games and full abstraction for fpc a new category of games is developed which improves over existing such categories in that it interprets sums as well as products function spaces and recursive types a model of fpc a sequential functional language with just this type structure is described and shown to be fully abstract

a characterization of lambda definability in categorical models of implicit polymorphism lambda definability is characterized in categorical models of simply typed lambda calculus with type variables a category theoretic framework known as glueing or sconing is used to extend the jung tiuryn 1993 characterization of lambda definability first to ccc models and then to categorical models of the calculus with type variables

full abstraction for pcf an intensional model for the programming language pcf is described in which the types of pcf are interpreted by games and the terms by certain history free strategies this model is shown to capture definability in pcf more precisely every compact strategy in the model is definable in a certain simple extension of pcf we then introduce an intrinsic preorder on strategies and show that it satisfies some striking properties such that the intrinsic preorder on function types coincides with the pointwise preorder we then obtain an order extensional fully abstract model of pcf by quotienting the intensional model by the intrinsic preorder this is the first syntax independent description of the fully abstract model for pcf hyland and ong have obtained very similar results by a somewhat different route independently and at the same time we then consider the effective version of our model and prove a universality theorem every element of the effective extensional model is definable in pcf equivalently every recursive strategy is definable up to observational equivalence

polynomial factorization and nonrandomness of bits of algebraic and some transcendental numbers it is shown that the binary expansions of algebraic numbers do not form secure pseudorandom sequences given sufficiently many initial bits of an algebraic number its minimal polynomial can be reconstructed and therefore the further bits of the algebraic number can be computed this also enables the authors to devise a simple algorithm to factorise polynomials with rational coefficients all algorithms work in polynomial time

set theoretical and other elementary models of the l calculus abstract part i pp 351 373 of this paper is the previously unpublished 1972 memorandum plotkin 1972 with editorial changes and some minor corrections part ii pp 373 409 presents what happened next together with some further development of the material the first part begins with an elementary set theoretical model of the calculus functions are modelled in a similar way to that normally employed in set theory by their graphs difficulties are caused in this enterprise by the axiom of foundation next based on that model a model of the calculus is constructed by means of a natural deduction method finally a theorem is proved giving some general properties of those nontrivial models of the calculus which are continuous complete lattices the second part begins with a brief discussion of models of the calculus in set theories with anti foundation axioms next the model of the calculus of part i and also the closely related but different models of scott 1976 1980 and of engeler 1981 1988 are reviewed then general frameworks in which elementary constructions of models can be given are discussed following longo 1982 one can employ certain scott engeler algebras following coppo et al 1983 one can obtain filter models from their extended applicative type structures an extended discussion is given of various ways of constructing models of the calculus and the connections between them finally an extension of the theorem to complete partial orders is given the theme of the paper is the consideration of means of constructing models there is hardly any analysis of their properties there is no discussion of their application

the random oracle methodology revisited we take a critical look at the relationship between the security of cryptographic schemes in the random oracle model and the security of the schemes that result from implementing the random oracle by so called cryptographic hash functions the main result of this article is a negative one there exist signature and encryption schemes that are secure in the random oracle model but for which any implementation of the random oracle results in insecure schemes in the process of devising the above schemes we consider possible definitions for the notion of a good implementation of a random oracle pointing out limitations and challenges

finitary pcf is not decidable the question of the decidability of the observational ordering of finitary pcf was raised jung and stoughton in m bezem j f groote eds typed lambda calculi and applications lecture notes in computer science vol 664 springer berlin 1993 pp 230 244 to give mathematical content to the full abstraction problem for pcf milner theoret comput sci 4 1977 1 22 we show that the ordering is in fact undecidable this result places limits on how explicit a representation of the fully abstract model can be it also gives a slight strengthening of the author s earlier result on typed ability loader in a anderson m zeleny eds church memorial volume kluwer academic press dordrecht to appear copyright 2001 elsevier science b v

on the power of membership queries in agnostic learning we study the properties of the agnostic learning framework of haussler 1992 and kearns schapire and sellie 1994 in particular we address the question is there any situation in which membership queries are useful in agnostic learning our results show that the answer is negative for distribution independent agnostic learning and positive for agnostic learning with respect to a specific marginal distribution namely we give a simple proof that any concept class learnable agnostically by a distribution independent algorithm with access to membership queries is also learnable agnostically without membership queries this resolves an open problem posed by kearns et al 1994 for agnostic learning with respect to the uniform distribution over 0 1 n we show a concept class that is learnable with membership queries but computationally hard to learn from random examples alone assuming that one way functions exist

hardness results for neural network approximation problems we consider the problem of efficiently learning in two layer neural networks we investigate the computational complexity of agnostically learning with simple families of neural networks as the hypothesis classes we show that it is np hard to find a linear threshold network of a fixed size that approximately minimizes the proportion of misclassified examples in a training set even if there is a network that correctly classifies all of the training examples in particular for a training set that is correctly classified by some two layer linear threshold network with k hidden units it is np hard to find such a network that makes mistakes on a proportion smaller than c k2 of the examples for some constant c we prove a similar result for the problem of approximately minimizing the quadratic loss of a two layer network with a sigmoid output unit

a new data hiding scheme for binary image authentication with small image distortion a new data hiding scheme for binary image authentication that has a small distortion of the cover image is proposed in this paper using the data embedding algorithm that is based on hamming codes the proposed scheme embeds authentication information into the cover image with flipping only a small number of pixels a special type of the pixels are selected and flipped by a new algorithm to minimize visual distortion this new algorithm is based on elssm edge line segment similarity measure randomly shuffling the bit order of the authentication information to be embedded the information can only be extracted by the designated receiver who has the symmetric key we employ two measurement metrics miss detection rates for the degree of security and psnr peak signal to noise ratio and elssm for the degree of the image distortion to demonstrate the feasibility of the proposed scheme using these metrics we analyze the proposed scheme and the previous schemes the analysis reveals that the proposed scheme requires less image distortion than the previous schemes whilst achieving the same level of the miss detection rate experimental results demonstrate that the proposed scheme is more resilient against recent steganalysis attacks than the previous schemes

transitive signatures new schemes and proofs we present novel realizations of the transitive signature primitive introduced by micali and rivest enlarging the set of assumptions on which this primitive can be based and also providing performance improvements over existing schemes more specifically we propose new schemes based on factoring the hardness of the one more discrete logarithm problem and gap diffie hellman dh groups all these schemes are proven transitively unforgeable under adaptive chosen message attack in the standard not random oracle model we also provide an answer to an open question raised by micali and rivest regarding the security of their rivest shamir adleman rsa based scheme showing that it is transitively unforgeable under adaptive chosen message attack assuming the security of rsa under one more inversion we then present hash based modifications of the rsa factoring and gap diffie hellman based schemes that eliminate the need for node certificates and thereby yield shorter signatures these modifications remain provably secure under the same assumptions as the starting scheme in the random oracle model

how to construct random functions a constructive theory of randomness for functions based on computational complexity is developed and a pseudorandom function generator is presented this generator is a deterministic polynomial time algorithm that transforms pairs g r where g is any one way function and r is a random k bit string to polynomial time computable functions r 1 2 k 1 2 k these r s cannot be distinguished from random functions by any probabilistic polynomial time algorithm that asks and receives the value of a function at arguments of its choice the result has applications in cryptography random constructions and complexity theory

relative definability of boolean functions via hypergraphs the aim of this work is to show how hypergraphs can be used as a systematic tool in the classification of continuous boolean functions according to their degree of parallelism intuitively f is less parallel than g if it can be defined by a sequential program using g as its only free variable it turns out that the poset induced by this preorder is as for the degrees of recursion a sup semilattice although hypergraphs have already been used in bucciarelli theoret comput sci to appear as a tool for studying degrees of parallelism no general result relating the former to the latter has been proved in that work we show that the sup semilattice of degrees has a categorical counterpart we define a category of hypergraphs such that every object represents a monotone boolean function finite coproducts in this category correspond to lubs of degrees unlike degrees of recursion where every set has a recursive upper bound monotone boolean functions may have no sequential upper bound however the ones which do have a sequential upper bound can be nicely characterised in terms of hypergraphs these subsequential functions play a major role in the proof of our main result namely that f is less parallel than g if there exists a morphism between their associated hypergraphs

understanding the related key security of feistel ciphers from a provable perspective we initiate the provable related key security treatment for models of practical feistel ciphers in detail we consider feistel networks with four whitening keys w i k i 0 1 2 3 and round functions of the form f gamma j k oplus x where k is the master key w i and gamma j are efficient transformations and f is a public ideal function or permutation accessible by the adversary we investigate the key schedule conditions that are sufficient for security against xor induced related key attacks up to 2 n 2 adversarial queries when the key schedules are non linear we prove security for four rounds when only affine key schedules are used we prove security for six rounds these also imply secure tweakable feistel ciphers in the random oracle model by shuffling the key schedules our model unifies both the des like structure known as feistel 2 scheme in the cryptanalytic community also known as key alternating feistel due to lampe and seurin and the lucifer like model previously analyzed by guo and lin this allows us to derive concrete implications on these two more common models and helps understanding their related key security difference

the learnability of quantum states traditional quantum state tomography requires a number of measurements that grows exponentially with the number of qubits n but using ideas from computational learning theory we show that one can do exponentially better in a statistical setting in particular to predict the outcomes of most measurements drawn from an arbitrary probability distribution one needs only a number of sample measurements that grows linearly with n this theorem has the conceptual implication that quantum states despite being exponentially long vectors are nevertheless reasonable in a learning theory sense the theorem also has two applications to quantum computing first a new simulation of quantum one way communication protocols and second the use of trusted classical advice to verify untrusted quantum advice

complete restrictions of the intersection type discipline abstract in this paper the intersection type discipline as defined in barendregt 1983 is studied we will present two different and independent complete restrictions of the intersection type discipline the first restricted system the strict type assignment system is presented in section 2 its major feature is the absence of the derivation rule and it is based on a set of strict types we will show that these together give rise to a strict filter lambda model that is essentially different from the one presented in barendregt we will show that the strict type assignment system is the nucleus of the full system i e for every derivation in the intersection type discipline there is a derivation in which is used only at the very end finally we will prove that strict type assignment is complete for inference semantics the second restricted system is presented in section 3 its major feature is the absence of the type we will show that this system gives rise to a filter i model and that type assignment without is complete for the i calculus finally we will prove that a lambda term is typeable in this system if and only if it is strongly normalizable

performance improvement for the ggm construction of pseudorandom functions a pseudorandom function is a function that cannot be efficiently distinguished from a truly random function the first construction of pseudorandom functions was introduced by goldreich goldwasser and micali ggm construction in this paper we propose a variant of the ggm construction and compare its performance with the original construction we show that a 4 ary tree variant construction can achieve the best performance under the assumption that the underlying pseudorandom generators generate pseudorandom bits sequentially

pseudorandom functions and factoring the computational hardness of factoring integers is the most established assumption on which cryptographic primitives are based this work presents an efficient construction of pseudorandom functions whose security is based on the intractability of factoring in particular we are able to construct efficient length preserving pseudorandom functions where each evaluation requires only a small constant number of modular multiplications per output bit this is substantially more efficient than any previous construction of pseudorandom functions based on factoring and matches up to a constant factor the efficiency of the best known factoring based pseudorandom bit generators

a simple unpredictable pseudo random number generator two closely related pseudo random sequence generators are presented the 1 p generator with input p a prime outputs the quotient digits obtained on dividing 1 by p the x 2 bmod n generato

coin flipping of any constant bias implies one way functions we show that the existence of a coin flipping protocol safe against any nontrivial constant bias e g 499 implies the existence of one way functions this improves upon a result of haitner and omri focs 11 who proved this implication for protocols with bias s 2 1 2 o 1 t 207 unlike the result of haitner and omri our result also holds for weak coin flipping protocols

the category theoretic solution of recursive metric space equations it is well known that one can use an adaptation of the inverse limit construction to solve recursive equations in the category of complete ultrametric spaces we show that this construction generalizes to a large class of categories with metric space structure on each set of morphisms the exact nature of the objects is less important in particular the construction immediately applies to categories where the objects are ultrametric spaces with extra structure and where the morphisms preserve this extra structure the generalization is inspired by classical domain theoretic work by smyth and plotkin for many of the categories we consider there is a natural subcategory in which each set of morphisms is required to be a compact metric space our setting allows for a proof that such a subcategory always inherits solutions of recursive equations from the full category as another application we present a construction that relates solutions of generalized domain equations in the sense of smyth and plotkin to solutions of equations in our class of categories our primary motivation for solving generalized recursive metric space equations comes from recent and ongoing work on kripke style models in which the sets of worlds must be recursively defined we show a series of examples motivated by this line of work

a stable programming language it is well known that stable models as di domains qualitative domains and coherence spaces are not fully abstract for the language pcf this fact is related to the existence of stable parallel functions and of stable functions that are not monotone with respect to the extensional order which cannot be defined by programs of pcf in this paper a paradigmatic programming language named st pcf is proposed which extends the language pcf with two additional operators the operational description of the extended language is presented in an effective way although the evaluation of one of the new operators cannot be formalized in a pcf like rewrite system since st pcf can define all finite cliques of coherence spaces the above gap with stable models is filled consequently stable models are fully abstract for the extended language

prelogical relations we study a weakening of the notion of logical relations called prelogical relations that has many of the features that make logical relations so useful as well as further algebraic properties including composability the basic idea is simply to require the reverse implication in the definition of logical relations to hold only for pairs of functions that are expressible by the same lambda term prelogical relations are the minimal weakening of logical relations that gives composability for extensional structures and simultaneously the most liberal definition that gives the basic lemma prelogical predicates i e unary prelogical relations coincide with sets that are invariant under kripke logical relations with varying arity as introduced by jung and tiuryn and prelogical relations are the closure under projection and intersection of logical relations these conceptually independent characterizations of prelogical relations suggest that the concept is rather intrinsic and robust the use of prelogical relations gives an improved version of mitchell s representation independence theorem which characterizes observational equivalence for all signatures rather than just for first order signatures prelogical relations can be used in place of logical relations to give an account of data refinement where the fact that prelogical relations compose explains why stepwise refinement is sound

i categories as a framework for solving domain equations abstract an abstract notion of category of information systems or i category is introduced as a generalisation of scott s well known category of information systems as in the theory of partial orders i categories can be complete or algebraic and it is shown that algebraic i categories can be obtained from a certain completion of countable i categories the proposed axioms for a complete i category introduce a global partial order on the morphisms of the category making them a cpo an initial algebra theorem for a class of functors continuous on the cpo of morphisms is proved thus giving canonical solution of domain equations an effective version of these results for algebraic i categories is also provided some basic examples of i categories representing the categories of sets boolean algebras scott domains and continuous scott domains are constructed

a digital signature scheme secure against adaptive chosen message attacks we present a digital signature scheme based on the computational difficulty of integer factorization the scheme possesses the novel property of being robust against an adaptive chosen message attack an adversary who receives signatures for messages of his choice where each message may be chosen in a way that depends on the signatures of previously chosen messages cannot later forge the signature of even a single additional message this may be somewhat surprising since in the folklore the properties of having forgery being equivalent to factoring and being invulnerable to an adaptive chosen message attack were considered to be contradictory more generally we show how to construct a signature scheme with such properties based on the existence of a claw free pair of permutations a potentially weaker assumption than the intractibility of integer factorization the new scheme is potentially practical signing and verifying signatures are reasonably fast and signatures are compact

from algol to polymorphic linear lambda calculus in a linearly typed functional language one can define functions that consume their arguments in the process of computing their results this is reminiscent of state transformations in imperative languages where execition of an assignment statement alters the contents of the store we explore this connection by translating two variations on algol 60 into a purely functional language with polymorphic linear types on the one hand the translations lead to a semantic analysis of algol like programs in terms of a model of the linear language on the other hand they demonstrate that a linearly typed functional language can be at least as expressive as algol

bounds on the efficiency of generic cryptographic constructions a central focus of modern cryptography is the construction of efficient high level cryptographic tools e g encryption schemes from weaker low level cryptographic primitives e g one way functions of interest are both the existence of such constructions and their efficiency here we show essentially tight lower bounds on the best possible efficiency of any black box construction of some fundamental cryptographic tools from the most basic and widely used cryptographic primitives our results hold in an extension of the model introduced by impagliazzo and rudich and improve and extend earlier results of kim simon and tetali we focus on constructions of pseudorandom generators universal one way hash functions and digital signatures based on one way permutations as well as constructions of public and private key encryption schemes based on trapdoor permutations in each case we show that any black box construction beating our efficiency bound would yield the unconditional existence of a one way function and thus in particular prove p neq np

game semantics for dependent types abstract we present a model of dependent type theory dtt with 1 and intensional id types which is based on a slight variation of the call by name category of ajm games and history free winning well bracketed strategies the model satisfies streicher s criteria of intensionality and refutes function extensionality the principle of uniqueness of identity proofs is satisfied we show it contains a submodel as a full subcategory which gives a faithful interpretation of dtt with 1 and intensional id types and additionally finite inductive type families this smaller model is fully and faithfully complete with respect to the syntax at the type hierarchy built without id types as well as at the more general class of types where we allow for one strictly positive occurrence of an id type definability for the full type hierarchy with id types remains to be investigated

universal prediction this paper consists of an overview on universal prediction from an information theoretic perspective special attention is given to the notion of probability assignment under the self information loss function which is directly related to the theory of universal data compression both the probabilistic setting and the deterministic setting of the universal prediction problem are described with emphasis on the analogy and the differences between results in the two settings

on final coalgebras of continuous functors continuous endofunctors f of locally finitely presentable categories carry a natural metric on their final coalgebra whenever f 0 has an element this metric is proved to be a cauchy completion of the initial algebra of f this is illustrated on the poset of real numbers represented as a final coalgebra of an endofunctor of pos by pavlovic and pratt under additional assumptions on the locally finitely presentable category all finitary endofunctors are proved to have a final coalgebra constructed in steps of the natural iteration construction

infinite hypergraphs i basic properties abstract basic properties of the category of infinite directed hyperedge labelled hypergraphs are studied an algebraic structure is given which enables us to describe such hypergraphs by means of infinite expressions it is then shown that two expressions define the same hypergraphs if and only if they are congruent with respect to some rewriting system these results will be used in the second part of this paper to solve systems of recursive equations on hypergraphs and characterize their solutions

an irregular filter model in this paper we introduce a new filter model which is of a kind that has escaped investigation up to now it is induced by an intersection type theory generated in a non standard way by a preorder which puts into relation an atom with an arrow type without equating them we study the domain theoretic implications of this choice that are not trivial in order to describe this filter model a new category is introduced and a special purpose functor defined the filter model is then characterized as the initial algebra of the functor

a randomness test for block ciphers this paper describes a randomness test which can be used to measure the cryptographic strength of a block cipher or its underlying cryptographic primitive s cryptographic strength in the context of this paper is related to the ability of the round function to produce a random output which in turn is defined as the distance between a theoretical calculation and an experimental measure the measurements are based on the diffusion characteristic of the cipher potentially the test for randomness proposed in this paper could be used as a distinguisher based on diffusion

tail recursion through universal invariants abstract tail recursive constructions suggest a new semantics for datatypes which allows a direct match between specifications and tail recursive programs the semantics focuses on loops their fixpoints invariants and convergence convergent models of the natural numbers and lists are examined in detail and under very mild conditions are shown to be equivalent to the corresponding initial algebra models

learnability and the vapnik chervonenkis dimension valiant s learnability model is extended to learning classes of concepts defined by regions in euclidean space e n the methods in this paper lead to a unified treatment of some of valiant s results along with previous results on distribution free convergence of certain pattern recognition algorithms it is shown that the essential condition for distribution free learnability is finiteness of the vapnik chervonenkis dimension a simple combinatorial parameter of the class of concepts to be learned using this parameter the complexity and closure properties of learnable classes are analyzed and the necessary and sufficient conditions are provided for feasible learnability

on the semantic security of cellular automata based pseudo random permutation using results from the luby rackoff construction this paper proposes a semantically secure construction of pseudo random permutations using second order reversible cellular automata we show that the proposed construction is equivalent to the luby rackoff model if it is built using non uniform transition rules and we prove that the construction is strongly secure if an adequate number of iterations is performed moreover a corresponding symmetric block cipher is constructed and analysed experimentally in comparison with popular ciphers obtained results approve robustness and efficacy of the construction while achieved performances overcome those of some existing block ciphers

concurrent zero knowledge concurrent executions of a zero knowledge protocol by a single prover with one or more verifiers may leak information and may not be zero knowledge in toto in this article we study the problem of maintaining zero knowledge we introduce the notion of an timing constraint for any two processors p1 and p2 if p1 measures elapsed time on its local clock and p2 measures elapsed time on its local clock and p2 starts after p1 does then p2 will finish after p1 does we show that if the adversary is constrained by an assumption then there exist four round almost concurrent zero knowledge interactive proofs and perfect concurrent zero knowledge arguments for every language in np we also address the more specific problem of deniable authentication for which we propose several particularly efficient solutions deniable authentication is of independent interest even in the sequential case our concurrent solutions yield sequential solutions without recourse to timing that is in the standard model

a 2 categorical pasting theorem in order to facilitate the study of 2 categories with structure we state and prove an n categorical pasting theorem this is based upon a new definition of n pasting scheme that generalises johnson s definition of a well formed loop free pasting scheme by weakening his no direct loops condition we define n pasting prove the theorem and show that for n 3 it incorporates all possible composites of n cells we show that that is not true for higher n we define the horizontal n category of an n 1 category to generalise that of a 2 category we define horizontal and vertical composition for an n 1 category and we state and prove an interchange law we also study further conditions on a pasting diagram and their impact upon how one may evaluate a composite and we express street s free n categories in terms of left adjoints

separating models of learning with faulty teachers we study the power of two models of faulty teachers in valiant s pac learning model and angluin s exact learning model the first model we consider is learning from an incomplete membership oracle introduced by angluin and slonim d angluin d k slonim randomly fallible teachers learning monotone dnf with an incomplete membership oracle machine learning 14 1 1994 7 26 in this model the answers to a random subset of the learner s membership queries may be missing the second model we consider is random persistent classification noise in membership queries introduced by goldman kearns and schapire s goldman m kearns r schapire exact identification of read once formulas using fixed points of amplification functions siam journal on computing 22 4 1993 705 726 in this model the answers to a random subset of the learner s membership queries are flipped we show that in both the pac and the exact learning models the incomplete membership oracle is strictly stronger than the noisy membership oracle under the assumption that the problem of pac learning parities with random classification noise is intractable we also show that under the standard cryptographic assumptions the incomplete membership oracle is strictly weaker than the perfect membership oracle this generalizes the result of simon h simon how many missing answers can be tolerated by query learners theory of computing systems 37 1 2004 77 94 and resolves an open question of bshouty and eiron n bshouty n eiron learning monotone dnf from a teacher that almost does not answer membership queries journal of machine learning research 3 2002 49 57

distinguishing properties and applications of higher order derivatives of boolean functions abstract higher order differential cryptanalysis is based on a property of higher order derivatives of boolean functions such that derivative of a boolean function reduces its degree at least 1 and continuously taking derivatives eventually yields a zero function a quicker degree reduction means a lower data complexity in cryptanalysis which can be determined by fast point at which the derivative reduces the degree at least 2 in this paper we show that the set of the fast points of a boolean function constitutes a linear subspace and its dimension plus the degree of the function is at most the size of the function we also show that non zero fast point exists in every n variable boolean function of degree n 1 every symmetric boolean function of degree d where n d mod 2 or every quadratic boolean function of odd number variables which help us distinguish a few block ciphers and propose a new design principle about degree for block cipher

finite memory prediction as well as the empirical mean the problem of universally predicting an individual continuous sequence using a deterministic finite state machine fsm is considered the empirical mean is used as a reference as it is the constant that fits a given sequence within a minimal square error with this reference a reasonable prediction performance is the regret namely the excess square error over the reference loss the empirical variance the paper analyzes the tradeoff between the number of states of the universal fsm and the attainable regret it first studies the case of a small number of states a class of machines denoted degenerated tracking memory dtm is defined and the optimal machine in this class is shown to be the optimal among all machines for small enough number of states unfortunately dtm machines become suboptimal as the number of available states increases next the exponential decaying memory edm machine previously used for predicting binary sequences is considered while this machine has poorer performance for small number of states it achieves a vanishing regret for large number of states following that an asymptotic lower bound of o k 2 3 on the achievable regret of any k state machine is derived this bound is attained asymptotically by the edm machine furthermore a new machine denoted the enhanced exponential decaying memory machine is shown to outperform the edm machine for any number of states

statistically hiding commitments and statistical zero knowledge arguments from any one way function we give a construction of statistically hiding commitment schemes those in which the hiding property holds against even computationally unbounded adversaries under the minimal complexity assumption that one way functions exist consequently one way functions suffice to give statistical zero knowledge arguments for any np statement whereby even a computationally unbounded adversarial verifier learns nothing other than the fact that the assertion being proven is true and no polynomial time adversarial prover can convince the verifier of a false statement these results resolve an open question posed by naor et al j cryptology 11 1998 pp 87 108

a construction of the simplest super pseudorandom permutation generator in this paper we consider one of the two open problems proposed by pieprzyk 1 i e whether a permutation generator which is designed using five rounds of the data encryption standard and a single pseudorandom function is a super pseudorandom permutation generator first we show that f f f2 f is pseudorandom then using the pseudorandomness of f2 f f f and f f f2 f we show f f2 f f f is super pseudorandom

number theoretic constructions of efficient pseudo random functions we describe efficient constructions for various cryptographic primitives in private key as well as public key cryptography our main results are two new constructions of pseudo random functions we prove the pseudo randomness of one construction under the assumption that factoring blum integers is hard while the other construction is pseudo random if the decisional version of the diffie hellman assumption holds computing the value of our functions at any given point involves two subset products this is much more efficient than previous proposals furthermore these functions have the advantage of being in tc0 the class of functions computable by constant depth circuits consisting of a polynomial number of threshold gates this fact has several interesting applications the simple algebraic structure of the functions implies additional features such as a zero knowledge proof for statements of the form y e fs x and y n fs x given a commitment to a key s of a pseudo random function fs

relative to a random oracle a bf p a ne bf np a ne text co bf np a with probability 1 let a be a language chosen randomly by tossing a fair coin for each string x to determine whether x belongs to a with probability 1 each of the relativized classes textbf logspace a bf p a bf np a bf pp a and textbf pspace a is properly contained in the next also bf np a ne text co bf np a with probability 1 by contrast with probability 1 the class bf p a coincides with the class bf bpp a of languages recognized by probabilistic oracle machines with error probability uniformly bounded below tfrac 1 2 bf np a is shown with probability 1 to contain a bf p a immune set i e a set having no infinite subset in bf p a the relationship of bf p a immunity to p sparseness and bf np a completeness is briefly discussed bf p a immune sets in bf np a can be sparse or moderately dense but not co sparse relativization with respect to a random length preserving permutation pi instead of a rand

quantitative domains and infinitary algebras abstract we describe a class of models of the lambda calculus that generalize and simplify the quantitative domains of girard 1988 their salient feature is that these domains do not have enough points in the sense that a map of domains is not entirely determined by its value on the points i e the morphisms from the terminal object of the category we construct a universal domain whose structure is particularly simple and describe some of the features of the untyped lambda calculus associated to it finally we show how linear logic can be interpreted in these domains and construct another category of domains that supports linear logic

multiple noninteractive zero knowledge proofs under general assumptions in this paper we show how to construct noninteractive zero knowledge proofs for any np statement under general rather than number theoretic assumptions and how to enable polynomially many provers to give polynomially many such proofs based on a single random string our constructions can be used in cryptographic applications in which the prover is restricted to polynomial time

substitution permutation networks pseudorandom functions and natural proofs this article takes a new step towards closing the gap between pseudorandom functions prf and their popular bounded input length counterparts this gap is both quantitative because these counterparts are more efficient than prf in various ways and methodological because these counterparts usually fit in the substitution permutation network paradigm spn which has not been used to construct prf we give several candidate prf fi that are inspired by the spn paradigm most of our candidates are more efficient than previous ones our main candidates are as follows f1 0 1 n 0 1 n is an spn whose s box is a random function on b bits given as part of the seed we prove that f1 resists attacks that run in time 2eb f2 0 1 n 0 1 n is an spn where the s box is patched field inversion a common choice in practical constructions we show that f2 is computable with boolean circuits of size n logo 1 n and that it has exponential security 2 n against linear and differential cryptanalysis f3 0 1 n 0 1 is a nonstandard variant on the spn paradigm where states grow in length we show that f3 is computable with tc0 circuits of size n1 p e for any e 0 and that it is almost 3 wise independent f4 0 1 n 0 1 uses an extreme setting of the spn parameters one round one s box no diffusion matrix the s box is again patched field inversion we show that f4 is computable by circuits of size n logo 1 n and that it fools all parity tests on 20 9n outputs assuming the security of our candidates our work narrows the gap between the natural proofs barrier and existing lower bounds in three models circuits tc0 circuits and turing machines

theory revision with queries horn read once and parity formulas a theory in this context is a boolean formula it is used to classify instances or truth assignments theories can model real world phenomena and can do so more or less correctly the theory revision or concept revision problem is to correct a given roughly correct concept this problem is considered here in the model of learning with equivalence and membership queries a revision algorithm is considered efficient if the number of queries it makes is polynomial in the revision distance between the initial theory and the target theory and polylogarithmic in the number of variables and the size of the initial theory the revision distance is the minimal number of syntactic revision operations such as the deletion or addition of literals needed to obtain the target theory from the initial theory efficient revision algorithms are given for horn formulas and read once formulas where revision operators are restricted to deletions of variables or clauses and for parity formulas where revision operators include both deletions and additions of variables we also show that the query complexity of the read once revision algorithm is near optimal

the category theoretic solution of recursive domain equations recursive specifications of domains plays a crucial role in denotational semantics as developed by scott and strachey and their followers the purpose of the present paper is to set up a categorical framework in which the known techniques for solving these equations find a natural place the idea is to follow the well known analogy between partial orders and categories generalizing from least fixed points of continuous functions over cpos to initial ones of continuous functors over omega categories to apply these general ideas we introduce wand s bf o categories where the morphism sets have a partial order structure and which include almost all the categories occurring in semantics the idea is to find solutions in a derived category of embeddings and we give order theoretic conditions which are easy to verify and which imply the needed categorical ones the main tool is a very general form of the limit colimit coincidence remarked by scott in the concluding section we outline how compatibilit

how to generate cryptographically strong sequences of pseudo random bits we give a set of conditions that allow one to generate 50 50 unpredictable bits based on those conditions we present a general algorithmic scheme for constructing polynomial time deterministic algorithms that stretch a short secret random input into a long sequence of unpredictable pseudo random bits we give an implementation of our scheme and exhibit a pseudo random bit generator for which any efficient strategy for predicting the next output bit with better than 50 50 chance is easily transformable to an equally efficient algorithm for solving the discrete logarithm problem in particular if the discrete logarithm problem cannot be solved in probabilistic polynomial time no probabilistic polynomial time algorithm can guess the next output bit better than by flipping a coin if head guess 0 if tail guess 1

trees and semantics abstract several types of trees are proposed in the literature to model the behaviour of nondeterministic processes the purpose of this paper is to clarify the distinction between the various types of trees and to discuss their use as semantic domains trees in the sense of milner s derivation trees and bisimulation equivalence classes of trees are considered in three different settings in the category of sets in the metric setting and in the partial order setting each type of tree is characterized by a domain equation special attention is given to the use of trees as models for processes which allow for unbounded nondeterminism as for instance milners ccs processes in this case one has to deal with infinitely branching trees which cause problems to give denotational semantics that are fully abstract w r t a transition system based operational semantics

how to construct pseudorandom permutations from pseudorandom functions we show how to efficiently construct a pseudorandom invertible permutation generator from a pseudorandom function generator goldreich goldwasser and micali how to construct random functions p

universal forecasting algorithms abstract we consider forecasting systems which when given an initial segment of a binary string guess the next bit deterministic forecasting or estimate the probability of the next bit being 1 probabilistic forecasting the quality of forecasting is measured by the number of errors in the deterministic case or by the sum of distances between the forecasts and the true probabilities in the probabilistic case a forecasting system is said to be simple if it has a short description e g a simple formula which admits fast computation of the forecasts there is a universal forecasting algorithm which for any given bound on time of forecasting computes forecasts within time and the quality of these forecasts is not much lower than that of any simple forecasting system the complexity of the rival forecasting system may increase as increases the aim of the paper is to study the possibilities and limitations of universal forecasting

on the implementation of huge random objects we initiate a general study of the feasibility of implementing huge random objects and demonstrate its applicability to a number of areas in which random objects occur naturally we highlight two types of measures of the quality of the implementation with respect to the desired specification the first type corresponds to various standard notions of indistinguishability applied to function ensembles whereas the second type is a novel notion that we call truthfulness intuitively a truthful implementation of a random object of type t must always be an object of type t and not merely be indistinguishable from a random object of type t our formalism allows for the consideration of random objects that satisfy some fixed property or have some fixed structure as well as the consideration of objects supporting complex queries for example we consider the truthful implementation of random hamiltonian graphs as well as supporting complex queries regarding such graphs e g providing the next vertex along a fixed hamiltonian path in such a graph

non well founded sets modeled as ideal fixed points abstract motivated by ideas from the study of abstract data types we show how to interpret non well founded sets as fixed points of continuous transformations of an initial continuous algebra we conisder a preordered structure closely related to the set hf of well founded hereditarily finite sets by taking its ideal completion we obtain an initial continuous algebra in which we are able to solve all of the usual systems of equations that characterize hereditarily finite non well founded sets in this way we are able to obtain a structure which is isomorphic to hf 1 the non well founded analog of hf

arithmetic cryptography we study the possibility of computing cryptographic primitives in a fully black box arithmetic model over a finite field f in this model the input to a cryptographic primitive e g encryption scheme is given as a sequence of field elements the honest parties are implemented by arithmetic circuits that make only a black box use of the underlying field and the adversary has a full non black box access to the field this model captures many standard information theoretic constructions we prove several positive and negative results in this model for various cryptographic tasks on the positive side we show that under coding related intractability assumptions computational primitives like commitment schemes public key encryption oblivious transfer and general secure two party computation can be implemented in this model on the negative side we prove that garbled circuits additively homomorphic encryption and secure computation with low online complexity cannot be achieved in this model our results reveal a qualitative difference between the standard boolean model and the arithmetic model and explain in retrospect some of the limitations of previous constructions

constant depth circuits fourier transform and learnability in this paper boolean functions in 4c0 are studied using harmonic analysis on the cube the main result is that an aco boolean function has almost all of its power spectrum on the low order coefficients an important ingredient of the proof is hastad s switching lemma 8 this result implies several new properties of functions in 4c functions in ac have low average sensitivity they may be approximated well by a real polynomial of low degree and they cannot be pseudorandom function generators perhaps the most interesting application is an o n poiyiog n time algorithm for learning func tions in aco the algorithm observes the behavior of an ac function on o npo y og n randomly chosen inputs and derives a good approximation for the fourier transform of the function this approximation allows the algorithm to predict with high probability the value of the function on other randomly chosen inputs

continuous information system abstract in this paper we generalise the notion of algebraic information system to continuous information system just as algebraic information systems are concrete representations of scott domains continuous information systems are concrete representations of continuous scott domains the class of continuous information systems can be generated from the subclass of qualitative information systems in the sense that the category of continuous information systems is equivalent to the karoubi envelope of the category of qualitative information systems because qualitative information systems correspond to the qualitative domains of girard theoret comput sci 45 159 192 1986 this implies that the category of continuous scott domains is equivalent to the karoubi envelope of the category of qualitative domains we show how constructions on qualitative information systems such as product and function space can be translated to constructions on continuous information systems among other things we prove that the category of qualitative information systems is weak cartesian closed finally we define two universal information systems

guaranteeing the diversity of number generators a major problem in using iterative number generators of the form xi f xi 1 is that they can enter unexpectedly short cycles this is hard to analyze when the generator is designed hard to detect in real time when the generator is used and can have devastating cryptanalytic implications in this paper we define a measure of security called sequence diversity which generalizes the notion of cycle length for noniterative generators we then introduce the class of counter assisted generators and show how to turn any iterative generator even a bad one designed or seeded by an adversary into a counter assisted generator with a provably high diversity without reducing the quality of generators which are already cryptographically strong 2001 elsevier science

a random number generator based on elliptic curve operations abstract a random number generator based on the addition of points on an elliptic curve over finite fields is proposed by using the proposed generator together with the elliptic curve cryptography ecc algorithm we can save hardware and software components for hardware implementation the proposed generator can be implemented using the existing ecc arithmetic processor up to 29 of gate counts can be saved when compared to the case of implementing a random number generator separately theoretical analyses show that periods of the proposed random number generator are sufficiently long moreover the generated sequences have passed the fips 140 2 statistical tests as a result the proposed generator is suitable to be a reliable and efficient random number generator in ecc systems

kripke logical relations and pcf abstract sieber has described a model of pcf consisting of continuous functions that are invariant under certain finitary logical relations and shown that it is fully abstract for closed terms of up to third order types we show that one may achieve full abstraction at all types using a form of kripke logical relations introduced by jung and tiuryn to characterize definability

how to leak a secret theory and applications of ring signatures in this work we formalize the notion of a ring signature which makes it possible to specify a set of possible signers without revealing which member actually produced the signature unlike group signatures ring signatures have no group managers no setup procedures no revocation procedures and no coordination any user can choose any set of possible signers that includes himself and sign any message by using his secret key and the others public keys without getting their approval or assistance ring signatures provide an elegant way to leak authoritative secrets in an anonymous way to sign casual email in a way that can only be verified by its intended recipient and to solve other problems in multiparty computations our main contribution lies in the presentation of efficient constructions of ring signatures the general concept itself under different terminology was first introduced by cramer et al cds94 our constructions of such signatures are unconditionally signer ambiguous secure in the random oracle model and exceptionally efficient adding each ring member increases the cost of signing or verifying by a single modular multiplication and a single symmetric encryption we also describe a large number of extensions modifications and applications of ring signatures which were published after the original version of this work in asiacrypt 2001

a pseudorandom generator from any one way function pseudorandom generators are fundamental to many theoretical and applied aspects of computing we show how to construct a pseudorandom generator from any one way function since it is easy to construct a one way function from a pseudorandom generator this result shows that there is a pseudorandom generator if and only if there is a one way function

notions of computation and monads abstract the calculus is considered a useful mathematical tool in the study of programming languages since programs can be identified with terms however if one goes further and uses conversion to prove equivalence of programs then a gross simplification is introduced programs are identified with total functions from values to values that may jeopardise the applicability of theoretical results in this paper we introduce calculi based on a categorical semantics for computations that provide a correct basis for proving equivalence of programs for a wide range of notions of computation

pseudorandom generators hard for k dnf resolution and polynomial calculus resolution a pseudorandom generator gn f0 1g n f0 1g m is hard for a propositional proof system p if roughly speaking p cannot eciently

efficient tweakable enciphering schemes from block wise universal hash functions this paper describes several constructions of tweakable strong pseudorandom permutations sprps built from different modes of operations of a block cipher and suitable universal hash functions for the electronic codebook ecb mode based construction an invertible blockwise universal hash function is required we simplify an earlier construction of such a function described by naor and reingold the other modes of operations considered are the output feedback ofb mode and a counter like mode all the constructions make the same number of block cipher calls and the same number of multiplications combined with a class of polynomials defined by bernstein the new constructions provide the currently best known algorithms for the important practical problem of disk encryption

how to sign given any trapdoor permutation a digital signature scheme is presented which is based on the existence of any trapdoor permutation the scheme is secure in the strongest possible natural sense namely it is secure against existential forgery under adaptive chosen message attack

chosen ciphertext secure multi hop identity based conditional proxy re encryption with constant size ciphertexts abstract proxy re encryption pre allows one user to delegate the decryption rights of his her ciphertexts to another user since the introduction of multi hop identity based pre mh ibpre by green and ateniese the ciphertext size and the decryption complexity grow linearly in the number of re encryption hops in this paper for the first time we propose an mh ibpre that maintains the constant ciphertext size and computational complexity regardless of the number of re encryption hops moreover our scheme is bidirectional and also supports conditional re encryption the scheme is proven secure against selective identity and chosen ciphertext attacks and collusion resistant in the standard model as of independent interest we also show that the conditional re encryption can also be extended to a set of conditions

finite memory universal prediction of individual sequences the problem of predicting the next outcome of an individual binary sequence under the constraint that the universal predictor has a finite memory is explored in this analysis the finite memory universal predictors are either deterministic or random time invariant finite state fs machines with k states k state machines the paper provides bounds on the asymptotic achievable regret of these constrained universal predictors as a function of k the number of their states for long enough sequences the specific results are as follows when the universal predictors are deterministic machines the comparison class consists of constant predictors and prediction is with respect to the 0 1 loss function hamming distance we get tight bounds indicating that the optimal asymptotic regret is 1 2k in that case of k state deterministic universal predictors the constant predictors comparison class but prediction is with respect to the self information code length and the square error loss functions we show an upper bound on the regret coding redundancy of o k sup 2 3 and a lower bound of spl theta k sup 4 5 for these loss functions if the predictor is allowed to be a random k state machine i e a machine with random state transitions we get a lower bound of spl theta 1 k on the regret with a matching upper bound of o 1 k for the square error loss and an upper bound of o logk k throughout the paper for the self information loss in addition we provide results for all these loss functions in the case where the comparison class consists of all predictors that are order l markov machines

a co induction principle for recursively defined domains abstract this paper establishes a new property of predomains recursively defined using the cartesian product disjoint union partial function space and convex powerdomain constructors we prove that the partial order on such a recursive predomain d is the greatest fixed point of a certain monotone operator associated to d this provides a structurally defined family of proof principles for these recursive predomains to show that one element of d approximates another it suffices to find a binary relation containing the two elements that is a post fixed point for the associated monotone operator the statement of the proof principles is independent of any of the various methods available for explicit construction of recursive predomains following milner and tofte 1991 the method of proof is called co induction it closely resembles the way bisimulations are used in concurrent process calculi milner 1989 two specific instances of the co induction principle already occur in the work of abramsky 1990 1991 in the form of internal full abstraction theorems for denotational semantics of sccs and lazy lambda calculus in the first case post fixed binary relations are precisely abramsky s partial bisimulations whereas in the second case they are his applicative bisimulations the co induction principle also provides an apparently useful tool for reasoning about equality of elements of recursively defined datatypes in strict or lazy higher order functional programming languages

bounds on the efficiency of black box commitment schemes constructions of cryptographic primitives based on general assumptions e g one way functions tend to be less efficient than constructions based on specific e g number theoretic assumptions this has prompted a recent line of research aimed at investigating the best possible efficiency of black box cryptographic constructions based on general assumptions here we present bounds on the efficiency of statistically binding commitment schemes constructed using black box access to one way permutations our bounds are tight for the case of perfectly binding schemes our bounds hold in an extension of the impagliazzo rudich model we show that any construction beating our bounds would imply the unconditional existence of a one way function from which a statistically binding commitment scheme could be constructed from scratch

computational limitations on learning from examples the computational complexity of learning boolean concepts from examples is investigated it is shown for various classes of concept representations that these cannot be learned feasibly in a distribution free sense unless r np these classes include a disjunctions of two monomials b boolean threshold functions and c boolean formulas in which each variable occurs at most once relationships between learning of heuristics and finding approximate solutions to np hard optimization problems are given

the largest cartesian closed category of domains the main result of this paper provides a necessary and sufficient condition that the function space d d of a domain algebraic cpo d be again a domain the condition confirming a conjecture of plotkin is that d be strongly algebraic sfp the importance of this is that it enables us to conclude that sfp is the largest category of domains that is closed under the constructions of interest in semantics in the final section we briefly consider how our results may need to be extended if our admittedly rather restrictive notion of category of domains is relaxed in certain ways

universal profinite domains abstract we introduce a bicartesian closed category of what we call profinite domains study of these domains is carried out through the use of an equivalent category of pre orders in a manner similar to the information systems approach advocated by dana scott and others a class of universal profinite domains is defined and used to derive sufficient conditions for the profinite solution of domain equations involving continuous operators as a special instance of this construction a universal domain for the category sfp is demonstrated necessary conditions for the existence of solutions for domain equations over the profinites are also given and used to derive results about solutions of some equations a new universal bounded complete domain is also demonstrated using an operator which has bounded complete domains as its fixed points