A family of subsets C of [n] =def{1,...,n} is (r, t)-exclusive if for every S sub [n] of size at least n - r, there exist S1,...,Stisin C with S = S1cupS2cup...cupSt. These families, also known as complement-cover families, have cryptographic applications, and form the basis of information-theoretic broadcast encryption and multi-certificate revocation. We give the first explicit construction of such families with size poly(r, t)nrt/, essentially matching a basic lower bound. Our techniques are algebraic in nature. When r = O(t), as is natural for many applications, we can improve our bound to poly(r, t)(nr)1t/. Further, when r, t are small, our construction is tight up to a factor of r. We also provide a poly(r, t, log n) algorithm for finding S1,...,St, which is crucial for efficient use in applications. Previous constructions either had much larger size, were randomized and took super-polynomial time to find S1,...,St, or did not work for arbitrary n, r, and t. Finally, we improve the known lower bound on the number of sets containing each i isin [n]. Our bound shows that our derived broadcast encryption schemes have essentially optimal total number of keys and keys per user for n users, transmission size t, and revoked set size r

Existing techniques for designing efficient password authenticated key exchange (PAKE) protocols all can be viewed as variations of a small number of fundamental paradigms, and all are based on either the Diffie-Hellman or RSA assumptions. In this paper we propose a new technique for the design of PAKE protocols that does not fall into any of those paradigms, and which is based on a different assumption. In our technique, the server uses the password to construct a multiplicative group with a (hidden) smooth order subgroup, where the group order depends on the password. The client uses its knowledge of the password to generate a root extraction problem instance in the server's group and a discrete logarithm problem instance in the (smooth order) subgroup. If the server constructed its group correctly based on the password, the server can use its knowledge of the group order to solve the root extraction problem, and can solve the discrete logarithm problem by leveraging the smoothness of the hidden subgroup.The resulting scheme is provably secure (in the random oracle model) under the "decision subgroup assumption." The scheme can be efficiently instantiated using composite modulus groups, in which case the client and server each perform the equivalent of a small number of modular exponentiations, and the security reduces to a simple variant of the "Φ-hiding" assumption. We provide preliminary implementation results of this instantiation.

This paper is a preliminary exploration of secure distributed human computation. We consider the general paradigm of using large-scale distributed computation to solve difficult problems, but where humans can act as agents and provide candidate solutions. We are especially motivated by problem classes that appear to be difficult for computers to solve effectively, but are easier for humans; e.g., image analysis, speech recognition, and natural language processing. This paradigm already seems to be employed in several real-world scenarios, but we are unaware of any formal and unified attempt to study it. Nonetheless, this concept spawns interesting research questions in algorithm design, human computer interfaces, and programming language / API design, distributed systems, and cryptography, among other fields. There are also interesting implications for Internet commerce and the B24b model. We describe this research area and suggest a basic framework for the design of such systems. We analyze security and reliability against malicious parties using standard probability theory tools. We then derive design principles using standard decision-theory concepts. Finally, we list extensions and open problems.

Energy is a fundamental resource limitation in mobile and wireless devices. Much research in mobile and wireless networking over the past decade has examined ways of reducing energy usage, including specific techniques such as energy-aware protocols for routing and communication. However, to our knowledge, no systematic way has been developed for reasoning generally about the energy consumption of algorithms. A method for analyzing energy complexity at an abstract algorithmic level would be invaluable. However, it is not clear if we can develop a uniform abstract model of energy complexity that has both theoretical and practical value. This paper surveys techniques for modeling and minimizing energy consumption at various system levels, so as to place algorithmic energy complexity in perspective. We then discuss the attributes an energy complexity model should have, and describe our initial approach towards developing such a model. We end by discussing future technical directions.

We consider the problem of maintaining end-to-end security in the presence of intelligent proxies that may adaptively modify data being transmitted across a network. The video coding community considers this problem in the context of transcoding media streams, but their approaches either fail to address authentication or fail to provide meaningful security guarantees. We present two provably-secure schemes, LISSA and TRESSA, that allow an intelligent network intermediary to intercept a stream signed by a content provider, and adapt it dynamically, while preserving the ultimate receiver's ability to securely verify the content provider's signature (and, hence, authenticity and integrity of the data received). Our schemes allow the intermediary to selectively remove portions of the stream and, thus, permit common media transcoding techniques such as scalable compression and multiple file switching. Moreover, a content provider only has to encode and sign its entire data stream once, as opposed to nondynamically encoding and signing different versions for each anticipated combination of device, network configuration, and channel condition. Our implementation results demonstrate efficiency.

There has been a surge of interest in the delivery of personalized information to users (e.g., personalized stocks or travel information), particularly as mobile users with limited terminal device capabilities increasingly desire updated and targeted information in real time. When the number of information recipients is large and there is sufficient commonality in their interests, as is often the case, IP multicast is an efficient way of delivering the information. However, IP multicast services do not consider the structure and semantics of the information in the multicast process. We propose the use of Content-Based Multicast (CBM) where extra content filtering is performed at the interior nodes of the IP multicast tree; this will reduce network bandwidth usage and delivery delay, as well as the computation required at the sources and sinks. We evaluate the situations in which CBM is advantageous. The benefits of CBM depend critically upon how well filters are placed at interior nodes of the IP multicast tree and the costs depend upon those introduced by filters themselves. Further, we consider the benefits of allowing the filters to be mobile so as to respond to user mobility or changes in user interests and the corresponding costs of filter mobility. The criterion that we consider is the total network bandwidth utilization. For this criterion, we develop an optimal filter placement algorithm, as well as a heuristic that executes faster than the optimal algorithm. We evaluate the algorithms by means of simulation experiments. Our results indicate that filters can be effective in substantially reducing bandwidth. We also find filter mobility is worthwhile if there is marked large-scale user mobility. We conclude with suggestions for further work.