International Association for Cryptologic Research

International Association
for Cryptologic Research


Anderson C. A. Nascimento


A Two-Party Protocol with Trusted Initializer for Computing the Inner Product
We propose the first protocol for securely computing the inner product modulo an integer $m$ between two distrustful parties based on a trusted initializer, i.e. a trusted party that interacts with the players solely during a setup phase. We obtain a very simple protocol with universally composable security. As an application of our protocol, we obtain a solution for securely computing linear equations.
Oblivious Transfer based on the McEliece Assumptions}
We implement one-out-of-two bit oblivious transfer (OT) based on the assumptions used in the McEliece cryptosystem: the hardness of decoding random binary linear codes, and the difficulty of distinguishing a permuted generating matrix of Goppa codes from a random matrix. To our knowledge this is the first OT reduction to these problems only.
A Novel Probabilistic Passive Attack on the Protocols HB and HB+
Jose Carrijo Anderson C A Nascimento Rafael Tonicelli Hideki Imai
We present a very simple probabilistic, passive attack against the protocols HB and HB+. Our attack presents some interesting features: it requires less captured transcripts of protocol executions when com- pared to previous results; It makes possible to trade the amount of required transcripts for computational complexity; the value of noise used in the protocols HB and HB+ need not be known.
A CCA2 Secure Public Key Encryption Scheme Based on the McEliece Assumptions in the Standard Model
Rafael Dowsley Jörn Müller-Quade Anderson C. A. Nascimento
We show that a recently proposed construction by Rosen and Segev can be used for obtaining the first public key encryption scheme based on the McEliece assumptions which is secure against adaptive chosen ciphertext attacks in the standard model.
Commitment Capacity of Discrete Memoryless Channels
Andreas Winter Anderson C. A. Nascimento Hideki Imai
In extension of the bit commitment task and following work initiated by Crepeau and Kilian, we introduce and solve the problem of characterising the optimal rate at which a discrete memoryless channel can be used for bit commitment. It turns out that the answer is very intuitive: it is the maximum equivocation of the channel (after removing trivial redundancy), even when unlimited noiseless bidirectional side communication is allowed. By a well-known reduction, this result provides a lower bound on the channel's capacity for implementing coin tossing, which we conjecture to be an equality. The method of proving this relates the problem to Wyner's wire--tap channel in an amusing way. We also discuss extensions to quantum channels.