Direct Anonymous Attestation (DAA) is a scheme that enables the remote authentication of a Trusted Platform Module (TPM) while preserving the user's privacy. A TPM can prove to a remote party that it is a valid TPM without revealing its identity and without linkability. In the DAA scheme, a TPM can be revoked only if the DAA private key in the hardware has been extracted and published widely so that verifiers obtain the corrupted private key. If the unlinkability requirement is relaxed, a TPM suspected of being compromised can be revoked even if the private key is not known. However, with the full unlinkability requirement intact, if a TPM has been compromised but its private key has not been distributed to verifiers, the TPM cannot be revoked. Furthermore, a TPM cannot be revoked from the issuer, if the TPM is found to be compromised after the DAA issuing has occurred. In this paper, we present a new DAA scheme called Enhanced Privacy ID (EPID) scheme that addresses the above limitations. While still providing unlinkability, our scheme provides a method to revoke a TPM even if the TPM private key is unknown. This expanded revocation property makes the scheme useful for other applications such as for driver's license. Our EPID scheme is efficient and provably secure in the same security model as DAA, i.e., in the random oracle model under the strong RSA assumption and the decisional Diffie-Hellman assumption.

This paper describes the direct anonymous attestation scheme (DAA). This scheme was adopted by the Trusted Computing Group (TCG) as the method for remote authentication of a hardware module, called Trusted Platform Module (TPM), while preserving the privacy of the user of the platform that contains the module. DAA can be seen as a group signature without the feature that a signature can be opened, i.e., the anonymity is not revocable. Moreover, DAA allows for pseudonyms, i.e., for each signature a user (in agreement with the recipient of the signature) can decide whether or not the signature should be linkable to another signature. DAA furthermore allows for detection of "known" keys: if the DAA secret keys are extracted from a TPM and published, a verifier can detect that a signature was produced using these secret keys. The scheme is provably secure in the random oracle model under the strong RSA and the decisional Diffie-Hellman assumption.

Informally, a $( t,w )$-threshold scheme is a way of distributing partial information (shadows) to w participants, so that any t of them can easily calculate a key (or secret), but no subset of fewer than t participants can determine the key. Presented in this paper is an unconditionally secure threshold scheme in which any cheating participant can be detected and identified with high probability by any honest participant, even if the cheater is in coalition with other participants. Also given is a construction that will detect with high probability a dealer who distributes inconsistent shadows (shares) to the honest participants. The scheme is not perfect; a set of $t - 1$ participants can rule out at most $1 + \begin{pmatrix} {w - t + 1} \\ {t - 1} \end{pmatrix}$ possible keys, given the information they have. In this scheme, the key will be an element of GF$( q )$ for some prime power q. Hence q can be chosen large enough so that the amount of information obtained by any $t - 1$ participants is negligible.

The problem of finding a minimum-weight k-connected spanning subgraph of a complete graph, assuming that the edge weights satisfy the triangle inequality, is studied. It is shown that the class of minimum-weight k-edge connected spanning subgraphs can be restricted to those subgraphs which, in addition to the connectivity requirements, satisfy the following two conditions: (I) Every vertex has degree k or $k + 1$; (II) Removing any $1, 2, \cdots ,$ or k edges does not leave the resulting connected components all k-edge connected. For the k-vertex connected case, the parallel result is obtained with “k-edge” replaced by “k-vertex,” with the added technical restriction that $| V |\geqq 2k$ for condition (I) to hold. This generalizes recent work of Monma, Munson, and Pulleyblank for the case $k = 2$.

Cryptosystems are tested by subjecting them to cryptanalytic attacks by experts. Most of the cryptosystems that have been publicly proposed in the last decade have been broken. Some of the attacks that have been used are outlined, and some of the basic tools available to the cryptanalyst are explained. Attacks on the knapsack cryptosystems, congruential generators, and a variety of two key secrecy and signature schemes are discussed. There is also a brief discussion of the status of the security of cryptosystems for which there is no known feasible attack, such as the RSA, discrete exponentiation, and DES cryptosystems.>