Abstract. We give a simple and efficient construction of a verifiable random function (VRF) on bilinear groups. Our construction is direct. In contrast to prior VRF constructions [14,15], it avoids using an inefficient Goldreich-Levin transformation, thereby saving several factors in security. Our proofs of security are based on a decisional bilinear Diffie-Hellman inversion assumption, which seems reasonable given current state of knowledge. For small message spaces, our VRF's proofs and keys have constant size. By utilizing a collision-resistant hash function, our VRF can also be used with arbitrary message spaces. We show that our scheme can be instantiated with an elliptic group of very reasonable size. Furthermore, it can be made distributed and proactive.

We propose a simple game for modeling containment of the spread of viruses in a graph of n nodes. Each node must choose to either install anti-virus software at some known cost C, or risk infection and a loss L if a virus that starts at a random initial point in the graph can reach it without being stopped by some intermediate node. We prove many game theoretic properties of the model, including an easily applied characterization of Nash equilibria, culminating in our showing that a centralized solution can give a much better total cost than an equilibrium solution. Though it is NP-hard to compute such a social optimum, we show that the problem can be reduced to a previously unconsidered combinatorial problem that we call the sum-of-squares partition problem. Using a greedy algorithm based on sparse cuts, we show that this problem can be approximated to within a factor of O(log 1.5 n).

We propose a formal model for data entanglement as used in storage systems like Dagster [25] and Tangler [26]. These systems split data into blocks in such a way that a single block becomes a part of several documents; these documents are said to be entangled. Dagster and Tangler use entanglement in conjunction with other techniques to deter a censor from tampering with unpopular data. In this paper, we assume that entanglement is a goal in itself. We measure the strength of a system by how thoroughly documents are entangled with one another and how attempting to remove a document affects the other documents in the system. We argue that while Dagster and Tangler achieve their stated goals, they do not achieve ours. In particular, we prove that deleting a typical document in Dagster affects, on average, only a constant number of other documents; in Tangler, it affects virtually no other documents. This motivates us to propose two stronger notions of entanglement, called dependency and all-or-nothing integrity. All-or-nothing integrity binds the users' data so that it is hard to delete or modify the data of any one user without damaging the data of all users. We study these notions in six submodels, differentiated by the choice of users' recovery algorithms and restrictions placed on the adversary. In each of these models, we not only provide mechanisms for limiting the damage done by the adversary, but also argue, under reasonable cryptographic assumptions, that no stronger mechanisms are possible.

We propose a formal model for data entanglement as used in storage systems like Dagster [25] and Tangler [26]. These systems split data into blocks in such a way that a single block becomes a part of several documents; these documents are said to be entangled. Dagster and Tangler use entanglement in conjunction with other techniques to deter a censor from tampering with unpopular data. In this paper, we assume that entanglement is a goal in itself. We measure the strength of a system by how thoroughly documents are entangled with one another and how attempting to remove a document affects the other documents in the system. We argue that while Dagster and Tangler achieve their stated goals, they do not achieve ours. In particular, we prove that deleting a typical document in Dagster affects, on average, only a constant number of other documents; in Tangler, it affects virtually no other documents. This motivates us to propose two stronger notions of entanglement, called dependency and all-or-nothing integrity. All-or-nothing integrity binds the users' data so that it is hard to delete or modify the data of any one user without damaging the data of all users. We study these notions in six submodels, differentiated by the choice of users' recovery algorithms and restrictions placed on the adversary. In each of these models, we not only provide mechanisms for limiting the damage done by the adversary, but also argue, under reasonable cryptographic assumptions, that no stronger mechanisms are possible.

Abstract. We introduce a new cryptographic primitive called the blind coupon mechanism (BCM). In effect, the BCM is an authenticated bit commitment scheme, which is AND-homomorphic. It has not been known how to construct such commitments before. We show that the BCM has natural and important applications. In particular, we use it to construct a mechanism for transmitting alerts undetectably in a message-passing system of n nodes. Our algorithms allow an alert to quickly propagate to all nodes without its source or existence being detected by an adversary, who controls all message traffic. Our proofs of security are based on a new subgroup escape problem, which seems hard on certain groups with bilinear pairings and on elliptic curves over the ring Zn.