Computer Science

This paper shows that the security of blind signatures is, as defined by Juels, Luby and Ostrovsky, truly weaker than the security in the universal composability (UC) framework (i.e., define the ideal functionality of blind signatures), which was introduced by Canetti. That is, we formulate the security of blind signatures in the UC framework, and show that the class of UC-secure blind signatures is a proper subset of that of secure (in the sense of Juels et al.) blind signatures. In addition, we introduce a stronger security definition (stronger blindness; SB-security) of blind signatures than that by Juels et al. and show that SB-security is more suitable in many applications than Juels et al's. This paper then shows that SB-security of blind signatures is also truly weaker than the security in the UC framework.

We present a short group signature scheme with an efficient (concurrent) join protocol. Signatures in our scheme are almost as short as Boneh, Boyen and Shacham's Short Group Signatures (BBS04) that has no join protocol, and the computational costs of our scheme are also almost as efficient as BBS04. The security of our group signature is based on the Decision Linear Diffie-Hellman assumption and the 2 Variable Strong Diffie-Hellman (2SDH) assumption, which is a slightly strong variant of the Strong Diffie-Hellman (SDH) assumption. We prove the security of our system, in the random oracle model, using a security definition for group signatures recently given by Bellare, Shi, and Zhang.

For ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, and DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, using KEM and DEM, such that KEM is used for distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM semantically secure against adaptively chosen ciphertext attacks IND-CCA2) and DEM semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2) along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (nonmalleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent. J. Kilian (Ed.): TCC 2005, LNCS 3378, pp. 426-444, 2005.

For e-commerce payments, fair exchange is one of the essential problems. The optimistic fair exchange protocol allows two parties to efficiently exchange items so that either each party gets the other's item or neither does. We propose a new optimistic fair exchange protocol that is efficient and applicable to any digital signature scheme such as RSA or DSA. In our protocol, we introduce pre-signature, post-signature and notarized signature by prescribing the form of the digital signatures. Furthermore, we introduce a parameter that represents the expiration date of the pre-signature to realize the timely termination of the protocol.

The identity-based encryption (IBE) is one of the most important primitives in cryptography, and various security notions of IBE (e.g., IND-ID-CCA2, NM-ID-CCA2, IND-sID-CPA etc.) have been introduced and the relations among them have been clarified recently. This paper, for the first time, investigate the security of IBE in the universally composable (UC) framework. This paper first defines the UC-security of IBE, i.e., we define the ideal functionality of IBE, F IBE . We then show that UC-secure IBE is equivalent to conventionally-secure (IND-ID-CCA2-secure) IBE. This paper also introduces the UC-security of weaker security notions of IBE, which correspond to IND-ID-CPA IBE and IND-sID-CCA2. We finally prove that Boneh-Franklin's suggestion on the construction of a secure signatures from an IND-ID-CPA IBE scheme is true in the UC framework.

The identity-based encryption (IBE) is one of the most important primitives in cryptography, and various security notions of IBE (e.g., IND-ID-CCA2, NM-ID-CCA2, IND-sID-CPA etc.) have been introduced and the relations among them have been clarified recently. This paper, for the first time, investigate the security of IBE in the universally composable (UC) framework. This paper first defines the UC-security of IBE, i.e., we define the ideal functionality of IBE, F IBE . We then show that UC-secure IBE is equivalent to conventionally-secure (IND-ID-CCA2-secure) IBE. This paper also introduces the UC-security of weaker security notions of IBE, which correspond to IND-ID-CPA IBE and IND-sID-CCA2. We finally prove that Boneh-Franklin's suggestion on the construction of a secure signatures from an IND-ID-CPA IBE scheme is true in the UC framework.

For ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, and DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, using KEM and DEM, such that KEM is used for distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM semantically secure against adaptively chosen ciphertext attacks IND-CCA2) and DEM semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2) along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (nonmalleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent. J. Kilian (Ed.): TCC 2005, LNCS 3378, pp. 426-444, 2005.

The rate monotonic scheduling algorithm is a commonly used task scheduling algorithm f o r periodic realtime task systems. This paper discusses feasibility decision f o r a given real-time task system by the rate monotonic scheduling algorithm. It presents a new necessary a n d suficient condition f o r a given task system to be feasible, and a new feasibility decision algorithm based on that condition. The time complexity of this algorithm depends solely on the number of tasks. This algorithm can be applied to the inverse-deadline scheduling algorithm, which is an extension of the rate monotonic scheduling algorithm.

Programme 1 | Architectures parall eles, bases de donn ees, r eseaux et syst emes distribu es Projets Adp Rapport de recherche n 2523 | April 1995 | 18 pages Abstract: Mutual exclusion is a well-known problem that arise when multiple processes compete, in an uncoordinated way, for the acquisition of shared resources over a distributed system. In particular, k-mutual exclusion allows at most k processes to get one unit of the same resource simultaneously. These paradigms do not cover all the cases in which resource accesses must be serialized over a distributed system. There exist cases (e.g. the bandwidth of communication lines) where the amount of shared resource might di er from request to request (for example, audio and video communications). In this paper, we formalize this problem as the h-out of-k mutual exclusion problem, in which each request concerns some number h (1 h k) of units of shared resource and no unit is allocated to multiple processes at the same time. We present a general scheme for a quorum-based h-out of-k mutual exclusion algorithm that relies on a collection of quorums called k-arbiter. Several examples of k-arbiters are discussed, two particular classes of k-arbiters are investigated and a metric to evaluate the resiliency with respect to failures of k-arbiters is also given.

The rate monotonic scheduling algorithm is a commonly used task scheduling algorithm f o r periodic realtime task systems. This paper discusses feasibility decision f o r a given real-time task system by the rate monotonic scheduling algorithm. It presents a new necessary a n d suficient condition f o r a given task system to be feasible, and a new feasibility decision algorithm based on that condition. The time complexity of this algorithm depends solely on the number of tasks. This algorithm can be applied to the inverse-deadline scheduling algorithm, which is an extension of the rate monotonic scheduling algorithm.

Rate monotonic and deadline monotonic scheduling are commonly used for periodic real-time task systems. This paper discusses a feasibility decision for a given real-time task system when the system is scheduled by rate monotonic and deadline monotonic scheduling. The time complexity of existing feasibility decision algorithms depends on both the number of tasks and maximum periods or deadlines when the periods and deadlines are integers. This paper presents a new necessary and sufficient condition for a given task system to be feasible and proposes a new feasibility decision algorithm based on that condition. The time complexity of this algorithm depends solely on the number of tasks. This condition can also be applied as a sufficient condition for a task system using priority inheritance protocols to be feasible with rate monotonic and deadline monotonic scheduling.

h-out of-k mutual exclusion is a generalization of 1mutual exclusion problem, where there are k units of shared resources and each process requests h(1 h k) units at the same time. Though k-arbiter has been shown to be a quorum-based solution to this problem, quorums in k-arbiter are much larger than these in the 1-coterie for 1-mutual exclusion. Thus, the algorithm based on k-arbiter needs many messages. This paper defines two (h; k)arbiters for h-out of-k mutual exclusion: a uniform (h; k)arbiter and a (k + 1)-cube (h; k)-arbiter. The quorums in each (h; k)-arbiter are not larger than the ones in the corresponding k-arbiter; consequently using the (h; k)-arbiters is more efficient than using the k-arbiters. Uniform (h; k)arbiter is an optimal generalization of the majority coterie for 1-mutual exclusion. (k + 1)-cube (h; k)-arbiter is a quasi-optimal generalization of square grid coterie for 1mutual exclusion.

h-Out-of-k mutual exclusion is a generalization of the 1-mutual exclusion problem, where there are k units of shared resources and each process requests h (16 h6 k) units at the same time. Though k-arbiter has been shown to be a quorum-based solution to this problem, quorums in k-arbiter are much larger than those in the 1-coterie for 1-mutual exclusion. Thus, the algorithm based on k-arbiter needs many messages. This paper introduces the new notion that each request uses di erent quorums depending on the number of units of its request. Based on the notion, this paper deÿnes two (h; k)-arbiters for h-out-of-k mutual exclusion: a uniform (h; k)-arbiter and a (k + 1)-cube (h; k)-arbiter. The quorums in each (h; k)-arbiter are not larger than the ones in the corresponding k-arbiter; consequently, it is more e cient to use (h; k)-arbiters than the k-arbiters. A uniform (h; k)-arbiter is a generalization of the majority coterie for 1-mutual exclusion. A (k + 1)-cube (h; k)-arbiter is a generalization of square grid coterie for 1-mutual exclusion.

h-out of-k mutual exclusion is a generalization of 1-mutual exclusion problem, where there are k limits of shared resources and each process requests h(1⩽h⩽k) units at the same time. Though the k-arbiter has been shown to be a quorum-based solution to this problem, quorums in the k-arbiter are much larger than these in the 1-coterie for 1-mutual exclusion. Thus, the algorithm based on the k-arbiter needs many messages. This paper defines two (h, k)-arbiters for h-out of-k mutual exclusion: a uniform (h, k)-arbiter and a (k+1)-cube (h, k)-arbiter. The quorums in each (h, k)-arbiter are not larger than the ones in the corresponding k-arbiter; consequently using the (h, k)-arbiters is more efficient than using the k-arbiters. Uniform (h, k)-arbiter is an optimal generalization of the majority coterie for 1-mutual exclusion. (k+1)-cube (h, k)-arbiter is a quasi-optimal generalization of square grid coterie for 1-mutual exclusion

This paper describes algorithms for a distributed program debugger based on a replay technique. Halting at breakpoints and selective tracing are its fundamental features. In distributed systems, a given breakpoint or trace condition does not uniquely define the global state at which to halt or trace, because of the asynchrony of processes and communications. This paper therefore proposes the "firsf" global state Znf(P) to be the best global state at which to halt or trace, for a given condition P. Two kinds of global conditions related to plural processes, Conjunctive Predicates and Disjunctive Predicates, are considered. The authors present an algorithm that halts processes at Znf(P) for a given Conjunctive Predicate P. It is also shown that, for a Disjunctive Predicate P, it is impossible to halt at Znf(P), but possible to halt at some state which satisfies P. An algorithm is also provided for selective tracing when a Conjunctive or Disjunctive Predicate selection condition is &WI. 0 l!w Academic PW, IX.

This paper discusses the generalized mutual exclusion problem defined by H. Kakugawa and M. Yamashita. A set of processes shares a set of resources of an identical type. Each resource must be accessed by at most one process at any time. Each process may have different accessible resources. If two processes have no common accessible resource, it is reasonable to ensure a condition in resource allocation, which is called allocation independence in this paper, i.e., resource allocation to those processes must be performed without any interference. In this paper, we define a new structure, sharing structure coterie. By using a sharing structure coterie, the resource allocation algorithm proposed by H. Kakugawa and M. Yamashita ensures the above condition. We show a necessary and sufficient condition of the existence of a sharing structure coterie. The decision of the existence of a sharing structure coterie for an arbitrary distributed system is NP-complete. Furthermore, we show a resource allocation algorithm which guarantees the above requirement for distributed systems whose sharing structure coteries do not exist or are difficult to obtain. key words: distributed systems, coterie, resource allocation algorithm * * In [4], tuple (U, R, α) is called the sharing structure of a distributed system.

For designing reliable and efficient communications networks, the problem of constructing a maximally connected d-regular digraph (directed graph) with a small diameter is investigated. A maximally connected d-regular digraph with a diameter at most two larger than the lower bound for any number of nodes n > 2d and any d > 3 is constructed. Since the diameter of this digraph is quasiminimal (at most one larger than the lower bound) for n < d3 + d, we can construct maximally connected d-regular digraphs with a quasiminimal diameter for any n ( > d) and d, even for those cases not covered in previous papers.

and edge faults F might occur. The diameter D( R(G, p)/F) of the surviving route graph could be one of the fault-tolerant measurements. This paper shows the following results for a w-connected graph G = (I', E): (1) If IV 1 2 2~ 2, then there is a routing pl such that if 1 F 1 -c K, then D( R(G, p,)/F) < 3. (2) If I V I a tc2 and K f 2 and 4, then there is a p2 such that if I F I c K, then D( R(G, pZ)/F) ( 5.

This paper proposes a cake-cutting protocol using cryptography when the cake is a heterogeneous good that is represented by an interval on a real line. Although the Dubins-Spanier moving-knife protocol with one knife achieves simple fairness and truthfulness, all players must execute the protocol synchronously. Thus, the protocol cannot be executed on asynchronous networks such as the Internet. We show that the moving-knife protocol can be executed approximately but asynchronously by a discrete protocol using a secure auction protocol. The number of cuts is n − 1 where n is the number of players, which is the minimum. Sgall and Woeginger proposed another asynchronous protocol that satisfies simple fairness, truthfulness, and the minimum number of cuts. These two protocols are compared from the viewpoint of social surplus. The simulation result shows that the cryptographic moving-knife protocol is better than the Sgall-Woeginger protocol.

This paper presents a quorum-based distributed algorithm for the extended group mutual exclusion problem. In the group mutual exclusion problem, multiple processes can enter a critical section simultaneously if they belong to the same group. Processes in different groups cannot enter a critical section at the same time. In the extended group mutual exclusion, each process is a member of multiple groups at the same time. Each process can select which group it belongs at making a request. The algorithm for the group mutual exclusion cannot be applied for this extended problem, since there can be a case that two processes are prevented from entering a critical section simultaneously even when they are capable of doing so. We call the above situation unnecessary blocking. We present a quorum-based algorithm that prevents unnecessary blocking and show its correctness proof. 1 This definition allows that when a process makes a new request after using CD , the new request might be for CD .