Search

Reliability evaluation of interconnection networks is of significant importance to the design and maintenance of interconnection networks. The extra connectivity is an important parameter for the reliability evaluation of interconnection networks and is a generalization of the traditional connectivity. Let $g\geq 0$ be an integer and $G$ be a connected graph; the $g$-extra connectivity of $G$ is the minimum cardinality of a set of vertices in $G$, if it exists, whose removal disconnects $G$ and leaves every component with more than $g$ vertices. Determining the $g$-extra connectivity is still an unsolved problem in many interconnection networks. Let $n$, $k$ be positive integers. Let $Q_{n,k}\, (1 \leq k \leq n-1)$ denote the $(n, k)$-enhanced hypercube. In this paper, we determine the $g$-extra connectivity of $Q_{n,k}$ is $(n+1)(g+1)-\frac{g(g+3)}{2}$ for $0\leq g\leq n-k-1$, $4\leq k\leq n-5\,(n\geq 9)$. Some previous results in [Zhang, M. and Zhou, J. (2015) On g-extra connectivity of folded hypercubes. Theor. Comput. Sci., 593, 146–153.] and [Sabir, E., Mamut, A. and Vumar, E. (2019) The extra connectivity of the enhanced hypercubes. Theor. Comput. Sci., 799, 22–31.] are extended.

Deoxys-BC is an internal tweakable block cipher of the authenticated encryption algorithm Deoxys, which is a third-round finalist in the CAESAR competition. In this paper, we study the property of Deoxys-BC, such as the subtweakey difference cancelation and the freedom of the tweak. Combining the differential enumeration technique with these properties, the authors achieve the key-recovery attacks on Deoxys-BC under the meet-in-the-middle attack. As a result, we get an attack on 9-round Deoxys-BC-128-128 by constructing a 6-round meet-in-the-middle distinguisher with $2^{113}$ plaintext–tweak combinations, $2^{97}$ Deoxys-BC blocks and $2^{121.6}$ 9-round Deoxys-BC-128-128 encryptions. We also present an attack on 11-round Deoxys-BC-256-128 for the first time by constructing a 7-round meet-in-the-middle distinguisher with $2^{113}$ plaintext-tweak combinations, $2^{226}$ Deoxys-BC blocks and $2^{251}$ 11-round Deoxys-BC-256-128 encryptions.

NewHope cryptosystem is one of the second-round submissions of the National Institute of Standards and Technology post-quantum cryptography standardization process, which is a suite of two key encapsulation mechanisms based on the ring-learning with errors (LWE) problem. It has received much attention from the research community due to its small key size and high efficiency. Recently, three key mismatch attacks are proposed against NewHope under the condition of key reuse. They do not solve the ring-LWE instance directly but exploit the leakage of secret information. As far as we know, the best result is given by Okada et al. ((2020) Improving Key Mismatch Attack on NewHope with Fewer Queries. In Proc. of the 25th Australasian Conf. on Information Security and Privacy, Perth, WA, Australia, November 30–December 2, pp. 505–524. Springer Cham, Switzerland), which recovers the whole secret with a success probability of $97\%$ and $233,803$ average queries. In this paper, we further improve the key mismatch attack of NewHope by reducing the average queries to $106,577$ and raising the success probability to $100\%$. Moreover, we analyze the key mismatch attack without key reuse for the first time and we propose a combinatorial attack against NewHope1024. The total complexity of the combinatorial attack is $2^{253}$, which is lower than the complexity of primal attack and the claimed security strength of NewHope1024.

Public-key cryptographic primitives are time consuming for resource-constrained devices. A classical problem is to securely offload group exponentiations from a (comparatively) weak device—the client—to an untrusted more powerful device—the server. A delegation protocol must usually meet two security objectives: privacy—the exponent or the base should not be revealed to a passive adversary—and verifiability—a malicious server should not be able to make the client accept an invalid value as the result of the delegated computation. Most proposed protocols relies on a secret splitting of the exponent and the base, and a considerable amount of literature has been devoted to their analysis. Recently, Su et al. (Su, Q., Zhang, R. and Xue, R. (2020) Secure outsourcing algorithms for composite modular exponentiation based on single untrusted cloud. Comput. J., 63, 1271.) and Rangasamy and Kuppusamy (Rangasamy, J. and Kuppusamy, L. (2018) Revisiting Single-Server Algorithms for Outsourcing Modular Exponentiation. In Chakraborty, D. and Iwata, T. (eds), Progress in Cryptology - INDOCRYPT 2018: 19th International Conference in Cryptology in India, New Delhi, India, December 912, Vol. 11356, Lecture Notes in Computer Science. Springer, Heidelberg, Germany, pp. 320. proposed outsourcing protocols for modular exponentiations. They claim that their protocols achieve security (privacy and verifiability). We show that these claims are flawed and that their schemes are broken beyond repair. They remain insecure even if one increases significantly the proposed parameters (and consequently the protocols computational and communication complexities). Our attacks rely on standard lattice-based cryptanalytic techniques, namely the Coppersmith methods to find small integer zeroes of modular multivariate polynomials and simultaneous Diophantine approximation methods for the so-called approximate greatest common divisor problem.

With the help of a multi-signature scheme, we can reduce the cost of storage and bandwidth in case of many signers signing the same message. Therefore, multi-signature schemes can be used in bitcoin to reduce the size of a blockchain. In this paper, we propose a lattice-based multi-signature scheme with the following highlighted features. Our lattice-based multi-signature scheme supports signature compression and public key aggregation. The only existing lattice-based multi-signature scheme by Kansal and Dutta (Africacrypt, 2020) that supports both signature compression and public key aggregation has communication and storage cost $\widetilde{\mathcal{O}}(n^2)$, whereas our communication and storage cost is $\mathcal{O}(n)$. Our multi-signature scheme is in the plain public key model where the special registration of the public key is not necessary and it is secure under the rogue key attack. Our multi-signature scheme is secure under the hardness of ring short integer solution problem in the random oracle model.

Lattice-based online/offline signature is attractive for the merit of resisting quantum attacks besides the short online response time. Prior to this work, the hash-sign-switch paradigm lattice-based online/offline signatures usually increase the length of each signature, and the Fiat–Shamir candidates are highly inefficient due to multiple aborts in online signing phase. In this work we mainly address its efficient issue and propose a new paradigm of its construction in the perspective of abort. In this paradigm, one tries to remove one or more aborts from online to offline signing phase by $\Gamma $-transformation. Specifically, this work proposes an efficient lattice-based online/offline signature scheme with fewer online aborts and thus allows the signer to obtain a valid signature by fewer online repetitions. Through this way, the resulting scheme can reduce much online signing time with the same signature size. The performance evaluation shows that our scheme is efficient and practical.

Cognitive Radio network (CRN) depends on opportunistic spectrum access and spectrum sensing for improving the wireless networks’ spectrum efficiency. Since throughput maximization can result in high-energy consumption, the spectrum sensing technique should address the energy-throughput trade-off. The spectrum sensing time has to be determined by the considering the residual battery energies of each secondary user (SU). The primary user (PU) interference degrades the throughput of the entire network. Hence, the transmit power level should be determined by considering the PU interference and SU battery energy. This paper proposes the multi-objective brain storm optimization (MBSO) algorithm for handling energy-throughput trade-off in CRN. In this work, the sensing time is adaptively determined based on the residual battery energy of SUs, and the transmit power is determined based on the energy level of the PU signal and the residual battery energy of the SUs. A multi-objective optimization problem is formulated in order to maximize the throughput and minimize the packet error rate (PER) and is solved by applying the MBSO algorithm. Experimental results show that MBSO attains improved throughput, higher residual energy with lesser PER. The spectrum sensing performance is enhanced with higher probability of detection.

AEGIS is one of the authenticated encryption with associated data designs selected for the final portfolio of the CAESAR competition. It combines the AES round function and simple Boolean operations to update its large state and extract a keystream to achieve an excellent software performance. The AEGIS family consists of AEGIS-128, AEGIS-256 and AEGIS-128L, which use 5, 6 and 8 parallel AES round functions to process 128, 128 and 256 bits message block per step with slightly different output functions separately. Surprisingly, very few cryptanalytic results on AEGIS have been published so far. This paper presents the first guess-and-determine attacks on AEGIS family. Firstly, we propose a new observation on the structure of AEGIS that the relations of fixed variables remain in the outputs at consecutive steps under some conditions on the AND operations, and the vectorial bitwise AND operation is biased, which is able to derive the additional variables added directly. Secondly, we add several techniques, such as divide and conquer on byte-based columns, reduction by meet in the middle and simplification through constraints on variables, for each AEGIS member. Finally, we conduct guess-and-determine attacks on AEGIS-128, AEGIS-256 and AEGIS-128L and result in a complexity of $2^{309}$, $2^{437}$ and $2^{384}$ to $2^{416}$, respectively. Although neither attack threatens the practical security of AEGIS, it has great significance to evaluate the resistance of such structure compared with their large internal state exploited of 640, 768 and 1024 bits. It is also the first internal state recovery attack on AEGIS without nonce reusing, while only distinguishing attacks on AEGIS exist up to now.

This paper investigates the security of counter mode encryption with authentication tag (COMET), one of the 32 second-round candidates in National Institute of Standards and Technology’s lightweight cryptography standardization process, against differential cryptanalysis. CHAM-64/128 is a block cipher chosen as one of the underlying block ciphers in COMET for hardware-oriented applications, and a differential characteristic with a high probability for CHAM-64/128 is useful for forgery attacks on COMET. However, we find that the optimal $\mathbf{39}$-round differential characteristic for CHAM-64/128 proposed by Roh et al., which is the longest differential characteristic of CHAM-64/128, is invalid. Then, we propose a new method of distinguishing an $\mathbf{m}$-bit block cipher from an $\mathbf{m}$-bit random permutation using a differential characteristic with a probability not higher than $\mathbf{2^{-m}}$. Using our method, we use two $\mathbf{39}$-round differential characteristics with a probability of $\mathbf{2^{-64}}$ for CHAM-64/128 to distinguish $\mathbf{39}$-round-reduced CHAM-64/128 from a $\mathbf{64}$-bit random permutation, respectively. Furthermore, we refine the probabilities of two differentials with the same input and output differential masks as the two $\mathbf{39}$-round differential characteristics, respectively. Finally, we present the first forgery attacks on COMET with the two differentials without using weak keys. Our forgery attacks follow the nonce-misuse scenario. It should be noticed that this attack does not invalidate the security claims of the designers.

Homomorphic message authentication codes (MACs) allow a user to outsource data to an untrusted server and verify the correctness of returned computation results over the outsourced data. Many cloud applications need delegation computations over outsourced data with dual capabilities. On one hand, they need to keep the outsourced data secret such that the server cannot trace and infer any sensitive information from the computation results. On the other hand, the user should be able to efficiently verify the computation results. Unfortunately, the state-of-the-art homomorphic MAC schemes are not so desirable due to either poor privacy or low verification efficiency. In this paper, we first put forward a new cryptographic primitive called privacy-preserving homomorphic MACs (PHMAC) that simultaneously provides data privacy and efficient verification. Then, we present a PHMAC construction capable for the evaluation of polynomials of fixed degree $d\geq 1$, in which the tag does not reveal any information of underlying authenticated data while being verifiable in constant time (in an amortized sense). As an application, we give a generic construction of homomorphic authenticated encryption (HAE) from proposed PHMAC and homomorphic encryption. Benefited from the functionalities of underlying PHMAC scheme, the derived HAE enjoys stronger authenticity and supports larger classes of functions than that of Lai et al. (Verifiable Computation on Outsourced Encrypted Data. In Computer Security—ESORICS 2014—19th European Symposium on Research in Computer Security, Wroclaw, Poland, September 7–11, Part I, pp. 273–291. Springer, Berlin). Such HAE enables verifiable delegation computations over growing outsourced encrypted data in an efficient way.

Connectivity and diagnosability are two crucial subjects for a network’s ability to tolerate and diagnose faulty processors. The $r$-component connectivity $c\kappa _{r}(G)$ of a network $G$ is the minimum number of vertices whose deletion results in a graph with at least $r$ components. The $r$-component diagnosability $ct_{r}(G)$ of a network $G$ is the maximum number of faulty vertices that the system can guarantee to identify under the condition that there exist at least $r$ fault-free components. This paper first establishes that the $(r+1)$-component connectivity of $k$-ary $n$-cube $Q^{k}_{n}$ is $c\kappa _{r+1}(Q^{k}_{n})=-\frac{1}{2}r^{2}+\Big(2n-\frac{1}{2}\Big)r+1$ for $n\geq 2$, $k\geq 4$ and $1\leq r\leq n$. In view of $c\kappa _{r+1}(Q^{k}_{n})$, we prove that the $(r+1)$-component diagnosabilities of $k$-ary $n$-cube $Q^{k}_{n}$ under the PMC model and MM* model are $ct_{r+1}(Q^{k}_{n})=-\frac{1}{2}r^{2}+\Big(2n-\frac{3}{2}\Big)r+2n$ for $n\geq 4$, $k\geq 4$ and $1\leq r\leq n-1$.

The Learning Parity with Noise (LPN) problem represents the average-case analogue of the NP-Complete problem “decoding linear codes”, and it has been extensively studied in learning theory, coding theory and cryptography with applications to quantum-resistant cryptographic schemes. However, LPN also suffers from large public key size which is the common drawback that hinders code-based cryptography from being practical. In this paper, we study a sparse variant of LPN whose public matrix consists of sparse vectors instead of following uniform distribution. We show a win–win argument that at least one of the following assumption is true: (i) either the hardness of sparse LPN is implied by that of the standard LPN under the same noise rate; (ii) or there exists new black-box constructions of public-key encryption schemes and oblivious transfer protocols from standard LPN. Since the second assumption relies on the infeasible noise regimes for LPN-based public-key cryptography, we believe that the first assumption is more likely to hold, i.e. sparse LPN is as hard as standard LPN. Finally, we give a (heuristic) method to further compress the sparse public matrix by evaluating pseudorandom functions with keys made public, whose security again resorts to the aforementioned win–win technique.

The (conditional) matching preclusion number of a graph is the minimum number of edges whose deletion leaves the resulting graph (with no isolated vertices) that has neither perfect matchings nor almost perfect matchings. The (conditional) strong matching preclusion number of a graph is the minimum number of vertices and edges whose deletion makes the resulting graph (with no isolated vertices) without perfect matching or almost perfect matching. The enhanced hypercube $Q_{n,k}$ $(1\leq k\leq n-1)$ is an extension of hypercube. In this paper, we prove that the matching preclusion number of $Q_{n,k}$ is $n+1$ $(1\leq k\leq n-1)$, the strong matching preclusion number of $Q_{n,k}$ is $n+1$ $(2\leq k\leq n-1)$, the conditional matching preclusion number of $Q_{n,n-1}$ is $2n-1$, the conditional matching preclusion number of $Q_{n,k}$ is $2n$ $(1\leq k\leq n-2)$ and the conditional strong matching preclusion number of $Q_{n,n-2}$ is $2n-3$ $(n\geq 4)$.

In this paper, we further explore the properties of the verifiable random functions in both a black-box and a non-black-box manner. The results are mainly following two parts: $\bullet $ Black-Box Barrier: It is set up for an impossibility result of black-box reduction from verifiable random functions to injective one-way functions and indistinguishability obfuscators, where the verifiable random functions are suggested to be domain-invariant (i.e. the support of the distribution of keys and the domain of the evaluation space are independent of the underlying building blocks). Our result illustrates how the non-domain-invariant constructions circumvent the black-box barriers for constructing verifiable random functions and sheds light on why it is so difficult to give a domain-invariant instantiation. $\bullet $ Non-Black-Box Construction: On the other hand, the verifiable unpredictable functions are constructed from a given primitive by a non-black-box technique called the hitting-set generator. To show it's a somewhat useful technique for constructing the verifiable unpredictable functions, we further derive a limitation of the black-box barrier by proving the barrier still holds between the given primitive and verifiable unpredictable functions. Our results not only analyse the properties of verifiable random functions theoretically, but also reveal the limitation of indistinguishability obfuscators in a black-box manner, and show the advantages by adopting non-black-box techniques.

Secret key leakage has become a security threat in computer systems, and it is crucial that cryptographic schemes should resist various leakage attacks, including the continuous leakage attacks. In the literature, some research progresses have been made in designing leakage resistant cryptographic primitives, but there are still some remaining issues unsolved, e.g. the upper bound of the permitted leakage is fixed. In actual applications, the leakage requirements may vary; thus, the leakage parameter with fixed size is not sufficient against various leakage attacks. In this paper, we introduce some novel idea of designing a continuous leakage-amplified public-key encryption scheme with security against chosen-ciphertext attacks. In our construction, the leakage parameter can have an arbitrary length, i.e. the length of the permitted leakage can be flexibly adjusted according to the specific leakage requirements. The security of our proposed scheme is formally proved based on the classic decisional Diffie–Hellman assumption.

Affective computing is a key research topic in artificial intelligence which is applied to psychology and machines. It consists of the estimation and measurement of human emotions. A person’s body language is one of the most significant sources of information during job interview, and it reflects a deep psychological state that is often missing from other data sources. In our work, we combine two tasks of pose estimation and emotion classification for emotional body gesture recognition to propose a deep multi-stage architecture that is able to deal with both tasks. Our deep pose decoding method detects and tracks the candidate’s skeleton in a video using a combination of depthwise convolutional network and detection-based method for 2D pose reconstruction. Moreover, we propose a representation technique based on the superposition of skeletons to generate for each video sequence a single image synthesizing the different poses of the subject. We call this image: ‘history pose image’, and it is used as input to the convolutional neural network model based on the Visual Geometry Group architecture. We demonstrate the effectiveness of our method in comparison with other methods in the state of the art on the standard Common Object in Context keypoint dataset and Face and Body gesture video database.

Blind signature is an important cryptographic primitive with widespread applications in secure e-commerce, for example to guarantee participants’ anonymity. Existing blind signature schemes are mostly based on number-theoretic hard problems, which have been shown to be solvable with quantum computers. The National Institute of Standards and Technology (NIST) began in 2017 to specify a new standard for digital signatures by selecting one or more additional signature algorithms, designed to be secure against attacks carried out using quantum computers. However, none of the third-round candidate algorithms are code-based, despite the potential of code-based signature algorithms in resisting quantum computing attacks. In this paper, we construct a new code-based blind signature (CBBS) scheme as an alternative to traditional number-theoretic based schemes. Specifically, we first extend Santoso and Yamaguchi’s three pass identification scheme to a concatenated version (abbreviated as the CSY scheme). Then, we construct our CBBS scheme from the CSY scheme. The security of our CBBS scheme relies on hardness of the syndrome decoding problem in coding theory, which has been shown to be NP-complete and secure against quantum attacks. Unlike Blazy et al.’s CBBS scheme which is based on a zero-knowledge protocol with cheating probability $2/3$, our CBBS scheme is based on a zero-knowledge protocol with cheating probability $1/2$. The lower cheating probability would reduce the interaction rounds under the same security level and thus leads to a higher efficiency. For example, to achieve security level $2^{-82}$, the signature size in our CBBS scheme is $1.63$ MB compared to $3.1$ MB in Blazy et al.’s scheme.

SM9 is a Chinese cryptography standard, which includes a set of identity-based cryptographic schemes over pairings. SM9 identity-based signature scheme (SM9-IBS) was standardized by ISO/IEC and has been widely used in many real-world applications such as blockchain. Nevertheless, the signing algorithm of SM9-IBS suffers from several heavy calculations (e.g. pairings, scalar multiplications in groups), which might be a bottleneck for lightweight devices such as sensors. In this paper, we modify the SM9-IBS scheme slightly to support fast signing. In order to achieve this, we make the use of online/offline methodology and propose a new online/offline IBS scheme based on SM9. The proposed scheme is proved to be EUF-sID-CMA secure and is about 99% faster than SM9-IBS in terms of signature generation. Precisely, the time cost of online signing is

Packet classification plays an essential role in diverse network functions such as quality of service, firewall filtering and load balancer. However, implementing an efficient packet classifier is a challenging problem. The problem even gets worse in the era of software-defined network, in which frequent rule updates are performed, and complex flow tables are used. This paper proposes CMT, a new software algorithm named by its novel data structure—common mask tree—to implement an efficient multi-field packet classifier. The core idea of CMT is to combine the strengths of both decision-tree and tuple-space schemes by employing tree-like structures and hash tables simultaneously. The objective of CMT is to achieve both high classification performance and fast rule updates. In the evaluation section, CMT is compared with decision-tree and tuple-space schemes. Compared to the state-of-the-art decision-tree methods, CMT performs rule updates at two orders of magnitude faster. CMT has a stable performance on different rulesets and achieves a 40% improvement in memory access compared to the state-of-the-art tuple-space method.

DPA Contest is a world-famous side-channel competition aiming at analyzing and evaluating the implementing security of some latest countermeasures. Improved Rotating S-box Masking Scheme (RSM2.0) is one of the most popular countermeasures designed during DPA Contest V4.2, which arms with both Low Entropy Masking Schemes and shuffling strategy to ensure the software security of AES-128, particularly the non-profiled security. Up to now, conducting high efficient non-profiled attacking scheme with low resource costs is still a challenge. In this paper, we first propose general and non-profiled leakage fingerprint attacks (named NP-LFA) for secret cracking and make use of it to crack RSM2.0 random masks with almost 100% accuracy. Further, we analyze the hidden vulnerabilities embedded in RSM2.0 implementation, and utilize them to bypass the shuffling defense and perform the master key recovery. Official evaluation results show that NP-LFA is capable of compromising RSM2.0 within 14 traces, each of which only costs 60 ms processing time. Such result validates the high efficiency and light-weighted characteristics of our attacking scheme, which has ranked the first in the official website till now. In addition, we discuss and put forward some possible strategies to mitigate our NP-LFA threats.

The edge authentication of graphs has been studied in the literature because graphs are one of the most widely used data organization structures. The majority of such schemes cannot be used to authenticate general directed graphs (GDGs); other schemes cannot be used for addressing either the issue of dynamic update or the issue of information leakage (such as the existence of nodes/edges and structural relationship of the graph). Also, all the existing schemes do not consider the forward security: if the signer’s secret key has been compromised, all previously generated signatures remain valid. This property provides high-level security protection for authentication schemes. To address these issues, in this work, we propose a forward-secure edge authentication scheme for GDGs. Observe that existing such schemes can only give a proof such that ‘there is an edge between nodes $u$ and $v$’. Our scheme, however, can directly give a proof such that ‘there is no edge between nodes $u$ and $v$’, which makes the function of edge authentication schemes more diverse. Moreover, our proposed scheme is proven to be secure against an adaptive chosen-message adversary in the random oracle model. To show its desirable performance, we analyze the computational costs of our scheme and compare it with other related schemes in terms of features.

We present a novel technique for converting a Boolean conjunctive normal form (CNF) into an orthogonal disjunctive normal form (DNF), aka exclusive sum of products. Our method (which will be pitted against a hardwired command from Mathematica) zooms in on the models of the CNF by imposing its clauses one by one. Clausal imposition invites parallelization, and wildcards beyond the common don’t-care symbol compress the output. The method is most efficient for few but large clauses. Generalizing clauses, one can in fact impose superclauses. By definition, superclauses are obtained from clauses by substituting each positive literal by an arbitrary conjunction of positive literals.

Binary tree encryption is an intriguing primitive that enables many practical applications to achieve an increasing important security feature, forward security. However, the public key size of existing constructions grows linearly with the depth of the underlying binary tree in the standard model. To support more secret keys associated with nodes, it is often expected that the tree has a sufficiently large depth. This places a burden on employing it implicitly or explicitly in real world. In this work, we show how to compress linear-size public key down to constant-size public key and give our construction featuring constant-size public key in the standard model. We prove that our construction achieves an improved security, adaptive security, under the matrix decision Diffie–Hellman assumption, which is a generalization of standard $k$-Lin assumption. Moreover, our key-generation, key-derivation and encryption algorithms have lower time complexity than that of the prior construction, leading to further efficiency improvements. To illustrate these improvements in practice, we give an implementation of our construction and the prior one and then evaluate the performance in the tree depth.

The division property method is a technique for automatic searching integral distinguishers on block ciphers. Previous methods only use word-based division property to search integral distinguishers for block ciphers with large S-boxes. Since using bit-based division property may find longer integral distinguishers than word-based division property, we propose a method to automatically search the integral distinguishers based on bit-based division property for block ciphers with large S-boxes. To achieve this goal, we propose a new division property propagation table for S-boxes. Theoretically, we prove that using both the new table and the traditional method to describe the bit-based division property propagation rule of S-box will lead to the same integral distinguishers. Technically, we design a mixed-integer linear programming-based tool to search the integral distinguisher based on the new table, which helps to search new integral distinguishers for block ciphers with large S-boxes efficiently. As a result, we apply our tool to derive new integral distinguishers and get the tight bound on the rounds that no integral distinguishers exist for ICEBERG, KHAZAD, Camellia, CS-Cipher, ITUbee and SMS4. Besides, to show the availability of our integral distinguishers, we form the present best five-round and the first six-round integral attack for ICEBERG as an example.

Hedged public-key encryption (HPKE), introduced by Bellare et al. (ASIACRYPT 2009), provides useful security when the per-message randomness fails to be uniform due to faulty implementations or adversarial actions. The HPKE scheme achieves IND-CPA (chosen plaintext attack) security when the randomness they used is of high quality, but, when the randomness is poor quality, rather than breaking completely, it achieves a weaker but a useful notion of security called IND-CDA (chosen distribution attack) as long as the message and randomness together have sufficient min-entropy. However, little research on HPKE in the presence of key leakage was done. In this paper, we study HPKE featuring key leakage-resilience and formulate appropriate security notion for key leakage-resilient HPKE. We work in the continual key leakage model where the secret key is refreshed periodically and an adversary can learn arbitrary but bounded leakage on the secret key between the updates. We present two generic constructions of continual leakage-resilient HPKE in the standard model by using a continual leakage-resilient all-but-one lossy trapdoor function. Finally, we give an instantiation of leakage-resilient HPKE under the linear assumption in bilinear groups.

Requirements engineering (RE) has been developed as a discipline to identify and then translate stakeholders’ needs into system requirements. Hence, RE is used to produce a set of specifications for developing a software system. The specifications can be applied to satisfy stakeholders and can be implemented, deployed and maintained by using their alternative design options. The past several years have seen significant improvements in RE, whereby the discipline supports the modelling and analysis of stakeholders’ goals (objectives) beyond merely incorporating these goals. Goals further help in deriving functional and non-functional requirements (NFRs) of a system. Goals play an important role in the RE process by helping elaborate the requirements. Goal-oriented requirements engineering (GORE) refers to the use of goals in RE for eliciting requirements. GORE is then used in the process of elaboration, organization, specification, analysis, negotiation, documentation and evolution of the elicited requirements. To model the software system requirements, GORE is implemented by using goals in view of goal models. Stakeholders’ goals are then represented through these goal models to assess their non-functional needs. We developed a technique for analysing conflicting goals of inter-dependent actors in a goal model. In this proposal, to ascertain stakeholders’ NFRs, we applied the cost-effectiveness analysis (CEA) to a multi-objective optimisation model in the i* goal model. This optimisation model can handle large, sophisticated systems. The requirements analyst can use information derived from the input data. The CEA further facilitates the requirements analyst by including the sensitivity of conflicting goals in the i* goal model. Based on the inter-dependency relationships, the proposed approach includes the optimisation of each objective function. This approach also uses sensitivity analysis based on the economic evaluation of derived optimal values to prioritize design options. The most cost-effective design option can hence be chosen and used to further the aim of achieving conflicting goals. This proposal uses a Telemedicine System case study, making evaluations through a simulation-based analysis.

The paper proposes a new technique to mitigate the state explosion in model checking. The technique is called a divide & conquer approach to leads-to model checking. As indicated by the name, the technique is dedicated to leads-to properties. It is known that many important systems requirements can be expressed as leads-to properties, thus it is worth focusing on leads-to properties. The technique divides an original leads-to model checking problem into multiple smaller model checking problems and tackles each smaller one. We prove a theorem that the multiple smaller model checking problems are equivalent to the original leads-to model checking problem. We conduct two case studies demonstrating the power of the proposed technique.

In this paper, we introduce a new construction for unlinkable secret handshake that allows a group of users to perform handshakes anonymously. We define formal security models for the proposed construction and prove that it can achieve session key security, anonymity and affiliation hiding. In particular, the proposed construction ensures that (i) anonymity against protocol participants (including group authority) is achieved since a hierarchical identity-based signature is used in generating group user’s pseudonym-credential pairs and (ii) revocation is achieved using a secret sharing-based revocation mechanism.

Password-based authenticated key exchange (PAKE) allows two parties to compute a common secret key. PAKE offers the advantage of allowing two parties to pre-share only a password. However, when it is executed in a client–server environment, server corruption can expose the clients’ passwords. To be resilient against server compromises, verifier-based authenticated key exchange (VPAKE) is proposed, as an augmented version of PAKE. Thus far, there are two known major VPAKE constructions formally proven secure. However, both involve strong assumptions, such as random oracles. In this paper, we propose a simple and efficient VPAKE using tamper-proof hardware without random oracles to support resilient infrastructures. In particular, we transform Katz–Vaikuntanathan one-round PAKE into two-round VPAKE so as to instill resilience to server compromises. We provide a formal definition of VPAKE using tamper-proof hardware and security proof without random oracles. Finally, we provide a performance analysis and comparisons to previous VPAKE and PAKE protocols. Our transformation supports an efficient VPAKE protocol with six group element communications when the underlying Katz–Vaikuntanathan PAKE is instantiated by Cramer–Shoup ciphertext following the proposal by Benhamouda et al.

A new model of computation called Watson–Crick jumping finite automata was introduced by Mahalingam et al., and the authors study the computing power and closure properties of the variants of the model. There are four variants of the model: no state, 1-limited, all-final and simple Watson–Crick jumping finite automata. In this paper, we introduce a restricted version that is a combination of variants of the existing model. It becomes essential to explore the computing power and closure properties of these combinations. The combination variants are extensively compared with Chomsky hierarchy, general jumping finite automata family and among themselves. We also explore the closure properties of such restricted automata.

Searchable encryption (SE) allows the cloud server to search over the encrypted data and leak information as little as possible. Most existing efficient SE schemes assume that the leakage of search pattern and access pattern is acceptable. A series of work was proposed, instructing malicious users to use this leakage to come up with attacks. Especially, with a devastating attack proposed by Zhang et al., the cloud server can reveal the keywords queried by normal users by using some injected files. From the method of constructing uniform $(k,n)$-set of a finite set $A$ proposed by Cao, we put forward a new file-injection attack. In our attack, the server needs fewer injected files than the previous attack when the size of $T$ is larger than 9 and the size of keyword set is larger than $2T$, where $T$ is the threshold of the number of keywords in each injected file. Our attack is more practical and easier to implement in the real scenario.

Saliency detection has been a hot topic in the field of computer vision. In this paper, we propose a novel approach that is based on multiscale segmentation and fuzzy broad learning. The core idea of our method is to segment the image into different scales, and then the extracted features are fed to the fuzzy broad learning system (FBLS) for training. More specifically, it first segments the image into superpixel blocks at different scales based on the simple linear iterative clustering algorithm. Then, it uses the local binary pattern algorithm to extract texture features and computes the average color information for each superpixel of these segmentation images. These extracted features are then fed to the FBLS to obtain multiscale saliency maps. After that, it fuses these saliency maps into an initial saliency map and uses the label propagation algorithm to further optimize it, obtaining the final saliency map. We have conducted experiments based on several benchmark datasets. The results show that our solution can outperform several existing algorithms. Particularly, our method is significantly faster than most of deep learning-based saliency detection algorithms, in terms of training and inferring time.

The K2 stream cipher, designed for 32-bit words, is an ISO/IEC 18033 standard and is listed as a recommended algorithm used by the Japanese government in the CRYPTREC project. The main feature of the K2 algorithm is the use of a dynamic feedback control mechanism between the two linear feedback shift registers, which makes the analysis of the K2 algorithm more difficult. In this paper, for its simplified version algorithm, a key recovery attack is performed by using differential attacks. Firstly, for the unknown key, the same IV is fixed in two chosen IV differential attacks, and we use the input differences and the output differences of the S-box to recover the input of S-box; the internal state values can be uniquely determined by taking intersection of the input of S-box. This technology is used to improve the key recovery attack of seven-round algorithm proposed by Deike Priemuth-Schmid. Secondly, we find the constraint relationship between the keystream equations and the unknown differences by introducing the guess difference bit and eliminate the impossible differences by the constraint relationship. Thus, we expand the key recovery attack from seven to nine rounds. The time complexity of the attack is $\boldsymbol{O} \boldsymbol{(2^{113.93})}$, the data complexity is $\boldsymbol{O}\boldsymbol{(2^{8.71})}$ and the success rate is $\textbf{99.07\%}$.

References In recent years, online customer reviews have become the main source to determine public opinion about offered products and services. Therefore, manufacturers and sellers are extremely concerned with customer reviews, as these can have a direct impact on their businesses. Unfortunately, there is an increasing trend to write spam reviews to promote or demote targeted products or services. This practice, known as review spamming, has posed many questions regarding the authenticity and dependability of customers’ review-based business processes. Although the spam review detection (SRD) problem has gained much attention from researchers, existing studies on SRD have mostly worked on datasets of English, Chinese, Arabic, Persian, and Malay languages. Therefore, the objective of this research is to identify the spam in Roman Urdu reviews using different classification models based on linguistic features and behavioral features. The performance of each classifier is evaluated in a number of perspectives: (i) linguistic features are used to calculate accuracy (F1 score) of each classifier; (ii) behavioral features combined with distributional and non-distributional aspects are used to evaluate accuracy (F1 score) of each classifier; and (iii) the combination of both linguistic and behavioral features (distributional and non-distributional aspects) are used to evaluate the accuracy of each classifier. The experimental evaluations demonstrated an improved accuracy (F1 score: 0.96), which is the result of combinations of linguistic features and behavioral features with the distributional aspect of reviewers. Moreover, behavioral features using distributional characteristic achieve an accuracy (F1 score: 0.86) and linguistic features shows accuracy (F1 score: 0.69). The outcome of this research can be used to increase customers’ confidence in the South Asian region. It can also help to reduce spam reviews in the South Asian region, particularly in Pakistan.

The diagnosability is one of the most important measures of the reliability of networks. Consider the setting where there are large-scale failures that disconnect the network and result in many components. Then, the diagnosability is closely related to the number of components. In this paper, we define and study the $\boldsymbol{g}$-component diagnosability of network $\boldsymbol{G}$, which is denoted by $\boldsymbol{ct_g(G)}$ and has not been addressed before. $\boldsymbol{ct_g(G)}$ is the maximum number of nodes in the faulty node set $\boldsymbol{F}$ of $\boldsymbol{G}$ such that $\boldsymbol{G-F}$ has at least $\boldsymbol{g}$ components and diagnosis model can identify all nodes in $\boldsymbol{F}$. Under PMC and MM$^*$ diagnosis models, we show that, in the hypercube $\boldsymbol{Q_n\ (n\geq 7)}$, $\boldsymbol{ct_{g+1}(Q_n)=-(1/2)g^2+(n-3/2)g+n}$ when $\boldsymbol{g\leq n-1}$. Moreover, we determine the $\boldsymbol{(n+1)}$-component diagnosability $\boldsymbol{ct_{n+1}(Q_n)=n^2/2+n/2-2}$ for $\boldsymbol{n\geq 7}$.

The mixing time of random walks on a graph has found broad applications across both theoretical and practical aspects of computer science, with the application effects depending on the behavior of mixing time. It is extensively believed that real-world networks, especially social networks, are fast mixing with their mixing time at most $O(\log N)$ where $N$ is the number of vertices. However, the behavior of mixing time in the real-life networks has not been examined carefully, and exactly analytical research for mixing time in models mimicking real networks is still lacking. In this paper, we first experimentally evaluate the mixing time of various real-world networks with scale-free small-world properties and show that their mixing time is much higher than anticipated. To better understand the behavior of the mixing time for real-world networks, we then analytically study the mixing time of the Apollonian network, which is simultaneously scale-free and small-world. To this end, we derive the recursive relations for all eigenvalues, especially the second largest eigenvalue modulus of the transition matrix, based on which we deduce a lower bound for the mixing time of the Apollonian network, which approximately scales sublinearly with $N$. Our results indicate that real-world networks are not always fast mixing, which has potential implications in the design of algorithms related to mixing time.

Group signature (GS) allows each member in a group to do signatures anonymously on behalf of the group under management of a group authority. Membership revocation has been a central issue in GS and widely studied so far. The mechanism of verifier local revocation for GS, first formalized by Boneh and Shacham, has an advantage of making the signers free from fetching the up-to-date information of the revoked users and practicality in the scenario of periodically update in the large population of group users. Most of work related to group signature with verifier-local revocation either can only achieve selfless anonymity or have inefficient constructions due to complicate primitives. Aiming to a recent chosen ciphertext attack-almost-full anonymous notion for GS, this paper presents an efficient GS with verifier local revocation in the standard model by adding a new primitive plaintext searchable encryption into Groth’s GS under Canard et al.’s framework. We prove that it has backward unlinkability to ensure that all signatures generated by the user before the revocation remain anonymous, even if it is revoked later.

Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted from the same message or not without decryption. This attribute enables PKEET to be increasingly utilized in cloud storage, where users store their encrypted data on the cloud. In traditional PKEET, the tester is authorized by the data receiver to perform equality test on its ciphertexts. However, the tester can only test one ciphertext or all ciphertexts of one receiver with one authorization. It means that the receiver cannot adaptively authorize the test right of any number of ciphertexts to the tester. A trivial solution is authorizing one ciphertext each time and repeating multiple times. The corresponding size of trapdoor in this method is linear with the number of authorized ciphertexts. This will incur storage burden for the tester. To solve the aforementioned problem, we propose the concept of PKEET supporting partial authentication (PKEET-PA). We then instantiate the concept to a lightweight PKEET-PA, which achieves constant-size trapdoor. Besides, we prove the security of our PKEET-PA scheme against two types of adversaries. Compared with other PKEET schemes that can be used in trivial solution, our PKEET-PA is more efficient in receivers’ computation and has lower trapdoor size.

This article describes an algorithm that solves a fully dynamic variant of the minimum spanning tree (MST) problem. The fully retroactive MST allows adding an edge to time $t$, or to obtain the current MST at time $t$. By using the square root technique and a data structure link-cut tree, it was possible to obtain an algorithm that runs each query in $O(\sqrt{m} \lg{|V(G)|})$ amortized, in which $|V(G)|$ is the number of nodes in graph $G$ and $m$ is the size of the timeline. We use a different approach to solve the MST problem instead of the standard algorithms, such as Prim or Kruskal, and this allows using the square root technique to improve the final complexity of the algorithm. Our empirical analysis shows that the proposed algorithm runs faster than re-executing the standard algorithms, and this difference only increases when the number of nodes in these graphs is larger.

Nowadays, the whole world is covered with the revolution of digital information so that digital data are easy to transfer, access and process. Modern image processing tools are used to create forged images; by using these tools, forgers introduced forged region in the original image to spread the rumor in the public. Now there is a challenge for the forensic department to prove the authenticity of the original image. So there is required a new efficient copy-move tamper detection method. To fulfill this requirement, a new computational efficient method for copy-move forgery detection using firefly algorithm is proposed.

Today, automated extractive text summarization is one of the most common techniques for organizing information. In extractive summarization, the most appropriate sentences are selected from the text and build a representative summary. Therefore, probing for the best sentences is a fundamental task. This paper has coped with extractive summarization as a multi-objective optimization problem and proposed a language-independent, semantic-aware approach that applies the harmony search algorithm to generate appropriate multi-document summaries. It learns the objective function from an extra set of reference summaries and then generates the best summaries according to the trained function. The system also performs some supplementary activities for better achievements. It expands the sentences by using an inventive approach that aims at tuning conceptual densities in the sentences towards important topics. Furthermore, we introduced an innovative clustering method for identifying important topics and reducing redundancies. A sentence placement policy based on the Hamiltonian shortest path was introduced for producing readable summaries. The experiments were conducted on DUC2002, DUC2006 and DUC2007 datasets. Experimental results showed that the proposed framework could assist the summarization process and yield better performance. Also, it was able to generally outperform other cited summarizer systems.

Cybersecurity has gradually become the public focus between common people and countries with the high development of Internet technology in daily life. The cybersecurity knowledge analysis methods have achieved high evolution with the help of knowledge graph technology, especially a lot of threat intelligence information could be extracted with fine granularity. But named entity recognition (NER) is the primary task for constructing security knowledge graph. Traditional NER models are difficult to determine entities that have a complex structure in the field of cybersecurity, and it is difficult to capture non-local and non-sequential dependencies. In this paper, we propose a cybersecurity entity recognition model CyberEyes that uses non-local dependencies extracted by graph convolutional neural networks. The model can capture both local context and graph-level non-local dependencies. In the evaluation experiments, our model reached an F1 score of 90.28% on the cybersecurity corpus under the gold evaluation standard for NER, which performed better than the 86.49% obtained by the classic CNN-BiLSTM-CRF model.

Linearly homomorphic signatures (LHSs) allow any entity to linearly combine a set of signatures and to provide authentication service for the corresponding (combined) data. The public key of the current known LHSs from lattices in the standard model requires $O(l)$ matrices and $O(k)$ vectors, where $l$ is the length of file identifier and $k$ is the maximum data set size that linear functions support. In this paper, we construct two lattice-based LHS schemes with provable security in the standard model and both schemes can authenticate vectors defined over finite field. First, we present a basic LHS scheme satisfying selective security, based on the full-rank difference hash functions. Second, we modify the chameleon hash function constructed by (Cash, D., Hofheinz, D., Kiltz, E. and Peikert, C. (2010) Bonsai Trees, or How to Delegate a Lattice Basis. In Proc. EUROCRYPT 10, Monaco/French Riviera, May 30 to June 3, pp. 523–552. Springer, Berlin) to construct a linearly homomorphic chameleon hash function (LHCHF), which can be applied to all transformations from selectively secure LHS scheme that authenticates vectors defined over finite field $\mathbb{F}_{p}$ ($p=poly(n)$) to fully secure one, except for a new one that authenticates vectors defined over a small field. Starting from LHCFH and the basic scheme as above, we obtain a fully secure LHS scheme. Both schemes can be used to sign multiple files and have relatively short public keys consisting of $O(1)$ matrices and $O(k)$ vectors.

Local information has significant contributions to visual sentiment analysis (VSA). Recent studies about local region discovery need manually annotate region location. Affective local information learning and automatic discovery of sentiment-specific region are still the challenges in VSA. In this paper, we propose an end-to-end VSA method for weakly supervised sentiment-specific region discovery. Our method contains two branches: an automatic sentiment-specific region discovery branch and a sentiment analysis branch. In the sentiment-specific region discovery branch, a region proposal network with multiple convolution kernels is proposed to generate candidate affective regions. Then, we design the multiple instance learning (MIL) loss to remove redundant and noisy candidate regions. Finally, the sentiment analysis branch integrates both holistic and localized information obtained in the first branch by feature map coupling for final sentiment classification. Our method automatically discovers sentiment-specific regions by the constraint of MIL loss function without object-level labels. Quantitative and qualitative evaluations on four benchmark affective datasets demonstrate that our proposed method outperforms the state-of-the-art methods.

We introduce the notion of private set operations (PSO) as a symmetric-key primitive in the cloud scenario, where a client securely outsources his dataset to a cloud service provider and later privately issues queries in the form of common set operations. We define a syntax and security notion for PSO and propose a general construction that satisfies it. There are two main ingredients to our PSO scheme: an adjustable join (Adjoin) scheme (MIT-CSAIL-TR-2012-006 (2012) Cryptographic treatment of CryptDB’s adjustable join. http://people.csail.mit.edu/nickolai/papers/popa-join-tr.pdf) and a tuple set (TSet) scheme (Cash, D., Jarecki, S., Jutla, C. S., Krawczyk, H., Rosu, M.-C., and Steiner, M. (2013) Highly-Scalable Searchable Symmetric Encryption With Support for Boolean Queries. 33rd Annual Cryptology Conf., Santa Barbara, CA, August 18–22, pp. 353–373. Springer, Berlin, Heidelberg). We also propose an Adjoin construction that is substantially more efficient (in computation and storage) than the previous ones (Mironov, I., Segev, G., and Shahaf, I. (2017) Strengthening the Security of Encrypted Databases: Non-Transitive Joins. 15th Int. Conf., TCC 2017, Baltimore, MD, USA, November 12–15, pp. 631–661. Springer, Cham) due to the hardness assumption that we rely on, while retaining the same security notion. The proposed PSO scheme can be used to perform join queries on encrypted databases without revealing the duplicate patterns in the unqueried columns, which is inherent to an Adjoin scheme. In addition, we also show that the PSO scheme can be used to perform Boolean search queries on a collection of encrypted documents. We also provide standard security proofs for our constructions and present detailed efficiency evaluation and compare them with well-known previous ones.

Leakage of private information, such as the secret keys, has become a threat to the security of computing systems. It has become a common requirement that cryptographic schemes should withstand various leakage attacks, including the continuous leakage attacks. Although some research progresses have been made toward this area, there are still some unsolved issues. In the literature, the public-key encryption (PKE) constructions with (continuous) leakage resilience normally require the upper bound of leakage to be fixed. However, in many real-world applications, this requirement cannot provide sufficient protection against leakage attacks. In order to mitigate these problems, this paper demonstrates how to design a leakage amplified PKE scheme with continuous leakage resilience and chosen-plaintext attacks security. In our proposed PKE scheme, the leakage parameter can have an arbitrary length. Moreover, the length of permitted leakage in our scheme can be flexibly adjusted according to the leakage requirements of application environment. Its security is formally proved under the classic static assumption.

ID-based encryption with equality test (IBEET) allows a tester to compare ciphertexts encrypted under different public keys for checking whether they contain the same message. In this paper, we first introduce group mechanism into IBEET and propose a new primitive, namely group ID-based encryption with equality test (G-IBEET). With the group mechanism: (1) group administrator can authorize a tester to make comparison between ciphertexts of group users, but it cannot compare their ciphertexts with any ciphertext of any user who is not in the group. Such group granularity authorization can make IBEET that adapts to group scenario; (2) for the group granularity authorization, only one trapdoor, named group trapdoor, should be issued to the tester, which can greatly reduce the cost of computation, transmission and storage of trapdoors in traditional IBEET schemes; (3) G-IBEET can resist the insider attack launched by the authorized tester, which is an open problem in IBEET. We give definitions for G-IBEET and propose a concrete construction with an efficient test algorithm. We then give its security analysis in the random oracle model.

As the number of servers in a data center network (DCN) increases, the probability of server failures is significantly increased. Traditional connectivity is an important metric to measure the reliability of DCN. However, the traditional connectivity of a DCN based on the condition of arbitrary faulty servers is generally lower. Therefore, it is important to increase the connectivity of a DCN by adding some limited conditions for the faulty server set. As a result, $g$-restricted connectivity and $h$-extra connectivity, which are two crucial subjects for a DCN’s ability to tolerate faulty servers, were proposed in the literature. In this paper, we study the $g$-restricted connectivity and $h$-extra connectivity of a new server-centric DCN, called BCDC, based on crossed cube with excellent performance. We prove that the $g$-restricted connectivity of BCDC is 4 for $n=3$ and $2n+g(n-2)-2$ for $n\geq 4$, where $0\leq g\leq n-3$, and the $h$-extra connectivity of BCDC is 4 for $n=3$ and $2n+h(n-2)-2$ for $n\geq 4$, where $0\leq h\leq n-3$.

Evaluating readability of web documents has gained attention due to several factors such as improving the effectiveness of writing and to reach a wider spectrum of audience. Current practices in this direction follow several statistical measures in evaluating readability of the document. In this paper, we have proposed a machine learning-based model to compute readability of web pages. The minimum educational standards required (grade level) to understand the contents of a web page are also computed. The proposed model classifies the web pages into highly readable, readable or less readable using specified feature set. To classify a web page with the aforementioned categories, we have incorporated the features such as sentence count, word count, syllable count, type-token ratio and lexical ambiguity. To increase the usability of the proposed model, we have developed an accessible browser extension to perform the assessments of every web page loaded into the browser.

In this study, a cotton disease diagnosis method that uses a combined algorithm of case-based reasoning (CBR) and fuzzy logic was designed and implemented. It focuses on the prevention, diagnosis and control of diseases affecting cotton production in China. Conventional methods of disease diagnosis are primarily based on CBR with reference to user-provided symptoms; however, in most cases, user-provided symptoms do not fully meet the requirements of CBR. To address this problem, fuzzy logic is incorporated into CBR to allow for more flexible and accurate models. With the help of CBR and fuzzy reasoning, three diagnostic results can be obtained by the cotton disease diagnosis system (CDDS) constructed in this study: success, success but not exact and failure. To verify the reliability of the CDDS and its ability to diagnose cotton diseases, its diagnostic accuracy and stability were analyzed and compared with the results obtained by the traditional expert scoring method. The analysis results reveal that the CDDS can achieve a high diagnostic success rate (above 90%) and better diagnostic stability than the traditional expert scoring method when at least four disease symptoms are input. The CDDS provides an independent and objective source of information to assist farmers in the diagnosis and prevention of cotton diseases.