Summary AEZ is a block cipher mode based on AES which uses three 128‐bit keys. The algorithm has been updated several times during the three rounds of the CAESAR cryptographic competition. Cryptanalytic results presented on AEZ to date do not breach its security. This paper describes a fault injection analysis on AEZ. We focus on analysing AEZ v4.2 but also investigate the applicability of these analyses to the recent version AEZ v5. This paper shows that all three 128‐bit keys in AEZ v4.2 can be uniquely retrieved using only three random‐valued single byte fault injections. A similar approach using four fault injections can uniquely recover all three keys of AEZ v5. The feasibility of this fault injection methodology has been proven against AES in previous works.

In this paper, we show that stream ciphers with a particular form of ciphertext output function are vulnerable to differential fault attacks using random faults. The CAESAR competition candidates Tiaoxin-346 and AEGIS-128L both fall into this category, and we show that our attack can be used to recover the secret key of Tiaoxin-346 and the entire state of AEGIS-128L with practical complexity. In the case of AEGIS-128L, the attack can be applied in a ciphertext-only scenario. Our attacks are more practical than previous fault attacks on these ciphers, which assumed bit-flipping faults. Although we also consider other ways of mitigating our attacks, we recommend that cipher designers avoid the form of ciphertext output function that we have identified.

A building information model (BIM) is an electronic repository of structured, three-dimensional data that captures both the physical and dynamic functional characteristics of a facility. In addition to its more traditional function as a tool to aid design and construction, a BIM can be used throughout the life cycle of a facility, functioning as a living database that places resources contained within the building in their spatial and temporal context. Through its comprehension of spatial relationships, a BIM can meaningfully represent and integrate previously isolated control and management systems and processes, and thereby provide a more intuitive interface to users. By placing processes in a spatial context, decision-making can be improved, with positive flow-on effects for security and efficiency. In this article, we systematically analyse the authorization requirements involved in the use of BIMs. We introduce the concept of using a BIM as a graphical tool to support spatial access control configuration and management (including physical access control). We also consider authorization requirements for regulating access to the structured data that exists within a BIM as well as to external systems and data repositories that can be accessed via the BIM interface. With a view to addressing these requirements we present a survey of relevant spatiotemporal access control models, focusing on features applicable to BIMs and highlighting capability gaps. Finally, we present a conceptual authorization framework that utilizes BIMs.

In dynamic and uncertain environments, where the needs of security and information availability are difficult to balance, an access control approach based on a static policy will be suboptimal regardless of how comprehensive it is. Risk-based approaches to access control attempt to address this problem by allocating a limited budget to users, through which they pay for the exceptions deemed necessary. So far the primary focus has been on how to incorporate the notion of budget into access control rather than what or if there is an optimal amount of budget to allocate to users. In this paper we discuss the problems that arise from a sub-optimal allocation of budget and introduce a generalised characterisation of an optimal budget allocation function that maximises organisations expected benefit in the presence of self-interested employees and costly audit.

In dynamic and uncertain environments such as healthcare, where the needs of security and information availability are difficult to balance, an access control approach based on a static policy will be suboptimal regardless of how comprehensive it is. The uncertainty stems from the unpredictability of users' operational needs as well as their private incentives to misuse permissions. In Role Based Access Control (RBAC), a user's legitimate access request may be denied because its need has not been anticipated by the security administrator. Alternatively, even when the policy is correctly specified an authorised user may accidentally or intentionally misuse the granted permission. This paper introduces a novel approach to access control under uncertainty and presents it in the context of RBAC. By taking insights from the field of economics, in particular the insurance literature, we propose a formal model where the value of resources are explicitly defined and an RBAC policy (entailing those predictable access needs) is only used as a reference point to determine the price each user has to pay for access, as opposed to representing hard and fast rules that are always rigidly applied.

Various time-memory tradeoffs attacks for stream ciphers have been proposed over the years. However, the claimed success of these attacks assumes the initialisation process of the stream cipher is one-to-one. Some stream cipher proposals do not have a one-to-one initialisation process. In this paper, we examine the impact of this on the success of time-memory-data tradeoff attacks. Under the circumstances, some attacks are more successful than previously claimed while others are less. The conditions for both cases are established.

Both the SSS and SOBER-t32 stream cipher designs use a single word-based shift register and a nonlinear filter function to produce keystream. In this paper we show that the algebraic attack method previously applied to SOBER-t32 is prevented from succeeding on SSS by the use of the keydependent substitution box (SBox) in the nonlinear filter of SSS. Additional assumptions and modifications to the SSS cipher in an attempt to enable algebraic analysis result in other difficulties that also render the algebraic attack infeasible. Based on these results, we conclude that a well-chosen key-dependent substitution box used in the nonlinear filter of the stream cipher provides resistance against such algebraic attacks.

The batch verification technique of Bellare et al. is extended to verification of several frequently employed zero-knowledge proofs. The new techniques are correct, sound, efficient, and can be widely applied. Specific applications are discussed in detail, including batch ZK proof and verification of validity of encryption (or reencryption) and batch ZK proof and verification of validity of decryption. Considerable efficiency improvements are gained in these two applications without compromising security. As a result, efficiency of the practical cryptographic systems (such as mix networks) based on these two applications is dramatically improved.

In electronic auction applications, small-value merchandise is often distributed. We call this kind of auction micro auction. Compared to traditional general-purpose electronic auction, micro electronic auction has its own special requirements. Especially, micro auction must be very efficient: the cost of the auction protocol must not be over the cost of the merchandise for sale. Although the merchandise to distribute are of small value in micro auctions, bid privacy is still needed in many circumstances. So sealed-bid auction mechanism has to be employed in micro auction. Therefore, a question is raised: how to balance between the high efficiency requirement of micro auction and the high cost needed to keep bid privacy. In this paper, the traditional sealed-bid e-auction techniques are modified to satisfy the special requirements of sealed-bid micro auction. Two existing general-purpose electronic sealed-bid auction schemes are modified into micro sealed-bid auction schemes. The new schemes are secure and suitable for micro auction. One of them is further improved in efficiency to meet more critical requirements in certain micro auction applications.

In symmetric cryptology the resistance to attacks depends critically on the nonlinearity properties of the Boolean functions describing cipher components like Substitution boxes (S‐boxes). Some of the most effective methods known to generate functions that satisfy multiple criteria are based on evolutionary heuristics. In this paper, we improve on these algorithms by employing an adaptive strategy. Additionally, using recent improvements in the understanding of these combinatorial structures, we discover essential properties of the graph formed by affine equivalence classes of Boolean functions, which offers several advantages as a conceptual model for multiobjective seeking evolutionary heuristics. Finally, we propose the first major global cooperative effort to discover new bounds for cryptographic properties of Boolean functions.

We present a new heuristic algorithm that efficiently generates Boolean Bent functions, which have desirable cryptographic properties including maximum nonlinearity. By using an evolutionary approach to design, we discover an easy way to find the algebraic normal forms of new bent functions. These algorithms run efficiently, making them suitable for engineering the components of modern symmetric encryption algorithms. In addition, we enable the algorithm to determine when new classes of bent functions have been discovered, by developing more a more effective approach to the equivalence class distinguishing problem. These results allow the efficient automated generation of many optimal Boolean functions that can be guaranteed to be affine non-equivalent, thus offering far more accurate classification of bent functions than previously available.

In symmetric cryptology (which is an essential part of modern computer security), the resistance to attacks depends critically on the nonlinearity properties of the Boolean functions describing cipher components like S-boxes. Some of the most effective methods known to generate functions that satisfy multiple criteria are based on evolutionary heuristics. In this paper, we improve on these algorithms by employing an adaptive strategy. Additionally, using recent improvements in the understanding of these combinatorial structures, we discover essential properties of the graph formed by affine equivalence classes of Boolean functions, which offers several advantages as a conceptual model for multiobjective seeking evolutionary heuristics. Finally, we propose the first major global cooperative effort to discover new bounds for cryptographic properties of Boolean functions.

A nonlinear filter generator is a basic keystream generator for stream cipher applications consisting of a single linear feedback shift register whose output is filtered by a nonlinear combining function. A binary nonlinear filter generator is viewed as a finite input memory automaton with one binary input and one binary output. The generalized inversion attack on a binary nonlinear filter generator is developed and analyzed by the theory of critical branching processes. Its objective is to recover the unknown input sequence from a given segment of the output sequence, provided that the filter function is known. Unlike the inversion attack, which requires that the filter function be linear in the first or the last input variable, this attack can be applied for any filter function. Both theory and systematic experiments show that its time complexity remains dose to 2/sup M/, which is the time complexity of the inversion attack, where M denotes the input memory size in bits.

Four discrete orthogonal transforms have been evaluated for their suitability for use in transform-based analog speech encryption. Subjective as well as objective tests were conducted to compare the residual intelligibility and the recovered speech quality under channel conditions. The cryptanalytic strengths of the schemes were then compared by applying a novel cryptanalytic attack which exploits the redundancy of speech using a spectral vector codebook. The results indicate that the discrete cosine transform (DCT) is the best transform to use in transform-based encryption. A modification of the DCT-based scheme which significantly improves the security of the scrambler is proposed.>

The performances of five discrete orthogonal transforms in speech encryption systems are compared. The transforms considered are the discrete Fourier transform, discrete cosine transform, Walsh-Hadamard transform, Karhunen-Loeve transform, and discrete prolate spheroidal transform. Four objective measures are used to grade the encryption systems with respect to residual intelligibility and recovered voice quality. A figure of merit based on all the four objective measures is formed. It gives good correlation to the subjective results of residual intelligibility and recovered speech quality.>