The problem of securing data present on USB memories and SD cards has not been adequately addressed in the cryptography literature. While the formal notion of a tweakable enciphering scheme (TES) is well accepted as the proper primitive for secure data storage, the real challenge is to design a low cost TES which can perform at the data rates of the targeted memory devices. In this work, we provide the first answer to this problem. Our solution, called STES, combines a stream cipher with a XOR universal hash function. The security of STES is rigorously analyzed in the usual manner of provable security approach. By carefully defining appropriate variants of the multi-linear hash function and the pseudo-dot product based hash function we obtain controllable trade-offs between area and throughput. We combine the hash function with the recent hardware oriented stream ciphers, namely Mickey, Grain and Trivium. Our implementations are targeted towards two low cost FPGAs-Xilinx Spartan 3 and Lattice ICE40. Simulation results demonstrate that the speeds of encryption/decryption match the data rates of different USB and SD memories. We believe that our work opens up the possibility of actually putting FPGAs within controllers of such memories to perform low-level in-place encryption.

We show several concrete attacks on an authenticated encryption (AE) scheme PAE, which appeared in the IEEE TRANSACTIONS ON INFORMATION THEORY, vol. 56, no. 8, pp. 4025-4037. In addition, we show some flaws and oversights in the analysis (presented in the same paper) used to prove PAE to be a secure AE scheme.

Payments through cards have become very popular in today's world. All businesses now have options to receive payments through this instrument, moreover most organizations store card information of its customers in some way to enable easy payments in future. Credit card data is a very sensitive information and its theft is a serious threat to any company. Any organization that stores such data needs to achieve payment card industry (PCI) compliance, which is an intricate process. Recently a new paradigm called “tokenization” has been proposed to solve the problem of storage of payment card information. In this paradigm instead of the real credit card data a token is stored. To our knowledge, a formal cryptographic study of this new paradigm has not yet been done. In this paper we formally define the syntax of a tokenization system, and several notions of security for such systems. Finally, we provide some constructions of tokenizers and analyze their security in the light of our definitions.

Privacy of data stored at un-trusted servers is an important problem of today. A solution to this problem can be achieved by encrypting the outsourced data, but simple encryption does not allow efficient query processing. In this paper we propose a novel scheme for encrypting relational databases so that range queries can be efficiently executed on the encrypted data. We formally define the syntax and security of the problem and specify a scheme called ESRQ1. ESRQ1 uses a deterministic encryption scheme along with bitmap indices to encrypt a relational database. We provide details of the functionality of ESRQ1 and prove its security in the specified model.

A new class of polynomials was introduced by Bernstein (Bernstein 2007) which were later named by Sarkar as BernsteinRabin-Winograd (BRW) polynomials (Sarkar 2009). For the purpose of authentication, BRW polynomials offer considerable computational advantage over usual polynomials: (m - 1) multiplications for usual polynomial hashing versus ⌊m/2⌋ multiplications and ⌈log2m⌉ squarings for BRW hashing, where m is the number of message blocks to be authenticated. In this paper, we develop an efficient pipelined hardware architecture for computing BRW polynomials. The BRW polynomials have a nice recursive structure which is amenable to parallelization. While exploring efficient ways to exploit the inherent parallelism in BRW polynomials we discover some interesting combinatorial structural properties of such polynomials. These are used to design an algorithm to decide the order of the multiplications which minimizes pipeline delays. Using the nice structural properties of the BRW polynomials we present a hardware architecture for efficient computation of BRW polynomials. Finally, we provide implementations of tweakable enciphering schemes proposed in Sarkar 2009 which use BRW polynomials. This leads to the fastest known implementation of disk encryption systems.

Tweakable enciphering schemes are length-preserving block cipher modes of operation that provide a strong pseudorandom permutation. It has been suggested that these schemes can be used as the main building blocks for achieving in-place disk encryption. In the past few years, there has been an intense research activity toward constructing secure and efficient tweakable enciphering schemes. But actual experimental performance data of these newly proposed schemes are yet to be reported. In this paper, we present optimized FPGA implementations of six tweakable enciphering schemes, namely, HCH, HCTR, XCB, EME, HEH, and TET, using a 128-bit AES core as the underlying block cipher. We report the performance timings of these modes when using both pipelined and sequential AES structures. The universal polynomial hash function included in the specification of HCH, HCHfp (a variant of HCH), HCTR, XCB, TET, and HEH was implemented using a Karatsuba multiplier as the main building block. We provide detailed algorithm analysis of each of the schemes trying to exploit their inherent parallelism as much as possible. Our experiments show that a sequential AES core is not an attractive option for the design of these modes as it leads to rather poor throughput. In contrast, according to our place-and-route results on a Xilinx Virtex 4 FPGA, our designs achieve a throughput of 3.95 Gbps for HEH when using an encryption/decryption pipelined AES core, and a throughput of 5.71 Gbps for EME when using a encryption-only pipeline AES core. The performance results reported in this paper provide experimental evidence that hardware implementations of tweakable enciphering schemes can actually match and even outperform the data rates achieved by state-of-the-art disk controllers, thus showing that they might be used for achieving provably secure in-place hard disk encryption.

This paper introduces two new algorithms to reduce the number of objectives in a multiobjective problem by identifying the most conflicting objectives. The proposed algorithms are based on a feature selection technique proposed by Mitra et. al. [11]. One algorithm is intended to determine the minimum subset of objectives that yields the minimum error possible, while the other finds a subset of objectives of a given size that yields the minimum error. To validate these algorithms we compare their results against those obtained by two similar algorithms recently proposed. The comparative study shows that our algorithms are very competitive with respect to the reference algorithms. Additionally, our approaches require a lower computational time. Also, in this study we propose to use the inverted generational distance to evaluate the quality of a subset of objectives.

The notion of tweakable block ciphers was formally introduced by Liskov-Rivest-Wagner at Crypto 2002 (the 2002 Annual International Cryptology Conference). The extension and the first construction, called CMC, of this notion to tweakable enciphering schemes which can handle variable length messages was given by Halevi-Rogaway at Crypto 2003. In this paper, we present HCH, which is a new construction of such a scheme. The construction uses two universal hash computations with a counter mode of encryption in-between. This approach was first proposed by McGrew-Viega to build a scheme called XCB and later used by Wang-Feng-Wu, to obtain a scheme called HCTR. A unique feature of HCH compared to all known tweakable enciphering schemes is that HCH uses a single key, can handle arbitrary length messages, and has a quadratic security bound. An important application of a tweakable enciphering scheme is disk encryption. HCH is well suited for this application. We also describe a variant, which can utilize precomputation and makes one less block cipher call. This compares favorably to other hash-encrypt-hash-type constructions, supports better key agility and requires less key material.

This work builds on earlier work by Rogaway at Asiacrypt 2004 on tweakable block cipher (TBC) and modes of operations. Our first contribution is to generalize Rogaway's TBC construction by working over a ring${\mmb R}$and by the use of a masking sequence of functions. The ring${\mmb R}$can be instantiated as either GF$(2^{n})$or as$ {\BBZ }_{2^{n}}$. Further, over GF$(2^{n})$, efficient instantiations of the masking sequence of functions can be done using either a binary linear feedback shift register (LFSR); a powering construction; a cellular automata map; or by using a word-oriented LFSR. Rogaway's TBC construction was built from the powering construction over GF$(2^{n})$. Our second contribution is to use the general TBC construction to instantiate constructions of various modes of operations including authenticated encryption (AE) and message authentication code (MAC). In particular, this gives rise to a family of efficient one-pass AE modes of operation. Out of these, the mode of operation obtained by the use of word-oriented LFSR promises to provide a masking method which is more efficient than the one used in the well known AE protocol called OCB1.

Suppose for a given classification or function approximation (FA) problem data are collected using l sensors. From the output of the ith sensor, ni features are extracted, thereby generating p = sigma li = 1 ni features, so for the task we have X subset Rp as input data along with their corresponding outputs or class labels Y subset Rc. Here, we propose two connectionist schemes that can simultaneously select the useful sensors and learn the relation between X and Y. One scheme is based on the radial basis function (RBF) network and the other uses the multilayered perceptron (MLP) network. Both schemes are shown to possess the universal approximation property. Simulations show that the methods can detect the bad/derogatory groups of features online and can eliminate the effect of these bad features while doing the FA or classification task.

Most methods of classification either ignore feature analysis or do it in a separate phase, offline prior to the main classification task. This paper proposes a neuro-fuzzy scheme for designing a classifier along with feature selection. It is a four-layered feed-forward network for realizing a fuzzy rule-based classifier. The network is trained by error backpropagation in three phases. In the first phase, the network learns the important features and the classification rules. In the subsequent phases, the network is pruned to an "optimal" architecture that represents an "optimal" set of rules. Pruning is found to drastically reduce the size of the network without degrading the performance. The pruned network is further tuned to improve performance. The rules learned by the network can be easily read from the network. The system is tested on both synthetic and real data sets and found to perform quite well.

Suppose for a given classification or function approximation (FA) problem data are collected using l sensors. From the output of the i/sup th/ sensor n/sub i/ features are extracted, thereby generating p = /spl Sigma//sub i=1//sup l/ n/sub i/ features. So for the task at hand we have X /spl sub/ R/sup p/ as input data along with their corresponding outputs or class labels. Here we propose two novel connectionist schemes that can select the sensors that yield redundant or bad features online and also do the required task, say, FA or classification. One of the schemes is based on the Radial Basis Function network and the other uses the Multilayered Perceptron network. Simulations show that the methods can detect the bad groups of features online and can also eliminate the effect of these bad features while doing the task.

The response of a multilayered perceptron (MLP) network on points which are far away from the boundary of its training data is generally never reliable. Ideally a network should not respond to data points which lie far away from the boundary of its training data. We propose a new training scheme for MLPs as classifiers, which ensures this. Our training scheme involves training subnets for each class present in the training data. Each subnet can decide whether a data point belongs to a certain class or not. Training each subnet requires data from the class which the subnet represents along with some points outside the boundary of that class. For this purpose we propose an easy but approximate method to generate points outside the boundary of a pattern class. The trained subnets are then merged to solve the multiclass classification problem. We show through simulations that an MLP trained by our method does not respond to points which lies outside the boundary of its training sample. Also, our network can deal with overlapped classes in a better manner. In addition, this scheme enables incremental training of an MLP, i.e., the MLP can learn new knowledge without forgetting the old knowledge.

Most methods of fuzzy rule-based system identification (SI) either ignore feature analysis or do it in a separate phase. This paper proposes a novel neuro-fuzzy system that can simultaneously do feature analysis and SI in an integrated manner. It is a five-layered feed-forward network for realizing a fuzzy rule-based system. The second layer of the net is the most important one, which along with fuzzification of the input also learns a modulator function for each input feature. This enables online selection of important features by the network. The system is so designed that learning maintains the nonnegative characteristic of certainty factors of rules. The proposed network is tested on both synthetic and real data sets and the performance is found to be quite satisfactory. To get an "optimal" network architecture and to eliminate conflicting rules, nodes and links are pruned and then the structure is retrained. The pruned network retains almost the same level of performance as that of the original one.

The mountain method of clustering and its relative, the subtractive clustering method, are studied here. A scheme to improve the accuracy of the prototypes obtained by the mountain method is proposed. Finally the mountain circular shell method to detect circular shells by using the mountain function is proposed. The proposed method is tested extensively on several synthetic data sets, and the results obtained are quite satisfactory. © 2000 John Wiley & Sons, Inc.