To save content items to your account,
please confirm that you agree to abide by our usage policies.
If this is the first time you use this feature, you will be asked to authorise Cambridge Core to connect with your account.
Find out more about saving content to .
To save content items to your Kindle, first ensure no-reply@cambridge.org
is added to your Approved Personal Document E-mail List under your Personal Document Settings
on the Manage Your Content and Devices page of your Amazon account. Then enter the ‘name’ part
of your Kindle email address below.
Find out more about saving to your Kindle.
Note you can select to save to either the @free.kindle.com or @kindle.com variations.
‘@free.kindle.com’ emails are free but can only be saved to your device when it is connected to wi-fi.
‘@kindle.com’ emails can be delivered even when you are not connected to wi-fi, but note that service fees apply.
Up to the 1970s, Cryptography was understood as the art of building encryption schemes, that is, the art of constructing schemes allowing secret data exchange over insecure channels. Since the 1970s, other tasks (e.g., signature schemes) have been recognized as falling within the domain of Cryptography (and even being at least as central to Cryptography). Yet the construction of encryption schemes remains, and is likely to remain, a central enterprise of Cryptography.
In this chapter we review the well–known notions of private–key and public–key encryption schemes. More importantly, we define what is meant by saying that such schemes are secure. This definitional treatment is a cornerstone of the entire area, and much of this chapter is devoted to various aspects of it. We also present several constructions of secure (private–key and public–key) encryption schemes. It turns out that using randomness during the encryption process (i.e., not only at the key–generation phase) is essential to security.
Organization. Our main treatment (i.e., Sections 5.1–5.3) refers to security under “passive” (eavesdropping) attacks. In contrast, in Section 5.4, we discuss notions of security under active attacks, culminating in robustness against chosen ciphertext attacks. Additional issues are discussed in Section 5.5.
Teaching Tip. We suggest to focus on the basic definitional treatment (i.e., Sections 5.1 and 5.2.1 – 5.2.4) and on the the feasibility of satisfying these definitions (as demonstarted by the simplest constructions provided in Sections 5.3.3 and 5.3.4.1). The overview to security under active attacks (i.e., Section 5.4.1) is also recommended.
The design of secure protocols that implement arbitrarily desired functionalities is a major part of modern cryptography. Taking the opposite perspective, the design of any cryptographic scheme may be viewed as the design of a secure protocol for implementing a suitable functionality. Still, we believe that it makes sense to differentiate between basic cryptographic primitives (which involve little interaction) like encryption and signature schemes, on the one hand, and general cryptographic protocols, on the other hand.
In this chapter we consider general results concerning secure multi–party computations, where the two–party case is an important special case. In a nutshell, these results assert that one can construct protocols for securely computing any desirable multi–party functionality (see the following terminology). Indeed, what is striking about these results is their generality, and we believe that the wonder is not diminished by the (various alternative) conditions under which these results hold.
Our focus on the general study of secure multi–party computation (rather than on protocols for solving specific problems) is natural in the context of the theoretical treatment of the subject matter. We wish to highlight the importance of this general study to practice. Firstly, this study clarifies fundamental issues regarding security in a multi–party environment. Secondly, it draws the lines between what is possible in principle and what is not. Thirdly, it develops general techniques for designing secure protocols. And last, sometimes it may even yield schemes (or modules) that may be incorporated in practical systems.
It is possible to build a cabin with no foundations, but not a lasting building.
Eng. Isidor Goldreich (1906–1995)
Cryptography is concerned with the construction of schemes that withstand any abuse. Such schemes are constructed so as to maintain a desired functionality, even under malicious attempts aimed at making them deviate from their prescribed functionality.
The design of cryptographic schemes is a very difficult task. One cannot rely on intuitions regarding the typical state of the environment in which the system operates. For sure, the adversary attacking the system will try to manipulate the environment into untypical states. Nor can one be content with countermeasures designed to withstand specific attacks because the adversary (which acts after the design of the system is completed) will try to attack the schemes in ways that are typically different from the ones envisioned by the designer. The validity of the foregoing assertions seems self–evident; still, some people hope that in practice, ignoring these tautologies will not result in actual damage. Experience shows that these hopes rarely come true; cryptographic schemes based on make–believe are broken, typically sooner than later.
In view of these assertions, we believe that it makes little sense to make assumptions regarding the specific strategy that the adversary may use. The only assumptions that can be justified refer to the computational abilities of the adversary.
Let graph $G=(V,E)$ and integer $b\geq 1$ be given. A set $S\subseteq V$ is said to be $b$-independent if $u,v\in S$ implies $d_G(u,v)>b$, where $d_G(u,v)$ is the shortest distance between $u$ and $v$ in $G$. The $b$-independence number $\a_b(G)$ is the size of the largest $b$-independent subset of $G$. When $b=1$ this reduces to the standard definition of independence number.
We study this parameter in relation to the random graph $G_{n,p},\,p=d/n$, in particular, when $d$ is a large constant. We show that w.h.p. if $d\geq d_{\epsilon, b}$, $$ \left| \alpha_b(G_{n,p}) - \frac{2bn}{d^b} \biggl(\log{d} - \frac{\log{\log{d}}}{b} - \frac{\log{2b}}{b} + \frac{1}{b}\biggr)\right| \leq \frac{\epsilon n}{d^b}.$$
Improving an old result of Clarkson, Edelsbrunner, Guibas, Sharir and Welzl, we show that the number of distinct distances determined by a set $P$ of $n$ points in three-dimensional space is $\Omega(n^{77/141-\varepsilon})=\Omega(n^{0.546})$, for any $\varepsilon>0$. Moreover, there always exists a point $p\in P$ from which there are at least so many distinct distances to the remaining elements of $P$. The same result holds for points on the three-dimensional sphere. As a consequence, we obtain analogous results in higher dimensions.
We show that for every $\varepsilon\,{>}\,0$ there exists an $r_0\,{=}\,r_0(\varepsilon)$ such that, for all integers $r\,{\ge}\, r_0$, every graph of average degree at least $r+\varepsilon$ and girth at least 1000 contains a subdivision of $K_{r+2}$. Combined with a result of Mader this implies that, for every $\varepsilon\,{>}\,0$, there exists an $f(\varepsilon)$ such that, for all $r\,{\ge}\, 2$, every graph of average degree at least $r+\varepsilon$ and girth at least $f(\varepsilon)$ contains a subdivision of $K_{r+2}$. We also prove a more general result concerning subdivisions of arbitrary graphs.
Using representation theory, we obtain a necessary and sufficient condition for a discrete-time Markov chain on a finite state space $E$ to be representable as $$\Psi_n \Psi_{n-1} \cdots \Psi_1 z,\quad n \geq 0,$$ for any $z \in E$, where the $\Psi_i$ are independent, identically distributed random permutations taking values in some given transitive group of permutations on $E$. The condition is particularly simple when the group is 2-transitive on $E$. We also work out the explicit form of our condition for the dihedral group of symmetries of a regular polygon.
What simple condition on a graph $G$ will ensure that $G\,{\succ}\,K_t$? As usual, $G\,{\succ}\,K_t$ means that $K_t$ is a minor of the graph $G$ (in other words, $G$ has vertex disjoint connected subgraphs $W_1,\ldots,W_t$ and at least one edge between $W_i$ and $W_j$, $1\,{\le}\, i<j\,{\le}\, t$).
We compute the fat-shattering function and the level fat-shattering function for important classes of affine functions. We observe that the level fat-shattering function and the fat-shattering function are identical for these classes. In addition we observe that the notion that adding the constant term to linear functions increases the dimension by at most 1 is incorrect for fat-shattering and level fat-shattering.
In this paper we prove several point selection theorems concerning objects ‘spanned’ by a finite set of points. For example, we show that for any set $P$ of $n$ points in $\R^2$ and any set $C$ of $m \,{\geq}\, 4n$ distinct pseudo-circles, each passing through a distinct pair of points of $P$, there is a point in $P$ that is covered by (i.e., lies in the interior of) $\Omega(m^2/n^2)$ pseudo-circles of $C$. Similar problems involving point sets in higher dimensions are also studied.
Most of our bounds are asymptotically tight, and they improve and generalize results of Chazelle, Edelsbrunner, Guibas, Hershberger, Seidel and Sharir [8], where weaker bounds for some of these cases were obtained.
We give results on the strong connectivity for spaces of sparse random digraphs specified by degree sequence. A full characterization is provided, in probability, of the fan-in and fan-out of all vertices including the number of vertices with small ($o(n)$) and large ($cn$) fan-in or fan-out. We also give the size of the giant strongly connected component, if any, and the structure of the bow-tie digraph induced by the vertices with large fan-in or fan-out. Our results follow a direct analogy of the extinction probabilities of classical branching processes.
We look at a model of random graphs suggested by Gilbert: given an integer $n$ and $\delta > 0$, scatter $n$ vertices independently and uniformly on a metric space, and then add edges connecting pairs of vertices of distance less than $\delta$ apart.
We consider the asymptotics when the metric space is the interval [0, 1], and $\delta = \delta(n)$ is a function of $n$, for $n \to \infty$. We prove that every upwards closed property of (ordered) graphs has at least a weak threshold in this model on this metric space. (But we do find a metric space on which some upwards closed properties do not even have weak thresholds in this model.) We also prove that every upwards closed property with a threshold much above connectivity's threshold has a strong threshold. (But we also find a sequence of upwards closed properties with lower thresholds that are strictly weak.)
How ‘tightly’ can we pack a given number of $r$-sets of an $n$-set? To be a little more precise, let $X=[n]=\{ 1,\ldots,n \}$, and let $X^r=\{ A\subset X : |A|=r \}$. For a set system $\mathcal{A}\subset X^r $, the neighbourhood of $\mathcal{A}$ is $N(\mathcal{A})=\{ B \in X^r: |B \bigtriangleup A|\le 2 \hbox{ for some }A \in \mathcal{A} \}$. In other words, $N(\mathcal{A})$ consists of those $r$-sets that are either in $\mathcal{A}$ or are ‘adjacent’ to it, in the sense that they are at minimal Hamming distance (i.e., distance 2) from some point of it. Given $|\mathcal{A}|$, how small can $|N(\mathcal{A})|$ be?
Sampling formulas describe probability laws of exchangeable combinatorial structures like partitions and compositions. We give a brief account of two known parametric families of sampling formulas for compositions and add a new family to the list.
We give a quantitative proof that, for sufficiently large $N$, every subset of $[N]^2$ of size at least $\delta N^2$ contains a square, i.e., four points with coordinates $\{(a,b),(a+d,b),(a,b+d),(a+d,b+d)\}$.
Baranyai's partition theorem states that the edges of the complete $r$-graph on $n$ vertices can be partitioned into $1$-factors provided that $r$ divides $n$. Fon-der-Flaass has conjectured that for $r=3$ such a partitioning exists with the property that any two $1$-factors are ‘far apart’ in some natural sense.
Our aim in this note is to prove that the Fon-der-Flaass conjecture is not always true: it fails for $n=12$. Our methods are based on some new ‘auxiliary’ hypergraphs.
Given a set $L$ of $n$ lines in ${\mathbb R}^3$, joints are points in ${\mathbb R}^3$ that are incident to at least three non-coplanar lines in $L$. We show that there are at most $O(n^{5/3})$ incidences between $L$ and the set of its joints.
This result leads to related questions about incidences between $L$ and a set $P$ of $m$ points in ${\mathbb R}^3$. First, we associate with every point $p \in P$ the minimum number of planes it takes to cover all lines incident to $p$. Then the sum of these numbers is at most \[ O\big(m^{4/7}n^{5/7}+m+n\big).\] Second, if each line forms a fixed given non-zero angle with the $xy$-plane – we say the lines are equally inclined – then the number of (real) incidences is at most \[ O\big(\min\big\{m^{3/4}n^{1/2}\kappa(m),\ m^{4/7}n^{5/7}\big\} + m + n\big) , \] where $\kappa(m) \,{=}\, (\log m)^{O(\alpha^2(m))}$, and $\alpha(m)$ is the slowly growing inverse Ackermann function. These bounds are smaller than the tight Szemerédi–Trotter bound for point–line incidences in $\reals^2$, unless both bounds are linear. They are the first results of this type on incidences between points and $1$-dimensional objects in $\reals^3$. This research was stimulated by a question raised by G. Elekes.
I show that the zeros of the chromatic polynomials $P_G(q)$ for the generalized theta graphs $\Theta^{(s,p)}$ are, taken together, dense in the whole complex plane with the possible exception of the disc $|q-1| < 1$. The same holds for their dichromatic polynomials (alias Tutte polynomials, alias Potts-model partition functions) $Z_G(q,v)$ outside the disc $|q+v| < |v|$. An immediate corollary is that the chromatic roots of not-necessarily-planar graphs are dense in the whole complex plane. The main technical tool in the proof of these results is the Beraha–Kahane–Weiss theorem on the limit sets of zeros for certain sequences of analytic functions, for which I give a new and simpler proof.