New Collision Attacks on SHA-1 Based on Optimal Joint Local-Collision Analysis

A central question in information theory is to determine the maximum success probability that can be achieved in sending a fixed number of messages over a noisy channel. This was first studied in the pioneering work of Shannon who established a simple expression characterizing this quantity in the limit of multiple independent uses of the channel. Here we consider the general setting with only one use of the channel. We observe that the maximum success probability can be expressed as the maximum value of a submodular function. Using this connection, we establish the following results: 1. There is a simple greedy polynomial-time algorithm that computes a code achieving a (1-1/e)-approximation of the maximum success probability. Moreover, for this problem it is NP-hard to obtain an approximation ratio strictly better than (1-1/e). 2. Shared quantum entanglement between the sender and the receiver can increase the success probability by a factor of at most 1/(1-1/e). In addition, this factor is tight if one allows an arbitrary non-signaling box between the sender and the receiver. 3. We give tight bounds on the one-shot performance of the meta-converse of Polyanskiy-Poor-Verdu.

Channel simulation using coherence, which refers to realizing a target channel with coherent states and free operations, is a fundamental problem in the quantum resource theory of coherence. The limitations of the accuracy of deterministic channel simulation motivate us to consider the more general probabilistic framework. In this paper, we develop the framework for probabilistic channel simulation using coherence with free operations. When the chosen set of free operations is the maximally incoherent operations, we provide an efficiently computable semidefinite program (SDP) to calculate the maximal success probability and derive the analytic expression of success probability for some special cases. When the chosen set of free operations is the dephasing-covariant incoherent operations (DIO), we show that if the target channel is not a resource nonactivating channel then one cannot simulate it exactly both deterministically and probabilistically. The SDP for maximal success probability of simulating a channel by DIO is also given correspondingly. Published by the American Physical Society 2024

Assume that the probability of success is unimodal as a function of dose. Take the response to be binary and the possible treatment space to be a lattice. The Optimizing Up-and-Down Design allocates treatments to pairs of subjects in a way that causes the treatment distribution to cluster around the treatment with maximum success probability. This procedure is constructed to use accruing information to limit the number of patients that are exposed to doses with high probabilities of failure. The Optimizing Up-and-Down Design is motivated by Kiefer and Wolfowitz’s stochastic approximation procedure. In this paper, we compare its performance to stochastic approximation. As an estimator of the best dose, simulation studies demonstrate that the mode of the empirical treatment distribution using the Optimizing Up-and-Down Design converges faster than does the usual estimator using stochastic approximation.Keywordsconstant gain stochastic algorithmMarkov chainsphase I/II clinical trialrandom walk designsstationary treatment distributionstochastic approximation

RIPEMD-160 is a hash function published in 1996, which shares similarities with other hash functions designed in this time-period like MD4, MD5 and SHA-1. However, for RIPEMD-160, no (semi-free-start) collision attacks on the full number of steps are known. Hence, it is still used, e.g., to generate Bitcoin addresses together with SHA-256, and is an ISO/IEC standard. Due to its dual-stream structure, even semifree- start collision attacks starting from the first step only reach 36 steps, which were firstly shown by Mendel et al. at Asiacrypt 2013 and later improved by Liu, Mendel and Wang at Asiacrypt 2017. Both of the attacks are based on a similar freedom degree utilization technique as proposed by Landelle and Peyrin at Eurocrypt 2013. However, the best known semi-free-start collision attack on 36 steps of RIPEMD-160 presented at Asiacrypt 2017 still requires 255.1 time and 232 memory. Consequently, a practical semi-free-start collision attack for the first 36 steps of RIPEMD-160 still requires a significant amount of resources. Considering the structure of these previous semi-free-start collision attacks for 36 steps of RIPEMD-160, it seems hard to extend it to more steps. Thus, we develop a different semi-free-start collision attack framework for reduced RIPEMD-160 by carefully investigating the message expansion of RIPEMD-160. Our new framework has several advantages. First of all, it allows to extend the attacks to more steps. Second, the memory complexity of the attacks is negligible. Hence, we were able to mount semi-free-start collision attacks on 36 and 37 steps of RIPEMD-160 with practical time complexity 241 and 249 respectively. Additionally, we describe semi-free-start collision attacks on 38 and 40 (out of 80) steps of RIPEMD-160 with time complexity 252 and 274.6, respectively. To the best of our knowledge, these are the best semi-free-start collision attacks for RIPEMD-160 starting from the first step with respect to the number of steps, including the first practical colliding message pairs for 36 and 37 steps of RIPEMD-160.

By using the theory of cavity QED, we study the system in which a two-level atom interacts with a cavity in the case of large detuning. Through the selective detecting of atomic state, Schrödinger cat states and entangled coherent states are easily generated. When the atom is driven by a weak classical field and the cavity field is in the Schrödinger cat state, we study the conditions of generating the Fock states and the maximal success probability. The maximal success probability in our scheme is larger than the previous one.

The ability to distill quantum coherence is pivotal for optimizing the performance of quantum technologies; however, such a task cannot always be accomplished with certainty. Here we develop a general framework of probabilistic distillation of quantum coherence in a one-shot setting, establishing fundamental limitations for different classes of free operations. We first provide a geometric interpretation for the maximal success probability, showing that under maximally incoherent operations (MIO) and dephasing-covariant incoherent operations (DIO) the problem can be simplified into efficiently computable semidefinite programs. Exploiting these results, we find that DIO and its subset of strictly incoherent operations have equal power in the probabilistic distillation of coherence from pure input states, while MIO are strictly stronger. We then prove a fundamental no-go result: Distilling coherence from any full-rank state is impossible even probabilistically. We further find that in some conditions the maximal success probability can vanish suddenly beyond a certain threshold in the distillation fidelity. Finally, we consider probabilistic coherence distillation assisted by a catalyst and demonstrate, with specific examples, its superiority to the unassisted and deterministic cases.

We introduce counter-cryptanalysis as a new paradigm for strengthening weak cryptographic primitives against cryptanalytic attacks. Redesigning a weak primitive to more strongly resist cryptanalytic techniques will unavoidably break backwards compatibility. Instead, counter-cryptanalysis exploits unavoidable anomalies introduced by cryptanalytic attacks to detect and block cryptanalytic attacks while maintaining full backwards compatibility. Counter-cryptanalysis in principle enables the continued secure use of weak cryptographic primitives.Furthermore, we present the first example of counter-cryptanalysis, namely the efficient detection whether any given single message has been constructed – together with an unknown sibling message – using a cryptanalytic collision attack on MD5 or SHA-1.An immediate application is in digital signature verification software to ensure that an (older) MD5 or SHA-1 based digital signature is not a forgery using a collision attack. This would certainly be desirable for two reasons. Firstly, it might still be possible to generate malicious forgeries using collision attacks as too many parties still sign using MD5 (or SHA-1) based signature schemes. Secondly, any such forgeries are currently accepted nearly everywhere due to the ubiquitous support of MD5 and SHA-1 based signature schemes. Despite the academic push to use more secure hash functions over the last decade, these two real-world arguments (arguably) will remain valid for many more years.Only due to counter-cryptanalysis were we able to discover that Flame, a highly advanced malware for cyberwarfare uncovered in May 2012, employed an as of yet unknown variant of our chosen-prefix collision attack on MD5 [SLdW07, SSA+09]. In this paper we disect the revealed cryptanalytic details and work towards the reconstruction of the algorithms underlying Flame’s new variant attack. Finally, we make a preliminary comparision between Flame’s attack and our chosen-prefix collision attack.KeywordsHash FunctionCompression FunctionDisturbance VectorMessage BlockCollision AttackThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

We present some different hyperentanglement concentration protocols (hyper-ECPs) for nonlocal N-photon systems in partially polarization-spatial hyperentangled states with known parameters, resorting to linear optical elements only, including those for hyperentangled Greenberger---Horne---Zeilinger-class states and the ones for hyperentangled cluster-class states. Our hyper-ECPs have some interesting features. First, they require only one copy of nonlocal N-photon systems and do not resort to ancillary photons. Second, they work with linear optical elements, neither Bell-state measurement nor two-qubit entangling gates. Third, they have the maximal success probability with only a round of entanglement concentration, not repeating the concentration process some times. Fourth, they resort to some polarizing beam splitters and wave plates, not unbalanced beam splitters, which make them more convenient in experiment.

We propose an optimal entanglement concentration protocol (ECP) for nonlocal \(N\)-electron systems in a partially entangled Greenberger–Horne–Zeilinger (GHZ) pure state, resorting to charge detection and the projection measurement on an additional electron. For each nonlocal \(N\)-electron system in a partially entangled GHZ state, one party in quantum communication, say Alice first entangles it with an additional electron, and then, she projects the additional electron into an orthogonal basis for dividing the \(N\)-electron systems into two groups. In the first group, the \(N\) parties obtain a subset of \(N\)-electron systems in a maximally entangled state directly. In the second group, they obtain some less-entangled \(N\)-electron systems which are the resource for the entanglement concentration in the next round. By iterating the entanglement concentration process several times, the present ECP has the maximal success probability, the theoretical limit of an ECP as it just equals to the entanglement of the partially entangled state, far higher than others. Moreover, this ECP for an \(N\)-electron GHZ-type state requires only one additional electron, not two or more, and it does not resort to a collective unitary evolution, far different from others, which may decrease the difficulty for its implementation in experiment. When it is used for an \(N\)-electron W-type state, \(N-1\) additional electrons are required only.

We propose an optimal nonlocal entanglement concentration protocol (ECP) for\nmulti-photon systems in a partially entangled pure state, resorting to the\nprojection measurement on an additional photon. One party in quantum\ncommunication first performs a parity-check measurement on her photon in an\nN-photon system and an additional photon, and then she projects the additional\nphoton into an orthogonal Hilbert space for dividing the original $N$-photon\nsystems into two groups. In the first group, the N parties will obtain a subset\nof $N$-photon systems in a maximally entangled state. In the second group, they\nwill obtain some less-entangled N-photon systems which are the resource for the\nentanglement concentration in the next round. By iterating the entanglement\nconcentration process several times, the present ECP has the maximal success\nprobability which is just equivalent to the entanglement of the partially\nentangled state. That is, this ECP is an optimal one.\n

Hyperentanglement has attracted much attention due to its fascinating applications in quantum communication. However, it is impossible to purify a pair of photon systems in a mixed hyperentangled state with errors in two degrees of freedom using linear optical elements only, far different from all the existing entanglement purification protocols in a degree of freedom (DOF) for quantum systems. Here, we investigate the possibility of purifying a spatial-polarization mixed hyperentangled Bell state with the errors in both the spatial-mode and polarization DOFs, resorting to the nonlinear optics of a nitrogen-vacancy (NV) center in a diamond embedded in a photonic crystal cavity coupled to a waveguide. We present the first hyperentanglement purification protocol for purifying a pair of two-photon systems in a mixed hyperentangled Bell state with the errors in two DOFs. We also propose an efficient hyperentanglement concentration protocol for a partially hyperentangled Bell pure state, which has the maximal success probability in principle. These two protocols are useful in long-distance quantum communication with hyperentanglement.

We report on theoretical research in photonic cluster-state computing. Finding optimal schemes of generating non-classical photonic states is of critical importance for this field as physically implementable photon–photon entangling operations are currently limited to measurement-assisted stochastic transformations. A critical parameter for assessing the efficiency of such transformations is the success probability of a desired measurement outcome. At present there are several experimental groups that are capable of generating multi-photon cluster states carrying more than eight qubits. Separate photonic qubits or small clusters can be fused into a single cluster state by a probabilistic optical CZ gate conditioned on simultaneous detection of all photons with 1/9 success probability for each gate. This design mechanically follows the original theoretical scheme of cluster state generation proposed more than a decade ago by Raussendorf, Browne and Briegel. The optimality of the destructive CZ gate in application to linear optical cluster state generation has not been analyzed previously. Our results reveal that this method is far from the optimal one. Employing numerical optimization we have identified that the maximal success probability of fusing n unentangled dual-rail optical qubits into a linear cluster state is equal to an m-tuple of photonic Bell pair states, commonly generated via spontaneous parametric down-conversion, can be fused into a single cluster with the maximal success probability of (1/4)m−1.

Vehicle flight readiness review - A technique for assuring maximum probability of mission success

In this work, the authors propose a novel technique to extend the scope of cognitive radio (CR) networks to multiple source–destination pairs. To accomplish this, a simplified feasible path set is formed and then three types of criteria or methods are employed to reach a solution for the best path for each pair. This set is defined by non‐intersecting paths which do not share any relay nodes. This not only solves the problem at hand but also greatly reduces the complexity which leads to a fast solution. The first method uses the maximum probability of success as a means for selecting the best path. In the second method, a fast and simple technique is used by choosing the minimum number of overall hops for path selection. The element with the minimum overall transmission time is selected for data transmission in the third technique. Finally, the proposed methods are compared through simulation to a unicast single user case in terms of throughput and packet delivery rate. The simulation results show that the first method has the best performance while the second method is slightly worse but faster.

We study the security of AES in the open-key setting by showing an analysis on hash function modes instantiating AES including Davies-Meyer, Matyas-Meyer-Oseas, and Miyaguchi-Preneel modes. In particular, we propose preimage attacks on these constructions, while most of previous work focused their attention on collision attacks or distinguishers using non-ideal differential properties. This research is based on the motivation that we should evaluate classical and important security notions for hash functions and avoid complicated attack models that seem to have little relevance in practice. We apply a recently developed meet-in-the-middle preimage approach. As a result, we obtain a preimage attack on 7 rounds of Davies-Meyer AES and a second preimage attack on 7 rounds of Matyas-Meyer-Oseas and Miyaguchi-Preneel AES. Considering that the previous best collision attack only can work up to 6 rounds, the number of attacked rounds reaches the best in terms of the classical security notions. In our attacks, the key is regarded as a known constant, and the attacks thus can work for any key length in common.KeywordsAEShash functionDavies-MeyerMatyas-Meyer-OseasMiyaguchi-PreneelPGVpreimagemeet-in-the-middleWhirlpool