Search

In this article, we analyse a block cipher mode of operation for authenticated encryption known as ++AE (plus-plus-AE). We show that this mode has a fundamental flaw: the scheme does not verify the most significant bit of any block in the plaintext message. This flaw can be exploited by choosing a plaintext message and then constructing multiple forged messages in which the most significant bit of certain blocks is flipped. All of these plaintext messages will generate the same authentication tag. This forgery attack is deterministic and guaranteed to pass the ++AE integrity check. The success of the attack is independent of the underlying block cipher, key or public message number. We outline the mathematical proofs for the flaw in the ++AE algorithm. We conclude that ++AE is insecure as an authenticated encryption mode of operation.

The purpose of this study was to obtain a range of normal measurements of the adult thoracic aorta and main pulmonary artery using cardiac MRI, and to assess agreement between measurements made on ECG-gated two-dimensional (2D) breath held steady-state-free precession (SSFP), and three-dimensional (3D) breath held SSFP image acquisitions. Forty-nine normal volunteers underwent cardiac MRI using a 1.5T system. Two independent examiners measured the ascending aorta, aortic arch, descending thoracic aorta and main pulmonary artery in pre-defined locations. Overall, inter-observer agreement for all measurements was excellent. Close agreement was observed in aortic diameters obtained from the 2D and 3D SSFP methods in six of the nine aortic measurement sites. There was a tendency for the 3D measurements to be smaller than the 2D measurements but this was only significant at two sites, the aortic annulus, and the ascending aorta. There was a significance difference in aortic measurements between the left carotid artery (LC) and the left subclavian artery (LSC). Normal values for transverse diameters of the thoracic aorta and main pulmonary artery were established using 2D and 3D non-contrast MR sequences in healthy adults. Overall both inter-observer agreement, and agreement between 2D and 3D techniques was good. Mean diameter differences demonstrated at the aortic annulus, ascending aorta and aortic arch between LC and LSC although significant were less than one millimetre and unlikely to be important in clinical practice.

This paper analyses the security of the lightweight cryptographic algorithm Fountain (V1), which is a candidate in the current NIST competition for such ciphers. We examine the Boolean functions used in Fountain for state update and output. We show that correlations exist between S-box functions and some register stages that may lead to correlation attacks if certain update functions are detectable. We also show that the state update function avoids state convergence in any phase of cipher operation, but state collisions may be forced in one bit position, for select states, by manipulating the associated data or plaintext.

AEZ is a block cipher mode based on AES which uses three 128-bit keys. The algorithm has been updated several times during the three rounds of the CAESAR cryptographic competition. Cryptanalytic results presented on AEZ to date do not breach its security. This paper describes a fault injection analysis on AEZ. We focus on analysing AEZ v4.2 but also investigate the applicability of these analyses to the recent version AEZ v5. This paper shows that all three 128-bit keys in AEZ v4.2 can be uniquely retrieved using only three random-valued single byte fault injections. A similar approach using four fault injections can uniquely recover all three keys of AEZ v5. The feasibility of this fault injection methodology has been proven against AES in previous works.

This paper investigates the application of fault attacks to the authenticated encryption stream cipher algorithm MORUS. We propose fault attacks on MORUS with two different goals: one to breach the confidentiality component, and the other to breach the integrity component. For the fault attack on the confidentiality component of MORUS, we propose two different types of key recovery. The first type is a partial key recovery using a permanent fault model, except for one of the variants of MORUS where the full key is recovered with this model. The second type is a full key recovery using a transient fault model, at the cost of a higher number of faults compared to the permanent fault model. Finally, we describe a fault attack on the integrity component of MORUS, which performs a forgery using the bit-flipping fault model.

This paper describes two different fault injection attacks on the authenticated encryption stream cipher Tiaoxin-346, a third round candidate in the CAESAR cryptographic competition. The first type of fault injection uses a bit-flipping fault model to conduct a forgery attack. The number of faulty bits required for this forgery attack is twice the number of bit modifications made in the input message. The second type of fault injection uses a random fault model in a differential fault attack to recover the secret key of the cipher. A successful attack can be performed with 36 random multi-byte faults and a computational complexity of 236. This second attack improves on the previous key recovery attack of Dey et. al., as the random fault model we use is more practical than the bit flipping model used in their attack.Ed Dawson

This paper investigates differential fault attacks against AEZ v4.2 authenticated encryption scheme. AEZ uses three different 128-bit keys (I, J, L) and can potentially work without a nonce or with a repeated nonce. Under these conditions, this paper identifies the best place to apply differential fault attacks. We exploit the structure of AEZ to minimise the total number of faults required for key recovery. We propose an approach that can reduce the number of fault injections required to retrieve all three AEZ keys, I, J and L, from six to four such that these keys are uniquely determined. As a second step, we further reduce the fault injections to three without reducing the success rate of the key recovery attack. This improvement to differential fault attacks on AEZ makes these attacks more practical. The attacks in this paper are verified experimentally using a generic implementation of AEZ v4.2 developed in C.

We present CHURNs, a method for providing freshness and authentication assurances to human users. In computer-to-computer protocols, it has long been accepted that assurances of freshness such as random nonces are required to prevent replay attacks. Typically, no such assurance of freshness is presented to a human in a human-and-computer protocol. A Computer–HUman Recognisable Nonce (CHURN) is a computer-aided random sequence that the human has a measure of control over and input into. Our approach overcomes limitations such as ‘humans cannot do random’ and that humans will follow the easiest path. Our findings show that CHURNs are significantly more random than values produced by unaided humans; that humans may be used as a second source of randomness, and we give measurements as to how much randomness can be gained from humans using our approach; and that our CHURN-generator makes the user feel more in control, thus removing the need for complete trust in devices and underlying protocols. We give an example of how a CHURN may be used to provide assurances of freshness and authentication for humans in a widely used protocol.

Non-linear feedback shift register (NLFSR) ciphers are cryptographic tools of choice of the industry especially for mobile communication. Their attractive feature is a high efficiency when implemented in hardware or software. However, the main problem of NLFSR ciphers is that their security is still not well investigated. The paper makes a progress in the study of the security of NLFSR ciphers. In particular, we show a distinguishing attack on linearly filtered NLFSR (or LF-NLFSR) ciphers. We extend the attack to a linear combination of LF-NLFSRs. We investigate the security of a modified version of the Grain stream cipher and show its vulnerability to both key recovery and distinguishing attacks.

This paper presents a model for the generation of a MAC tag using a stream cipher. The input message is used indirectly to control segments of the keystream that form the MAC tag. Several recent proposals can be considered as instances of this general model, as they all perform message accumulation in this way. However, they use slightly different processes in the message preparation and finalisation phases. We examine the security of this model for different options and against different types of attack, and conclude that the indirect injection model can be used to generate MAC tags securely for certain combinations of options. Careful consideration is required at the design stage to avoid combinations of options that result in susceptibility to forgery attacks. Additionally, some implementations may be vulnerable to side-channel attacks if used in Authenticated Encryption (AE) algorithms. We give design recommendations to provide resistance to these attacks for proposals following this model.

The XOR-Encrypt-XOR (XEX) block cipher mode was introduced by Rogaway in 2004. XEX mode uses nonce-based secret masks (L) that are distinct for each message. The existence of secret masks in XEX mode prevents the application of conventional fault attack techniques, such as differential fault analysis. This work investigates other types of fault attacks against XEX mode that either eliminate the effect of the secret masks or retrieve their values. Either of these outcomes enables existing fault attack techniques to then be applied to recover the secret key. To estimate the success rate and feasibility, we ran simulations for ciphertext-only fault attacks against 128-bit AES in XEX mode. The paper discusses also the relevance of the proposed fault attacks to certain authenticated encryption modes based on XEX, such as OCB2, OTR, COPA, SHELL and ElmD. Finally, we suggest effective countermeasures to provide resistance to these fault attacks.

Free to read Aims To investigate associations between HMG-CoA reductase inhibitor (statin) use and muscle strength, balance, mobility and falls in older people. Methods Five hundred community-dwelling people aged 70–90 years provided information about their medication use and undertook tests of lower limb strength, postural sway, leaning balance (maximal balance range and coordinated stability tests) and functional mobility. Participants were then followed up for 12 months with respect to falls. Results After adjusting for general health in analyses of covariance procedures, statin users had poorer maximal balance range than non-statin users (P = 0.017). Statin and non-statin users did not differ with respect to strength, postural sway, mobility or falls experienced in the follow-up year. Conclusion In a sample of healthy older people, statin use was not associated with muscle weakness, postural sway, reduced mobility or falls. Statin users, however, had poorer leaning balance which may potentially increase fall risk in this group.

Objective: This retrospective, observational cohort study investigated whether the clinical features of a patient's pain, including anatomical location, organ system and likely treating speciality, impact on the delivery of analgesia within 30min in EDs. Methods: Data were obtained from 24 centres across Australia between April 2008 and March 2009. Principal outcome was delivery of analgesia within 30min or less. Factors that might explain any differences were analysed, including anatomical location of the pain, likely treating speciality, organ system affected, age, sex, day and time of presentation, hospital location, documented pain score and triage category. Analysis was by the χ -test for independence of proportions and multiple logistic regression. A P-value

This paper analyzes the authenticated encryption algorithm ACORN, a candidate in the CAESAR cryptographic competition. We identify weaknesses in the state update function of ACORN which result in collisions in the internal state of ACORN. This paper shows that for a given set of key and initialization vector values we can construct two distinct input messages which result in a collision in the ACORN internal state. Using a standard PC the collision can be found almost instantly when the secret key is known. This flaw can be used by a message sender to create a forged message which will be accepted as legitimate.

In this paper, we analyse a block cipher mode of operation submitted in 2014 to the cryptographic competition for authenticated encryption (CAESAR). This mode is designed by Recacha and called ++AE (plus-plus-ae). We propose a chosen plaintext forgery attack on ++AE that requires only a single chosen message query to allow an attacker to construct multiple forged messages. Our attack is deterministic and guaranteed to pass ++AE integrity check. We demonstrate the forgery attack using 128-bit AES as the underlying block cipher. Hence, ++AE is insecure as an authenticated encryption mode of operation.

This paper considers the security of the Offset Two-Round (OTR) authenticated encryption mode [9] with respect to forgery attacks. The current version of OTR gives a security proof for specific choices of the block size (n) and the primitive polynomial used to construct the finite field \(\mathbb {F}_{2^n}\). Although the OTR construction is generic, the security proof is not. For every choice of finite field the distinctness of masking coefficients must be verified to ensure security. In this paper, we show that some primitive polynomials result in collisions among the masking coefficients used in the current instantiation, from which forgeries can be constructed. We propose a new way to instantiate OTR so that the masking coefficients are distinct in every finite field \(\mathbb {F}_{2^n}\), thus generalising OTR without reducing the security of OTR.

We investigated the application of cube attacks to MORUS, a candidate in the CAESAR competition. We applied the cube attack to a version of MORUS where the initialization phase is reduced from 16 steps to 4. Our analysis shows that the cube attack can successfully recover the secret key of MORUS-640 with a total complexity of about 2^10 for this reduced version, and similarly for MORUS-1280 with complexity 2^9. Additionally, we obtained cubes resulting in distinguishers for 5 steps of the initialization of MORUS- 1280; these can distinguish the cipher output function from a random function with complexity of 2^8. All our attacks are verified experimentally. Currently, the cube attack does not threaten the security of MORUS if the full initialization phase is performed.

The Common Scrambling Algorithm Stream Cipher (CSA-SC) is a shift register based stream cipher designed to encrypt digital video broadcast. CSA-SC produces a pseudo-random binary sequence that is used to mask the contents of the transmission. In this paper, we analyse the initialisation process of the CSA-SC keystream generator and demonstrate weaknesses which lead to state convergence, slid pairs and shifted keystreams. As a result, the cipher may be vulnerable to distinguishing attacks, time-memory-data trade-off attacks or slide attacks.

Sfinks is a shift register based stream cipher designed for hardware implementation and submitted to the eSTREAM project. In this paper, we analyse the initialisation process of Sfinks. We demonstrate a slid property of the loaded state of the Sfinks cipher, where multiple key-IV pairs may produce phase shifted keystream sequences. The state update functions of both the initialisation process and keystream generation and also the pattern of the padding affect generation of the slid pairs.

The study objective was to determine whether the ‘cardiac decompensation score’ could identify cardiac decompensation in a patient with existing cardiac compromise managed with intraaortic balloon counterpulsation (IABP). A one-group, posttest-only design was utilised to collect observations in 2003 from IABP recipients treated in the intensive care unit of a 450 bed Australian, government funded, public, cardiothoracic, tertiary referral hospital. Twenty-three consecutive IABP recipients were enrolled, four of whom died in ICU (17.4%). All non-survivors exhibited primarily rising scores over the observation period (p < 0.001) and had final scores of 25 or higher. In contrast, the maximum score obtained by a survivor at any time was 15. Regardless of survival, scores for the 23 participants were generally decreasing immediately following therapy escalation (p = 0.016). Further reflecting these changes in patient support, there was also a trend for scores to move from rising to falling at such treatment escalations (p = 0.024). This pilot study indicates the ‘cardiac decompensation score’ to accurately represent changes in heart function specific to an individual patient. Use of the score in conjunction with IABP may lead to earlier identification of changes occurring in a patient's cardiac function and thus facilitate improved IABP outcomes.

ObjectivesSurgical repair of post–myocardial infarction ventricular septal rupture is challenging with reported early mortality being substantial. In addition, congestive cardiac failure and ventricular tachyarrhythmia frequently occur long term after the operation, although frequency and predictive factors of these events have been poorly identified.MethodsA consecutive series of 68 patients who underwent repair of postinfarction ventricular septal rupture by 14 surgeons between 1988 and 2007 was studied. Fifty-eight (85%) patients underwent repair in an urgent setting (

Purpose. The current standard image orientation employed in the MRI assessment of right ventricular volumes uses a series of short axis cine acquisitions located with respect to a horizontal long axis view with the first slice placed across the atrio-ventricular valve plane at end diastole. Inherent inaccuracies are encountered with the use of this image orientation due to difficulty in defining the tricuspid valve and the border between atrium and ventricle on the resultant images. Our experience indicates that because the tricuspid valve is usually not in-plane in the slice the atrio-ventricular margin is difficult to distinguish. This leads to inaccuracies in measurements at the base of the RV and miscalculation of the RV volume. The purpose of this study was to assess an alternative method of image orientation aimed at increasing the accuracy of RV volume measurements using current commercially available CMRI sequences. This technique, the modified RV short axis series, is oriented to the outflow tract of the right ventricle. Method. We undertook a prospective study of 50 post cardiac transplant patients. A series of LV short axis multi-slice cine acquisition FIESTA images was acquired using the current standard technique. From this data set, LVand RV stroke volumes were derived on an Advantage Windows workstation using planimetry of the endocardial and epicardial borders in end systole and end diastole. Our new technique involved obtaining a set of multi-slice cine acquisition FIESTA images in a plane perpendicular to a line from the centre of the pulmonary valve to the apex of the RV. Planimetry of the RV was then performed and a stroke volume calculated using the same method of analysis. RV stroke volumes obtained from both techniques were compared with LV stroke volumes. Three operators independently derived RV data sets. Results. On the images acquired with the new technique, the tricuspid valve was easier to define leading to more accurate and reproducible planimetry of ventricular borders. RV stroke volumes calculated from the new method showed better agreement with LV stroke volumes than with the current method. These results were consistent across the three operators. Conclusions. This new method improves visualisation of the tricuspid valve and makes analysis easier and less prone to operator error than the current standard technique for MRI assessment of RV volumes.