No abstract

In this paper, we study algorithm substitution attacks (ASAs), where an algorithm in a cryptographic scheme is substituted for a subverted version. First, we formalize and study the use of state resets to detect ASAs, and show that many published stateful ASAs are detectable with simple practical methods relying on state resets. Second, we introduce two asymmetric ASAs on symmetric encryption, which are undetectable or unexploitable even by an adversary who knows the embedded subversion key. We also generalize this result, allowing for any symmetric ASA (on any cryptographic scheme) satisfying certain properties to be transformed into an asymmetric ASA. Our work demonstrates the broad application of the techniques first introduced by Bellare, Paterson, and Rogaway (Crypto 2014) and Bellare, Jaeger, and Kane (CCS 2015) and reinforces the need for precise definitions surrounding detectability of stateful ASAs.

We consider the integer Chebyshev problem, that of minimizing the supremum norm over polynomials with integer coefficients on the interval [0, 1]. We implement algorithms from semi-infinite programming and a branch and bound algorithm to improve on previous methods for finding integer Chebyshev polynomials of degree n. Using our new method, we found 16 new integer Chebyshev polynomials of degrees in the range 147 to 244.Here this constant is explicitly computable to an arbitrary number of digits. See [11,18] for details. In [5] it was shown that the lower bound coming from this infinite family is in fact not best possible. That is, there exists an ǫ > 0 such that t Z ([0, 1]) ≥ 0.4207263 · · · + ǫ. At the time no non-trivial lower bound for ǫ was determined. Pritsker showed in [19], by means of weighted potential theory, that t Z ([0, 1]) ≥ 0.4213. Generalizations of these Gorshkov-Wirsing polynomails were considered in [15].Given the submultiplicative nature of t Z,n (I) we have t Z (I) ≤ t Z,n (I) for all n. This gives a simple method to find an upper bound for t Z (I); find large degree polynomials with small supremum norm. In [5] a set of 9 polynomials p i (x) and exponents a i were found such that the resulting polynomial P (x) = p 1 (x) a1 . . . p 9 (x) a9 had small supremum norm. This was used to show that t Z ([0, 1]) ≤

No abstract

No abstract