Improved algebraic cryptanalysis of QUAD, Bivium and Trivium via graph partitioning on equation systems

We present a novel approach for preprocessing systems of polynomial equations via graph partitioning. The variable-sharing graph of a system of polynomial equations is defined. If such graph is disconnected, then the corresponding system of equations can be split into smaller ones that can be solved individually. This can provide a tremendous speed-up in computing the solution to the system, but is unlikely to occur either randomly or in applications. However, by deleting certain vertices on the graph, the variable-sharing graph could be disconnected in a balanced fashion, and in turn the system of polynomial equations would be separated into smaller systems of near-equal sizes. In graph theory terms, this process is equivalent to finding balanced vertex partitions with minimum-weight vertex separators. The techniques of finding these vertex partitions are discussed, and experiments are performed to evaluate its practicality for general graphs and systems of polynomial equations. Applications of this approach in algebraic cryptanalysis on symmetric ciphers are presented: For the QUAD family of stream ciphers, we show how a malicious party can manufacture conforming systems that can be easily broken. For the stream ciphers Bivium and Trivium, we nachieve significant speedups in algebraic attacks against them, mainly in a partial key guess scenario. In each of these cases, the systems of polynomial equations involved are well-suited to our graph partitioning method. These results may open a new avenue for evaluating the security of symmetric ciphers against algebraic attacks.

"The Lost Lounge" - Split Britches (Lois Weaver, Peggy Shaw)

Digital Scenography and traditional Stage Design for the US premiere of Split Britches "The Lost Lounge" - Lois Weaver and Peggy Shaw, Dixons Place New York, December 2009 Digital Scenography and traditional Stage Design for the UK premiere of Split Britches "The Lost Lounge" - Lois Weaver and Peggy Shaw, The Great Hall, Peoples Palace, London, March 2010

Algebraic attacks on clock-controlled stream ciphers

Stream ciphers are encryption algorithms used for ensuring the privacy of digital telecommunications. They have been widely used for encrypting military communications, satellite communications, pay TV encryption and for voice encryption of both fixed lined and wireless networks. The current multi year European project eSTREAM, which aims to select stream ciphers suitable for widespread adoptation, reflects the importance of this area of research. Stream ciphers consist of a keystream generator and an output function. Keystream generators produce a sequence that appears to be random, which is combined with the plaintext message using the output function. Most commonly, the output function is binary addition modulo two. Cryptanalysis of these ciphers focuses largely on analysis of the keystream generators and of relationships between the generator and the keystream it produces. Linear feedback shift registers are widely used components in building keystream generators, as the sequences they produce are well understood. Many types of attack have been proposed for breaking various LFSR based stream ciphers. A recent attack type is known as an algebraic attack. Algebraic attacks transform the problem of recovering the key into a problem of solving multivariate system of equations, which eventually recover the internal state bits or the key bits. This type of attack has been shown to be effective on a number of regularly clocked LFSR based stream ciphers. In this thesis, algebraic attacks are extended to a number of well known stream ciphers where at least one LFSR in the system is irregularly clocked. Applying algebriac attacks to these ciphers has only been discussed previously in the open literature for LILI-128. In this thesis, algebraic attacks are first applied to keystream generators using stop-and go clocking. Four ciphers belonging to this group are investigated: the Beth-Piper stop-and-go generator, the alternating step generator, the Gollmann cascade generator and the eSTREAM candidate: the Pomaranch cipher. It is shown that algebraic attacks are very effective on the first three of these ciphers. Although no effective algebraic attack was found for Pomaranch, the algebraic analysis lead to some interesting findings including weaknesses that may be exploited in future attacks. Algebraic attacks are then applied to keystream generators using (p; q) clocking. Two well known examples of such ciphers, the step1/step2 generator and the self decimated generator are investigated. Algebraic attacks are shown to be very powerful attack in recovering the internal state of these generators. A more complex clocking mechanism than either stop-and-go or the (p; q) clocking keystream generators is known as mutual clock control. In mutual clock control generators, the LFSRs control the clocking of each other. Four well known stream ciphers belonging to this group are investigated with respect to algebraic attacks: the Bilateral-stop-and-go generator, A5/1 stream cipher, Alpha 1 stream cipher, and the more recent eSTREAM proposal, the MICKEY stream ciphers. Some theoretical results with regards to the complexity of algebraic attacks on these ciphers are presented. The algebraic analysis of these ciphers showed that generally, it is hard to generate the system of equations required for an algebraic attack on these ciphers. As the algebraic attack could not be applied directly on these ciphers, a different approach was used, namely guessing some bits of the internal state, in order to reduce the degree of the equations. Finally, an algebraic attack on Alpha 1 that requires only 128 bits of keystream to recover the 128 internal state bits is presented. An essential process associated with stream cipher proposals is key initialization. Many recently proposed stream ciphers use an algorithm to initialize the large internal state with a smaller key and possibly publicly known initialization vectors. The effect of key initialization on the performance of algebraic attacks is also investigated in this thesis. The relationships between the two have not been investigated before in the open literature. The investigation is conducted on Trivium and Grain-128, two eSTREAM ciphers. It is shown that the key initialization process has an effect on the success of algebraic attacks, unlike other conventional attacks. In particular, the key initialization process allows an attacker to firstly generate a small number of equations of low degree and then perform an algebraic attack using multiple keystreams. The effect of the number of iterations performed during key initialization is investigated. It is shown that both the number of iterations and the maximum number of initialization vectors to be used with one key should be carefully chosen. Some experimental results on Trivium and Grain-128 are then presented. Finally, the security with respect to algebraic attacks of the well known LILI family of stream ciphers, including the unbroken LILI-II, is investigated. These are irregularly clock- controlled nonlinear filtered generators. While the structure is defined for the LILI family, a particular paramater choice defines a specific instance. Two well known such instances are LILI-128 and LILI-II. The security of these and other instances is investigated to identify which instances are vulnerable to algebraic attacks. The feasibility of recovering the key bits using algebraic attacks is then investigated for both LILI- 128 and LILI-II. Algebraic attacks which recover the internal state with less effort than exhaustive key search are possible for LILI-128 but not for LILI-II. Given the internal state at some point in time, the feasibility of recovering the key bits is also investigated, showing that the parameters used in the key initialization process, if poorly chosen, can lead to a key recovery using algebraic attacks.

Quantification of the relationship between Fuser Roller Temperature and Laser Printer Emissions

Recently published studies not only demonstrated that laser printers are often significant sources of ultrafine particles, but they also shed light on particle formation mechanisms. While the role of fuser roller temperature as a factor affecting particle formation rate has been postulated, its impact has never been quantified. To address this gap in knowledge, this study measured emissions from 30 laser printers in chamber using a standardized printing sequence, as well as monitoring fuser roller temperature. Based on a simplified mass balance equation, the average emission rates of particle number, PM2.5 and O3 were calculated. The results showed that: almost all printers were found to be high particle number emitters (i.e. > 1.01×1010 particles/min); colour printing generated more PM2.5 than monochrome printing; and all printers generated significant amounts of O3. Particle number emissions varied significantly during printing and followed the cycle of fuser roller temperature variation, which points to temperature being the strongest factor controlling emissions. For two sub-groups of printers using the same technology (heating lamps), systematic positive correlations, in the form of a power law, were found between average particle number emission rate and average roller temperature. Other factors, such as fuser material and structure, are also thought to play a role, since no such correlation was found for the remaining two sub-groups of printers using heating lamps, or for the printers using heating strips. In addition, O3 and total PM2.5 were not found to be statistically correlated with fuser temperature.

Exposure of pipe insulation to high temperatures from domestic pumped storage (split) solar water heating systems in Australia and New Zealand

Pipe insulation between the collector and storage tank on pumped storage (commonly called split), solar water heaters can be subject to high temperatures, with a maximum equal to the collector stagnation temperature. The frequency of occurrence of these temperatures is dependent on many factors including climate, hot water demand, system size and efficiency. This paper outlines the findings of a computer modelling study to quantify the frequency of occurrence of pipe temperatures of 80 degrees Celsius or greater at the outlet of the collectors for these systems. This study will help insulation suppliers determine the suitability of their materials for this application. The TRNSYS program was used to model the performance of a common size of domestic split solar system, using both flat plate and evacuated tube, selective surface collectors. Each system was modelled at a representative city in each of the 6 climate zones for Australia and New Zealand, according to AS/NZS4234 - Heat Water Systems - Calculation of energy consumption, and the ORER RECs calculation method. TRNSYS was used to predict the frequency of occurrence of the temperatures that the pipe insulation would be exposed to over an average year, for hot water consumption patterns specified in AS/NZS4234, and for worst case conditions in each of the climate zones. The results show; * For selectively surfaced, flat plate collectors in the hottest location (Alice Sprints) with a medium size hot water demand according to AS/NZS2434, the annual frequency of occurrence of temperatures at and above 80 degrees Celsius was 33 hours. The frequency of temperatures at and above 140 degrees Celsius was insignificant. * For evacuated tube collectors in the hottest location (Alice Springs), the annual frequency of temperatures at and above 80 degrees Celsius was 50 hours. Temperatures at and above 140 degrees Celsius were significant and were estimated to occur for more than 21 hours per year in this climate zone. Even in Melbourne, temperatures at and above 80 degrees can occur for 12 hours per year and at and above 140 degrees for 5 hours per year. * The worst case identified was for evacuated tube collectors in Alice Springs, with mostly afternoon loads in January. Under these conditions, the frequency of temperatures at and above 80 degrees Celsius was 10 hours for this month only. Temperatures at and above 140 degrees Celsius were predicted to occur for 5 hours in January.

Energy and cost savings from pipe insulation on domestic, pumped storage (split), solar water heating systems in Australia and New Zealand

Appropriate pipe insulation on domestic, pumped storage (split), solar water heating systems forms an integral part of energy conservation measures of well engineered systems. However, its importance over the life of the system is often overlooked. This study outlines the findings of computer modelling to quantify the energy and cost savings by using pipe insulation between the collector and storage tank. System sizes of 270 Litre storage tank, together with either selectively surfaced, flat plate collectors (4m2 area), or 30 evacuated tube collectors, were used. Insulation thicknesses of 13mm and 15mm, pipe runs both ways of 10, 15 and 20 metres and both electric and gas boosting of systems were all considered. The TRNSYS program was used to model the system performance at a representative city in each of the 6 climate zones for Australia and New Zealand, according to AS/NZS4234 – Heat Water Systems – Calculation of energy consumption and the ORER RECs calculation method. The results show:  Energy savings from pipe insulation are very significant, even in mild climates such as Rockhampton. Across all climates zones, savings ranged from 0.16 to 3.5GJ per system per year, or about 2 to 23 percent of the annual load.  There is very little advantage in increasing the insulation thickness from 13 to 15mm. For electricity at 19c/kWh and gas at 2 c/MJ, cost savings of between $27 and $100 per year are achieved across the climate zones. Both energy and cost savings would increase in colder climates with increased system size, solar contribution and water temperatures.  The pipe insulation substantially improves the solar contribution (or fraction) and Renewable Energy Certificates (RECs), as well as giving small savings in circulating pump running costs in milder climates. Solar contribution increased by up to 23 percent points and RECs by over 7 in some cases.  The study highlights the need to install and maintain the integrity of appropriate pipe insulation on solar water heaters over their life time in Australia and New Zealand.

Laser doppler imaging in a paediatric burns population

Objective Laser Doppler imaging (LDI) was compared to wound outcomes in children's burns, to determine if the technology could be used to predict these outcomes. Methods Forty-eight patients with a total of 85 burns were included in the study. Patient median age was 4 years 10 months and scans were taken 0–186 h post-burn using the fast, low-resolution setting on the Moor LDI2 laser Doppler imager. Wounds were managed by standard practice, without taking into account the scan results. Time until complete re-epithelialisation and whether or not grafting and scar management were required were recorded for each wound. If wounds were treated with Silvazine™ or Acticoat™ prior to the scan, this was also recorded. Results The predominant colour of the scan was found to be significantly related to the re-epithelialisation, grafting and scar management outcomes and could be used to predict those outcomes. The prior use of Acticoat™ did not affect the scan relationship to outcomes, however, the use of Silvazine™ did complicate the relationship for light blue and green scanned partial thickness wounds. Scans taken within the 24-h window after-burn also appeared to be accurate predictors of wound outcome. Conclusion Laser Doppler imaging is accurate and effective in a paediatric population with a low-resolution fast-scan.

State convergence in the initialisation of stream ciphers

An initialisation process is a key component in modern stream cipher design. A well-designed initialisation process should ensure that each key-IV pair generates a different key stream. In this paper, we analyse two ciphers, A5/1 and Mixer, for which this does not happen due to state convergence. We show how the state convergence problem occurs and estimate the effective key-space in each case.