, 4 (1991), 161-174. 임준현 23
☆ D. E. DENNING AND G. M. SACCO. Timestamps in key distribution protocols. Communications of the ACM 24 (1981), 533-536. 배성호 24
★ : 필수 , ☆: 난이도 1, ☆☆: 난이도 2( 가산점 )