We construct good GKP (Gottesman-Kitaev-Preskill) codes (in the sense of Conrad, Eisert and Seifert proposed) from standard short integer solution lattices (SIS) as well as from ring SIS and module SIS lattices, R-SIS and M-SIS lattices, respectively. These lattice are crucial for lattice-based cryptography. Our construction yields GKP codes with distance $\sqrt{n/πe}$. This compares favorably with the NTRU-based construction by Conrad et al. that achieves distance $Ω(\sqrt{n/q}),$ with $n\le q^2/0.28$. Unlike their codes, our codes do not have secret keys that can be used to speed-up the decoding. However, we present a simple decoding algorithm that, for many parameter choices, experimentally yields decoding results similar to the ones for NTRU-based codes. Using the R-SIS and M-SIS construction, our simple decoding algorithm runs in nearly linear time. Following Conrad, Eisert and Seifert's work, our construction of GKP codes follows directly from an explicit, randomized construction of symplectic lattices with (up to constants $\approx 1$) minimal distance $(1/σ_{2n})^{1/2n}\approx \sqrt{\frac{n}{πe}}$, where $σ_{2n}$ is the volume of the 2n-dimensional unit ball. Before this result, Buser and Sarnak gave a non-constructive proof for the existence of such symplectic lattices.

The fuzzy K -means problem is a popular generalization of the well-known K -means problem to soft clusterings. In this article, we present the first algorithmic study of the problem going beyond heuristics. Our main result is that, assuming a constant number of clusters, there is a polynomial time approximation scheme for the fuzzy K -means problem. As a part of our analysis, we also prove the existence of small coresets for fuzzy K -means. At the heart of our proofs are two novel techniques developed to analyze the otherwise notoriously difficult fuzzy K -means objective function.

We introduce updatable anonymous credential systems (UACS) and use them to construct a new privacy-preserving incentive system. In a UACS, a user holding a credential certifying some attributes can interact with the corresponding issuer to update his attributes. During this, the issuer knows which update function is run, but does not learn the user's previous attributes. Hence the update process preserves anonymity of the user. One example for a class of update functions are additive updates of integer attributes, where the issuer increments an unknown integer attribute value v by some known value k. This kind of update is motivated by an application of UACS to incentive systems. Users in an incentive system can anonymously accumulate points, e.g. in a shop at checkout, and spend them later, e.g. for a discount. In this paper, we (1) formally define UACS and their security, (2) give a generic construction for UACS supporting arbitrary update functions, and (3) construct a new incentive system using UACS that is efficient while offering offline double-spending protection and partial spending.

We present CLARC (Cryptographic Library for Anonymous Reputation and Credentials), an anonymous credentials system (ACS) combined with an anonymous reputation system.

Blömer et al. have presented a cloud architecture for enabling fine-grained cryptographic access control to data in the cloud. The architecture is intended to provide this service to large-scale orgnaizations. We revisit the cloud architecture, and enrich it with searchable encryption. In the process, we identify some shortcomings of Blömer et al.'s architecture, that prevent many cryptographic primitives from being implemented within the framework of the architecture. Subsequently, we propose fixes to these issues. As a result, we are able to propose a concrete instantiation of searchable encryption, in the form of Bost's Σoφoς scheme, in Blömer et al.'s architecture. Moreover, with our fixes, other primitives can be adapted to the architecture as well.

The fuzzy $K$-means problem is a popular generalization of the well-known $K$-means problem to soft clusterings. We present the first coresets for fuzzy $K$-means with size linear in the dimension, polynomial in the number of clusters, and poly-logarithmic in the number of points. We show that these coresets can be employed in the computation of a $(1+ε)$-approximation for fuzzy $K$-means, improving previously presented results. We further show that our coresets can be maintained in an insertion-only streaming setting, where data points arrive one-by-one.

One of the most popular fuzzy clustering techniques is the fuzzy K-means algorithm (also known as fuzzy-c-means or FCM algorithm). In contrast to the K-means and K-median problem, the underlying fuzzy K-means problem has not been studied from a theoretical point of view. In particular, there are no algorithms with approximation guarantees similar to the famous K-means++ algorithm known for the fuzzy K-means problem. This work initiates the study of the fuzzy K-means problem from an algorithmic and complexity theoretic perspective. We show that optimal solutions for the fuzzy K-means problem cannot, in general, be expressed by radicals over the input points. Surprisingly, this already holds for simple inputs in one-dimensional space. Hence, one cannot expect to compute optimal solutions exactly. We give the first (1+eps)-approximation algorithms for the fuzzy K-means problem. First, we present a deterministic approximation algorithm whose runtime is polynomial in N and linear in the dimension D of the input set, given that K is constant, i.e. a polynomial time approximation scheme (PTAS) for fixed K. We achieve this result by showing that for each soft clustering there exists a hard clustering with similar properties. Second, by using techniques known from coreset constructions for the K-means problem, we develop a deterministic approximation algorithm that runs in time almost linear in N but exponential in the dimension D. We complement these results with a randomized algorithm which imposes some natural restrictions on the sought solution and whose runtime is comparable to some of the most efficient approximation algorithms for K-means, i.e. linear in the number of points and the dimension, but exponential in the number of clusters.

In this work, we show how to use instruction skip faults to transfers the discrete logarithm problem from a cryptographically strong elliptic curve to a weak singular curve. More specifically, we attack the algorithm that computes from a field element a point on the curve. This algorithm is a building block of point decompression, hashing to curves, and random point sampling. Our attack is most powerful for curves of j-invariant zero that often occur in pairing based cryptography. Therefore, to demonstrate the effectivity of our attack in practice, we perform it on an AVR Xmega A1 for the pairing based Boneh-Lynn-Shacham short signature scheme.

In the last decade pairings have become an important, and often indispensable, ingredient in the construction of identity-based and attribute-based cryptosystems, as well as group signatures and credential systems. Consequently, the applicability of timing, power, or fault attacks to implementations of pairings is an important research topic. We will review some of the known results in this area.

Several fault attacks against pairing-based cryptography have been described theoretically in recent years. Interestingly, none of these has been practically evaluated. We accomplish this task and prove that fault attacks against pairing-based cryptography are indeed possible and even practical - thus posing a serious threat. Moreover, we successfully conduct a second-order fault attack against an open source implementation of the eta pairing on an AVR XMEGA A1. We inject the first fault into the computation of the Miller Algorithm and apply the second fault to completely skip the final exponentiation. We introduce a low-cost setup that allows us to generate multiple independent faults in one computation. The setup implements these faults by clock glitches which induce instruction skips. With this setup we conducted the first practical fault attack against a complete pairing computation.

In this paper we provide a new analysis of the SEM algorithm. Unlike previous work, we focus on the analysis of a single run of the algorithm. First, we discuss the algorithm for general mixture distributions. Second, we consider Gaussian mixture models and show that with high probability the update equations of the EM algorithm and its stochastic variant are almost the same, given that the input set is sufficiently large. Our experiments confirm that this still holds for a large number of successive update steps. In particular, for Gaussian mixture models, we show that the stochastic variant runs nearly twice as fast.

The diameter k-clustering problem is the problem of partitioning a finite subset of R^d into k subsets called clusters such that the maximum diameter of the clusters is minimized. One early clustering algorithm that computes a hierarchy of approximate solutions to this problem for all values of k is the agglomerative clustering algorithm with the complete linkage strategy. For decades this algorithm has been widely used by practitioners. However, it is not well studied theoretically. In this paper we analyze the agglomerative complete linkage clustering algorithm. Assuming that the dimension dis a constant, we show that for any k the solution computed by this algorithm is an O(log k)-approximation to the diameter k-clustering problem. Moreover, our analysis does not only hold for the Euclidean distance but for any metric that is based on a norm.

We study a generalization of the k -median problem with respect to an arbitrary dissimilarity measure D. Given a finite set P of size n , our goal is to find a set C of size k such that the sum of errors D( P,C ) = ∑ p ∈ P min c ∈ C {D( p,c )} is minimized. The main result in this article can be stated as follows: There exists a (1+ϵ)-approximation algorithm for the k -median problem with respect to D, if the 1-median problem can be approximated within a factor of (1+ϵ) by taking a random sample of constant size and solving the 1-median problem on the sample exactly. This algorithm requires time n 2 O ( mk log( mk /ϵ)), where m is a constant that depends only on ϵ and D. Using this characterization, we obtain the first linear time (1+ϵ)-approximation algorithms for the k -median problem in an arbitrary metric space with bounded doubling dimension, for the Kullback-Leibler divergence (relative entropy), for the Itakura-Saito divergence, for Mahalanobis distances, and for some special cases of Bregman divergences. Moreover, we obtain previously known results for the Euclidean k -median problem and the Euclidean k -means problem in a simplified manner. Our results are based on a new analysis of an algorithm of Kumar et al. [2004].

We study the generalized k-median problem with respect to a Bregman divergence Dø. Given a finite set P ⊆ ℝd of size n, our goal is to find a set C of size k such that the sum of errors cost(P, C) = Σp∊P minc∊C {Dø(p, c)} is minimized. The Bregman k-median problem plays an important role in many applications, e.g. information theory, statistics, text classification, and speech processing. We give the first coreset construction for this problem for a large subclass of Bregman divergences, including important dissimilarity measures such as the Kullback-Leibler divergence and the Itakura-Saito divergence. Using these coresets, we give a (1 + ∊)-approximation algorithm for the Bregman k-median problem with running time . This result improves over the previousely fastest known (1 + ∊)-approximation algorithm from [1]. Unlike the analysis of most coreset constructions our analysis does not rely on the construction of ∊-nets. Instead, we prove our results by purely combinatorial means.

In this paper we describe a new algorithm to prevent fault attacks on RSA signature algorithms using the Chinese Remainder Theorem (CRT-RSA). This variant of the RSA signature algorithm is widely used on smartcards. Smartcards on the other hand are particularly susceptible to fault attacks like the one described in [7]. Recent results have shown that fault attacks are practical and easy to accomplish ([21], [17]).Therefore, they establish a practical need for fault attack protected CRT-RSA schemes. Starting from a careful derivation and classification of fault models, we describe a new variant of the CRT-RSA algorithm. For the most realistic fault model described, we rigorously analyze the success probability of an adversary against our new CRT-RSA algorithm. Thereby, we prove that our new algorithm is secure against the Bellcore attack.

Motivated by Ajtai's worst-case to average-case reduction for lattice problems, we study the complexity of computing short linearly independent vectors (short basis) in a lattice.We show that approximating the length of a shortest set of linearly independent vectors (shortest basis) within any constant factor is NP-hard.Under the assumption that problems in NP cannot be solved in DTIME(n p"'y'og(n)) we show that no polynomial time algorithm can approximate the length of a shortest set of linearly independent vectors (shortest basis) within a factor of 2'"g'-'("), E > 0 arbitrary, but fixed.Finally, we obtain results on the limits of non-approximability for computing short linearly independent vectors (short basis).Our strongest result in this direction states that under reasonable complexity-theoretic assumptions, approximating the length of a shortest set of linearly independent vectors (shortest basis) within a factor of n/a is not NP-hard.

We introduce a new method, called priority encoding transmission, for sending messages over lossy packet-based networks. When a message is to be transmitted, the user specifies a priority value for each part of the message. Based on the priorities, the system encodes the message into packets for transmission and sends them to (possibly multiple) receivers. The priority value of each part of the message determines the fraction of encoding packets sufficient to recover that part. Thus even if some of the encoding packets are lost en-route, each receiver is still able to recover the parts of the message for which a sufficient fraction of the encoding packets are received. For any set of priorities for a message, we define a natural quantity called the girth of the priorities. We develop systems for implementing any given set of priorities such that the total length of the encoding packets is equal to the girth. On the other hand, we give an information-theoretic lower bound that shows that for any set of priorities the total length of the encoding packets must be at least the girth. Thus the system we introduce is optimal in terms of the total encoding length. This work has immediate applications to multimedia and high-speed networks applications, especially in those with bursty sources and multiple receivers with heterogeneous capabilities. Implementations of the system show promise of being practical.

We introduce a novel approach for sending messages over lossy packet-based networks. The new method, called Priority Encoding Transmission, allows a user to specify a different priority on each segment of the message. Based on the priorities, the sender uses the system to encode the segments into packets for transmission. The system ensures recovery of the segments in order of their priority. The priority of a segment determines the minimum number of packets sufficient to recover the segment. We define a measure for a set of priorities, called the rate, which dictates how much information about the message must be contained in each bit of the encoding. We develop systems for implementing any set of priorities with rate equal to one. We also give an information-theoretic proof that there is no system that implements a set of priorities with rate greater than one. This work has applications to multi-media and high speed networks applications, especially in those with bursty sources and multiple receivers with heterogeneous capabilities.>

The author presents a simple condition when nested radical expressions of depth two can be denested using real radicals or radicals of some bounded degree. He describes the structure of these denestings and determines an upper bound on the maximum size of a denesting. Also for depth two radicals he describes an algorithm that will find such a denesting whenever one exists. Unlike all previous denesting algorithms the algorithm does not use Galois theory. In particular, he avoids the construction of the minimal polynomial and splitting field of a nested radical expression. Thus he can obtain the first denesting algorithm whose run time is at most, and in general much less, than polynomial in description size of the minimal polynomial. The algorithm can be used to determine non-trivial denestings for expressions of depth larger than two.>

For two given simple polygons P, Q the problem is to determine a rigid motion I of Q giving the best possible match between P and Q, i.e. minimizing the Hausdorff-distance between P and I(Q). Faster algorithms as the one for the general problem are obtained for special cases, namely that I is restricted to translations or even to translations only in one specified direction. It turns out that determining pseudo-optimal solutions, i.e. ones that differ from the optimum by just a constant factor can be done much more ejjiciently than determining op-timal solutions. In the most general case the algorithm for the pseudo-optimal solution is based on the quite sur-prising fact that for the optimal possible match between P and an image I(Q) of Q the distance between the cen-troids of the edges of the convex hulls of P and I(Q] is a constant multiple of the Hausdorff-distance between P and I(Q). It is also shown that the Hausdorff-distance between two simple polygons can be determined in time O(n log n], where n is the total number of vertices.

For a certain sum of radicals the author presents a Monte Carlo algorithm that runs in polynomial time to decide whether the sum is contained in some number field Q( alpha ), and, if so, its coefficient representation in Q( alpha ) is computed. As a special case the algorithm decides whether the sum is zero. The main algorithm is based on a subalgorithm which is of interest in its own right. This algorithm uses probabilistic methods to check for an element beta of an arbitrary (not necessarily) real algebraic number field Q( alpha ) and some positive rational integer r whether there exists an rth root of beta in Q( alpha ).>