This paper describes a differential attack on several hash functions based on a block cipher. The emphasis will be on the results for cases where DES [8] is the underlying block cipher. It will briefly discuss the case of FEAL-N [19, 21].

This article discusses a distributed implementation of the Bell-LaPadula security policy model. Implementation of a confidentiality service in the OSIRM is not sufficient for enforcing the Bell-LaPadula model. Also integrity services are necessary. In this article both public key systems (PKSs) as well as symmetric cryptographic systems are considered for the realisation of these security services. By concentrating on the key distribution, no cryptographic algorithms or protocols are excluded on beforehand. It is investigated how key-distributions can be found resulting in a minimum number of keys. Application of PKSs results in a key distribution which requires less keys than key-distributions going with the use of a symmetric system. Moreover, practical or viable key-distributions going with symmetric algorithms turn out to be more sensitive to the disclosure of a secret key than key-distributions going with PKSs. A combination of a PKS and a symmetric system is indicated which does not suffer from the disadvantages going with the use of symmetric systems alone.>

The authors claim that the security of the Merkle-Hellman algorithm is greatly exaggerated. First, any enciphering key that is obtained from a superincreasing sequence has infinitely many superincreasing deciphering keys that can decipher all messages. This follows from the fact that the conditions on the transformation^{\ast} w \bmod mrequirew/mto lie in a restricted set of intervals. Second, it is claimed that iterative transformations^{\ast} w \bmod mmay not increase the security. In the example that Merkle and Hellman used for "proving" the benefits of the iterative transformation, the security is completely ruined. Third, techniques are presented to crack one bit of the plaintext. These techniques apply to sets of enciphering keys introduced in this text, which contain all the Merkle-Hellman enciphering keys. Such bit-by-bit techniques also allow the construction of new enciphering keys. Fourth, some knapsacks that allow a one-to-one deciphering cannot be obtained from easy deciphering keys, e.g., superincreasing keys, even with infinitely many transformations^{\ast} w \bmod m!If the worst cases of nondeterministic polynomial complete knapsack problems are always of this kind, the foundation of the security of the Merkle-Hellman algorithm is nonexistent. The cryptanalysis can be reduced to a problem of simultaneous diophantine approximations. A link is made with other recent results.