Secrecy scheme

This third demarcation seems unnecessary from a purely scientific point of view, but for several practical reasons, it is not Digital signature schemes, and authentication schemes generally, have nothing to do with keeping messages secret. For that purpose, one has secrecy schemes. 

Apart from a historical idea that cr5 tology deals with secrecy, one reason why authentication and secrecy are sometimes mixed up is that some well-known authentication and secrecy schemes are constructed from the same basic functions, e.g., DBS or RSA ([DES77, RiSA78], see Chapter 2). However, the basic functions are used differently in order to achieve the different purposes. 

Another reason is that the following idea seems to suggest itself, and has indeed been proposed several times (e.g., with a small technical modification, in [DiHe76, RiSA78]) Assume one has a secrecy scheme, and one receives a ciphertext and deciphers it. If it yields a sensible message, it must have been a correct ciphertext produced by the supposed sender. 

Hence, authentication schemes, and digital signature schemes in particular, carmot be treated as a variant of secrecy schemes, but need both definitions and constructions of their own. 

Primarily, secrecy schemes were considered, and no formal notion of security existed. Some even thought it impossible that such a notion could exist, the more so because several schemes had been broken for whose security mathematical arguments had been given. However, these arguments had only referred to some aspects of security, e.g., how many keys were possible (see, e.g., [DiHe76]). 

The first important step towards modem scientific cryptology was Claude Shannon s work [Shan49]. There, for the first time, a precise (and, according to informal requirements, certainly sufficient) notion of security for any type of cryptologic scheme was defined the information-theoretic security of secrecy schemes, sometimes called Shannon security. Roughly, the definition requires that a ciphertext provides an outsider with no additional information at all about the message. The information-theoretic notion means that the scheme is absolutely unbreakable, i.e., unbreakable even by attackers with unrestricted computing power and unrestricted memory. 

However, in the same article it was proved that any secrecy scheme that is provably secure in this sense is equivalent to one-time pads (see Section 1.5) or even less efficient. Thus, for a while, there was no further research in this field. Besides, for most applications, one-time pads were regarded as too inefficient, because the length of the secret key, which has to be exchanged beforehand, must be at least equal to the overall length of the messages that might be sent later. Hence one continued to use other schemes in practice. 

A similar work for authentication schemes was only published 15 years later In [GiMS74], the information-theoretic, i.e., absolute security of symmetric authentication schemes was defined. Schemes complying with this definition are often called authentication codes. Like Claude Shannon s work, [GiMS74] already contains both concrete constructions of authentication codes and lower bounds on the achievable efficiency, and in particular, the key length. In contrast to secrecy schemes, however, the upper and lower bounds are not identical furthermore, the constructions are less trivial. Therefore, there has been further research in this field. 

The word cryptology is nowadays used for all schemes, or only all mathematical schemes, which enable parties who distrust each other or outsiders to cooperate in a useful way. For more types of cryptologic schemes than authentication and secrecy schemes, see, e.g, [Bras88, Schn96] or some subschemes in the later chapters of this text. Cryptography is sometimes regarded as a synonym and sometimes as more restricted, either to the construction of schemes (in contrast to cryptanalysis, for instance) or to secrecy schemes. 

The same idea with key pairs was first introduced for secrecy schemes in [DiHe76] In this case, the first, more powerful, key is needed to decrypt messages, whereas with the second key, one can only encrypt. As before, the second key is published. Thus everybody can encrypt messages for the owner of a key pair and only the owner can decrypt them with the secret key. These schemes are called asymmetric secrecy schemes. ... 

The name public-key cryptosystems is also used. With some authors, it designates all asymmetric schemes, with others, asymmetric secrecy schemes only. 

One could also consider normal confidentiality requirements in the interest of all participants in a transaction, e.g., that attackers do not learn anything about the messages that honest users authenticate for each other. In general, one woidd use combinations of normal signature schemes and secrecy schemes inside the system, but, as mentioned under Directedness of Authentication in Section 5.2.8, this will not always be trivial. 

The AICS was collected over a 13-year period commencing in 1977 in preparation for the introduction of an industrial chemical assessment scheme. Companies were requested to have their chemicals, which were in commerce in Australia, nominated and listed on the AICS. The inventory was closed off when the NICNAS commenced operations in 1990. There are approximately 40 000 chemicals on the AICS. The AICS also has a confidential section, which at present has less than 1000 chemicals. The confidential status of chemicals on this section of the AICS is reviewed once every 3 years. Chemicals must meet strict criteria before they can be relisted on the confidential section. If the confidentiality claim is rejected by NICNAS then the chemical is transferred to the non-confidential AICS. Similarly, for assessed new chemicals, there is an opportunity for a company to elect to have its chemical listed on the confidential section of the AICS. However, they must meet the criteria which are designed to balance commercial interests for secrecy against the public interest for disclosure (public right to know). 

Usually, the secrecy and signature schemes constructed from this trap-door one-way family of permutations are also called RSA. However, there are several variants of those, as will be seen in Section 2.5. This can lead to confusion. 

These minimal structural requirements, called locality, are described in a little more detail in Section 5.3.1. Similar requirements would be made on general cryptologic transaction schemes, such as secrecy, payment, and credential schemes. Section 5.3.2 describes additional structural properties that characterize special classes of... 

EvKW74 Arthur Evans, William Kantrowitz, Edwin Weiss A User Authentication Scheme Not Requiring Secrecy in the Computer Communications of the ACM 17/8 (1974) 437-442. 

For practical applications, digital signatures are one of the two most important cryptologic primitives. In particular with the rise of electronic conunerce on the Internet and the World Wide Web, they may become even more important than the better-known schemes for message secrecy. 

The various reactions have been carried through historic sequences from laboratory scale experiments to technical developments wherever possible. When sufficient data were available, industrial practice has been discussed In many cases, the discussion could not be made as critical as desired because trade secrecy prevented the use of industrial data as illustrative material, because the multiplicity of conditions used in vapor phase oxidations made adequate comparisons and confirmations impossible, and because the paucity of data, published or otherwise, made it difficult to obtain sufficient knowledge of certain reactions. Nevertheless, a large amount of information has been gleaned from the scattered literature and arranged according to the scheme already mentioned. 

The new munitions requirements are a logical attempt to address these potential dangers and place the onus on the party that created the hazard in the first place. One important aspect of this regulatory scheme is to empower the EPA, states, and local governments with oversight responsibilities, thus stripping the cloak of secrecy (and denial) from the DOD. 

The overlying software-based system feeds the CMAC scheme (implemented in hardware) with the properly padded (when needed) input blocks Minput which are parts of the whole message that is intended to be protected for authentication. The padding process is a quite simple process that can be carried out by the software. This does not imply security problems since there is no secrecy or keys information that should be protected at this point. The initial unit part is the hardware component responsible for the conditional bitwise operation xor between the Mi pui and one of the subkeys Ki or K2. 

At first there were conflicting Ideas about mechanism, and I recall working out a scheme which I considered plausible In the middle 50 s and describing It In a seminar at the Shell Development Co. This caused considerable confusion, since Jay Kochi and his colleagues there had worked out the same approach In considerable detail, but were restrained from publishing It because of Industrial secrecy. Kochi of course has gone on to make fundamental contributions to the study of redox systems. Identifying a variety of paths for transition metal-radical reactions (12). 

---