Computer science and technology innovated over the past sixty years, have revolutionized science, the economy and societal interactions. Inherently CS constitutes a new science combining mathematics, logic, information theory and electronics, on par with physics, chemistry and the life sciences. It is appropriate to educate students in the fundamentals of this science. The curriculum should emphasize the scientific content rather than provide mere training in some programming language.

We present a highly efficient method for proving correctness of computations while preserving secrecy of the input values. This is done in an Evaluator-Prover model which can also be realized by a secure processor. We describe an application to secure auctions.

We present a practical system for conducting sealed-bid auctions that preserves the secrecy of the bids while providing for verifiable correctness and trustworthiness of the auction. The auctioneer must accept all bids submitted and follow the published rules of the auction. No party receives any useful information about bids before the auction closes and no bidder is able to change or repudiate her bid. Our solution uses Paillier's homomorphic encryption scheme [25] for zero knowledge proofs of correctness. Only minimal cryptographic technology is required of bidders; instead of employing complex interactive protocols or multi-party computation, the single auctioneer computes optimal auction results and publishes proofs of the results' correctness. Any party can check these proofs of correctness via publicly verifiable computations on encrypted bids. The system is illustrated through application to first-price, uniform-price and second-price auctions, including multi-item auctions. Our empirical results demonstrate the practicality of our method: auctions with hundreds of bidders are within reach of a single PC, while a modest distributed computing network can accommodate auctions with thousands of bids.

We show how a polynomial-time prover can commit to an arbitrary finite set S of strings so that, later on, he can, for any string x, reveal with a proof whether x /spl isin/ S or x /spl notin/ S, without revealing any knowledge beyond the verity of these membership assertions. Our method is non interactive. Given a public random string, the prover commits to a set by simply posting a short and easily computable message. After that, each time it wants to prove whether a given element is in the set, it simply posts another short and easily computable proof, whose correctness can be verified by any one against the public random string. Our scheme is very efficient; no reasonable prior way to achieve our desiderata existed. Our new primitive immediately extends to providing zero-knowledge databases.

We address the problem of the-security of cryptographic protocols in face of future advances in computing technology and algorithmic research. The problem stems from the fact may be deemed that computations which at a given point in time may be deemed infeasible, can, in the course of years or decades, be made possible with improved hardware and/or breakthroughs in code-breaking algorithms. In such cases, the security of historical , but nonetheless highly confidential data may be in jeopardy. We present a scheme for efficient secure two-party communication with provable everlasting security. The security is guaranteed in face of any future technological advances, given the current state of of the art. Furthermore, the security of the messages is also guaranteed even if the secret encryption/decryption key is revealed in the future, The scheme is based on the bounded storage model and provides information-theoretic security in this model. The bounded storage model postulates an adversary who is computationally unbounded, and is only bounded in the amount of storage (not computation space) available to store the output of his computation. The bound on the storage can be arbitrarily large (e.g., 100 Tbytes), as long as it is fixed. Given this storage bound, our protocols guarantee that even a computationally all powerful adversary gains no information about a message (except with a probability that is exponentially small in the security parameter k). The bound on storage space need only hold at the time of the message transmission. Thereafter, no additional storage space or, computational power can help the adversary in deciphering the message. We present two protocols. The first protocol, which elaborates on the autoregressive (AR) protocol of Aumann and Rabin (see Advances in Cryptology-Crypto '99, p. 65-79, 1999), employs a short secret key whose size is independent of the length of the message, but uses many public random bits. The second protocol uses an optimal number of public random bits, but employs a longer secret key. Our proof of security utilizes a novel linear algebraic technique.

We study the problem of executing parallel programs, in particular Cilk programs, on a collection of processors of different speeds. We consider a model in which each processor maintains an estimate of its own speed, where communication between processors has a cost, and where all scheduling must be online. This problem has been considered previously in the fields of asynchronous parallel computing and scheduling theory. Our model is a bridge between the assumptions in these fields. We provide a new more accurate analysis of of an old scheduling algorithm called the maximum utilization scheduler. Based on this analysis, we generalize this scheduling policy and define the high utilization scheduler. We next focus on the Cilck platform and introduce a new algorithm for scheduling Cilk multithreaded parallel programs on heterogeneous processors. This scheduler is inspired by the high utilization scheduler and is modified to fit in a Cilk context. A crucial aspect of our algorithm is that it keeps the original spirit of the Cilk scheduler. In fact, when our new algorithm runs on homogeneous processors, it exactly mimics the dynamics of the original Cilk scheduler.

We efficiently combine unpredictability and verifiability by extending the Goldreich-Goldwasser-Micali (1986) construction of pseudorandom functions f/sub s/ from a secret seed s, so that knowledge of s not only enables one to evaluate f/sub s/ at any point x, but also to provide an NP-proof that the value f/sub s/(x) is indeed correct without compromising the unpredictability of f/sub s/ at any other point for which no such a proof was provided.

The goal of this paper is to introduce a simple verifiable secret sharing scheme, to improve the efficiency of known secure multiparty protocols and, by employing these techniques, to improve the efficiency of applications which use these protocols.First we present a very simple Verifiable Secret Sharing protocol which is based on fast cryptographic primitives and avoids altogether the need for expensive zero-knowledge proofs.This is followed by a highly simplified protocol to compute multiplications over shared secrets.This is a major component in secure multiparty computation protocols and accounts for much of the complexity of proposed solutions.Using our protocol as a plug-in unit in known protocols reduces their complexity.We show how to achieve efficient multiparty computations in the computational model, through the application of homomorphic commitments.Finally, we present fast-track multiparty computation protocols.In a model in which malicious faults are rare we show that it is possible to carry out a simpler and more efficient protocol which does not perform all the expensive checks needed to combat a malicious adversary from foiling the computation.Yet, the protocol still enables detection of faults and recovers the computation when faults occur without giving any information advantage to the adversary.This results in protocols which are much more efficient under normal operation of the system i.e. when there are no faults.As an example of the practical impact of our work we show how our techniques can be used to greatly improve the speed and the fault-tolerance of existing threshold cryptography protocols.

We establish, for the first time, lower bounds for randomized mutual exclusion algorithms (with a read-modify-write operation). Our main result is that a constant-size shared variable cannot guarantee strong fairness, even if randomization is allowed. In fact, we prove a lower bound of $\Omega (\log\log n)$ bits on the size of the shared variable, which is also tight. We investigate weaker fairness conditions and derive tight (upper and lower) bounds for them as well. Surprisingly, it turns out that slightly weakening the fairness condition results in an exponential reduction in the size of the required shared variable. Our lower bounds rely on an analysis of Markov chains that may be of interest on its own and may have applications elsewhere.

In this paper we present a simple geometric-like series of elements in a finite field F/sub q/, and show that computing its sum is NP-hard. This problem is then reduced to the problem of counting mod p the number of zeroes in a linear recurrence sequence with elements in a finite F/sub p/, where p is a small prime. Hence the latter problem is also NP-hard. In the lecture we shall also survey other computationally hard algebraic problems.

One of the most sought after software innovation of this decade is the construction of systems using off-the-shelf-workstations that actually deliver and even surpass, the power and reliability of supercomputers. Using completely novel techniques: eager scheduling, evasive memory layouts and dispersed data management it is possible to build an execution environment for parallel programs on workstation networks. These techniques were originally developed in a theoretical framework for an abstract machine which models a shared memory asynchronous multiprocessor. The network of workstations platform presents an inherently asynchronous environment for the execution of our parallel program. This gives rise to substantial problems of correctness of the computation and of proper automatic load balancing of the work amongst the processors, so that a slow processor will not hold up the total computation. A limiting case of asynchrony is when a processor becomes infinitely slow, i.e. fails. Our methodology copes with all these problems, as well as with memory failures. An interesting feature of this system is that it is neither a fault-tolerant system extended for parallel processing nor is it parallel processing system extended for fault tolerance. The same novel mechanisms ensure both properties.

Lotteries with the unique maximum property and the unique winner property are considered. Tight lower bounds are proven on the domain size of such lotteries.

An n-thread parallel program p is large-grained if in every parallel step the computations on each of the threads are complex procedures requiring numerous processor instructions. This practically relevant style of programs differs from PRAM programs in its large granularity and the possibility that within a parallel step the computations on different threads may considerably vary in size. Let M be an n-processor asynchronous parallel system, with no restriction on the degree of asynchrony and without any specialized synchronization mechanisms. It is a challenging theoretical as well as practically important problem to ensure correct execution of P on such a parallel machine. Let P be a large-grained program requiring total work W for its execution on a synchronous a-processor parallel system. We present a transformation (compilation) of P into a program C(P) which correctly and efficiently effects the computation of P on the asynchronous machine M. Under moderate assumptions on the granularity of threads and the size of the program variables, execution of C(P) requires just O(Wlog* n) expected total work, and the memory space overhead is a small multiplicative constant.>

We establish, for the first time, lower bounds for randomized mutual-exclusion algorithms (with a read-modify-write operation). Our main result is that a constant size shared-variable cannot guarantee strong fairness, even if randomization is allowed. In fact, we prove a lower bound of\\Omega\\Gamma/46 log n) bits on the size of the shared-variable, which is also tight. We investigate weaker fairness conditions and derive tight (upper and lower) bounds for them as well. Surprisingly, it turns out that slightly weakening the fairness condition results in an exponential reduction in the size of the required shared-variable. Our lower bounds rely on an analysis of Markovchains, that may be of interest on its own and may have applications elsewhere. Keywords: Mutual Exclusion, Randomized Distributed Algorithms, Markov-Chains, Lower-Bounds. 1 Introduction Randomization has played an important role in the design and understanding of distributed algorithms. It is a natural tool which is usual...

The authors discuss the question of simulating synchronous computations on asynchronous systems. They consider an asynchronous system with very weak, or altogether lacking any, atomicity assumptions. The first contribution of this paper is a novel clock for asynchronous systems. The clock is a basic tool for synchronization in the asynchronous environment. It is a very robust construction and can operate in a system with no atomicity assumptions, and in the presence of a dynamic scheduler. The behavior of the clock is obtained with overwhelming probability (1-2/sup - alpha n/, alpha >0). The authors show how to harness this clock to drive a PRAM simulation on an asynchronous system. The resulting simulation scheme is more efficient than existing ones, while actually relaxing the assumptions on the underlying asynchronous system.>

In [4] a randomized algorithm for mutual exclusion with bounded waiting, employing a logarithmic sized shared variable, was given. Saias and Lynch [5] pointed out that the adversary scheduler postulated in the above paper can observe the behavior of processes in the interval between an opening of the critical section and the next closing of the critical section. it can then draw conclusions about values of their local variables as well as the value of the randomized round number component of the shared variable, and arrange the schedule so as to discriminate against a chosen process. This invalidates the claimed properties of the algorithm.

In this paper, we address the problem of automatically transforming arbitrary programs written for an ideal parallel machine to run on a completely asynchronous machine. We present a transformation which can be applied to an ideal program such that the resulting program's execution on an asynchronous machine is work and space efficient, relative to the ideal program from which it is derived. Above all, the transformation will guarantee that the ideal program will execute in a continually progressive manner on the asynchronous machine; these instructions are not universal. Furthermore, the individual processors can get delayed for arbitrary amounts of time while executing any instruction. In contrast, previous work relied either on the asynchronous machine having universal read-modify-write instructions as primitives, or on limited asynchrony by restricting the relative speeds of the processors.

An Information Dispersal Algorithm (IDA) is developed that breaks a file F of length L = ↿ F ↾ into n pieces F i , l ≤ i ≤ n , each of length ↿ F i ↾ = L / m , so that every m pieces suffice for reconstructing F . Dispersal and reconstruction are computationally efficient. The sum of the lengths ↿ F i ↾ is ( n / m ) · L . Since n / m can be chosen to be close to l, the IDA is space efficient. IDA has numerous applications to secure and reliable storage of information in computer networks and even on single disks, to fault-tolerant and efficient transmission of information in networks, and to communications between processors in parallel computers. For the latter problem provably time-efficient and highly fault-tolerant routing on the n -cube is achieved, using just constant size buffers.

Simultaneous broadcast [CGMAJ is a fundamental tool in designing secure protocols for fault tolerant distributed computing.A system that supports it enables n processes to globally commit to independently chosen values (a significantly harder task than mere agreement).It is also a basic building block in a recent %ompleteness" theorem of [GMWZ].In this paper we present a new protocol for simultaneous broadcast.Building upon past work, we introduce a novel method of concurrently alternating and interleaving n executions of verifiable secret sharing protocols.This approach greatly improves the time complexity (number of communication rounds) of simultaneous broadcast.Previous protocols (combination of [CGMA] and [GMW]) q re uired the complete serialization of the ra verifiable secret sharings, resulting in n(n) communication rounds.Our protocol is constructive, and requires only log n + log log n serial executions of verifiable secret sharings.It preserves maximum fault tolerance (t < n/2 faults), and polynomial resource bounds (internal computation and communication bits).The same improvement appiies to the general simulation in [GMWX].In light of its improved performance, it is significant that our our protocol has a fairly simple correctness proof.In the slippery business of distributed cryptographic protocols, simpler proofs are important.

We present a randomized solution for the Byzantine Generals Problems. The solution works in the synchronous as well as the asynchronous case and produces Byzantine Agreement within a fixed small expected number of computational rounds, independent of the number n of processes and the bound t on the number of faulty processes. The solution uses A. Shamir's method for sharing secrets. It specializes to produce a simple solution for the Distributed Commit problem.

We present a logic LL which uses a modal operator L to help capture the notion of likely. Despite the fact that no use is made of numbers, LL can capture many of the properties of likelihood in an intuitively appealing way. Using standard techniques of modal logic, we give a complete axiomatization for LL and show that satisfiability of LL formulas can be decided in exponential time. We discuss how the logic might be used in areas where decision making is crucial, such as management and medical diagnosis, and conclude by using LL to give a formal proof of correctness of a protocol for exchanging secrets.

It is shown that distributed systems of probabilistic processors are essentially more powerful than distributed systems of deterministic processors, i.e., there are certain useful behaviors that can be realized only by the former. This is demonstrated on the dining philosophers problem. It is shown that, under certain natural hypotheses, there is no way the philosophers can be programmed (in a deterministic fashion) so as to guarantee the absence of deadlock (general starvation). On the other hand, if the philosophers are given some freedom of choice one may program them to guarantee that every hungry philosopher will eat (with probability one) under any circumstances (even an adversary scheduling). The solution proposed here is fully distributed and does not involve any central memory or any process with which every philosopher can communicate.

The problem of implementing mutual exclusion of N asynchronous parallel processes in a model where the primitive communication mechanism is a test-and-set operation on a shared variable, was the subject of extensive research. While a two-valued variable suffices to insure mutual exclusion, it is shown in [1] that N/2 values are necessary to avoid lockout of any process, and N + 1 values are required to insure bounded waiting time. We introduce the idea of employing randomization in the synchronization protocol and achieve a mutual exclusion, lockout-free, bounded-waiting solution using just 4(log2N+4)-valued shared variable. The protocol is extremely simple, easy to implement, and avoids certain undesirable features present in some of the other solutions.

We present probabilistic algorithms for the problems of finding an irreducible polynomial of degree n over a finite field, finding roots of a polynomial, and factoring a polynomial into its irreducible factors over a finite field. All of these problems are of importance in algebraic coding theory, algebraic symbol manipulation, and number theory. These algorithms have a very transparent, easy to program structure. For finite fields of large characteristic p, so that exhaustive search through ${\text{Z}}_p $, is not feasible, our algorithms are of lower order in the degrees of the polynomial and fields in question, than previously published algorithms.

Random access machines (RAMs) are usually defined to have registers that hold integers. While this captures in part the structure of a commercial computer, it overlooks an implementation-dependent feature of most binary oriented machines, namely their ability to operate bit by bit on the bit vectors used to represent integers. Typical operations are bit-wise Boolean operations (and, or, not, etc.) and shifts by an amount specified in some register. These operations are ideal for certain problems, such as dealing with sets represented as bit vectors, some parsing algorithms [4], propositional calculus theorem proving, and analysis of sorting networks. A RAM so implemented we shall call a vector machine.

We study certain first and second order theories which are semantically defined as the sets of all sentences true in certain given structures. Let be a structure where A is a non-empty set, λ is an ordinal, and Pα is an n(α)-ary relation or function4 on A. With we associate a language L appropriate for which may be a first or higher order calculus. L has an n(α)-place predicate or function constant P for each α < λ. We shall study three types of languages: (1) first-order calculi with equality; (2) second-order monadic calculi which contain monadic predicate (set) variables ranging over subsets of A; (3) restricted (weak) second-order calculi which contain monadic predicate variables ranging over finite subsets of A.

No abstract available.

A definite automaton is, roughly speaking, an automaton (sequential circuit) with the property that for some fixed integer k its action depends only on the last k inputs. The notion of a definite event introduced by Kleene, as well as the related concepts of definite automata and tables, are studied here in detail. Basic results relating to the minimum number of states required for synthesizing an automaton of a given degree of definiteness are proved. We give a characterization of all k-definite events definable by k+1 state automata. Various decision problems pertaining to definite automata are effectively solved. We also solve effectively the problem of synthesizing a minimal automaton defining a given definite event. The solutions of decision and synthesis problems given here are practical in the sense that if the problem is presented by n units of information, then the algorithm in question requires about n3 steps of a very elementary nature (rather than requiring about 2n steps as some algorithms for automata do, which puts them beyond the capacity of the largest computers even for relatively small values of n). A notion of equivalence of definite events is introduced and the uniqueness of the minimal automaton defining an event in an equivalence class is proved.

In this note we shall prove a certain relative recursiveness lemma concerning countable models of set theory (Lemma 5). From this lemma will follow two results about special types of such models. Kreisel [5] and Mostowski [6] have shown that certain (finitely axiomatized) systems of set theory, formulated by means of the ϵ relation and certain additional non-logical constants, do not possess recursive models. Their purpose in doing this was to construct consistent sentences without recursive models. As a first corollary of Lemma 5, we obtain a very simple proof, not involving any formal constructions within the system of the notions of truth and satisfiability, of an extension of the Kreisel-Mostowski theorems. Namely, set theory with the single non-logical constant ϵ does not possess any recursively enumerable model. Thus we get, as a side product, an easy example of a consistent sentence containing a single binary relation which does not possess any recursively enumerable model; this sentence being the conjunction of the (finitely many) axioms of set theory.