Results 1 
8 of
8
On the statistical properties of Diffie–Hellman distributions
 MR 2001k:11258 Zbl 0997.11066
"... Let p be a large prime such that p−1 has some large prime factors, and let ϑ ∈ Z ∗ p be an rth power residue for all small factors of p − 1. The corresponding DiffieHellman (DH) distribution is (ϑ x, ϑ y, ϑ xy) where x, y are randomly chosen from Z ∗ p. A recently formulated assumption is that giv ..."
Abstract

Cited by 29 (10 self)
 Add to MetaCart
Let p be a large prime such that p−1 has some large prime factors, and let ϑ ∈ Z ∗ p be an rth power residue for all small factors of p − 1. The corresponding DiffieHellman (DH) distribution is (ϑ x, ϑ y, ϑ xy) where x, y are randomly chosen from Z ∗ p. A recently formulated assumption is that given p, ϑ of the above form it is infeasible to distinguish in reasonable time between DH distribution and triples of numbers chosen
Character Sums With Exponential Functions
, 2000
"... Let # be an integer of multiplicative order t # 1 modulo a prime p. We introduce and estimate sums of the form S Z (p, t, a) = T X s=1 exp (2#ia# zs /p) with a sequence Z = (z 1 , . . . , z T ) such that kz 1 , . . . , kz T is a permutation of z 1 , . . . , z T , both sequences taken mo ..."
Abstract

Cited by 5 (5 self)
 Add to MetaCart
Let # be an integer of multiplicative order t # 1 modulo a prime p. We introduce and estimate sums of the form S Z (p, t, a) = T X s=1 exp (2#ia# zs /p) with a sequence Z = (z 1 , . . . , z T ) such that kz 1 , . . . , kz T is a permutation of z 1 , . . . , z T , both sequences taken modulo t, for su#ciently many distinct modulo t values of k. Such sequences include # x n for x = 1, . . . , t with an integer n # 1; # x n for x = 1, . . . , t and gcd(x, t) = 1 with an integer n # 1; # e x for x = 1, . . . , T with an integer e, where T is the period of the sequence e x modulo t. Some of our results can be extended to composite moduli and to sums of multiplicative characters as well. Character sums with the above sequences have some cryptographic motivation and applications and have been considered in several papers by J. B. Friedlander, D. Lieman and I. E. Shparlinski. In particular we generalize and improve several previous bounds. 1 Introduction In thi...
On the multidimensional distribution of inversive congruential pseudorandom numbers in parts of the period
 Math. Comp
, 2000
"... Abstract. The inversive congruential method is an attractive alternative to the classical linear congruential method for pseudorandom number generation. In this paper we present the first nontrivial bounds on the discrepancy of individual sequences of inversive congruential pseudorandom numbers in p ..."
Abstract

Cited by 3 (2 self)
 Add to MetaCart
Abstract. The inversive congruential method is an attractive alternative to the classical linear congruential method for pseudorandom number generation. In this paper we present the first nontrivial bounds on the discrepancy of individual sequences of inversive congruential pseudorandom numbers in parts of the period. The proof is based on a new bound for certain incomplete exponential sums. 1.
On the uniformity of distribution of the RSA pairs
 Math. Comp
"... Abstract. Let m = pl be a product of two distinct primes p and l. Weshow that for almost all exponents e with gcd(e, ϕ(m)) = 1 the RSA pairs (x, xe) are uniformly distributed modulo m when x runs through • the group of units Z ∗ m modulo m (that is, as in the classical RSA scheme); • the set of kp ..."
Abstract

Cited by 2 (1 self)
 Add to MetaCart
Abstract. Let m = pl be a product of two distinct primes p and l. Weshow that for almost all exponents e with gcd(e, ϕ(m)) = 1 the RSA pairs (x, xe) are uniformly distributed modulo m when x runs through • the group of units Z ∗ m modulo m (that is, as in the classical RSA scheme); • the set of kproducts x = ai1 ···ai, 1 ≤ i1 < ·· · < ik ≤ n, where k a1, ·· ·,an ∈ Z ∗ m are selected at random (that is, as in the recently introduced RSA scheme with precomputation). These results are based on some new bounds of exponential sums. 1.
On the Uniformity of Distribution of the ElGamal Signature
 Appl. Algebra in Engin., Commun. and Computing
, 2000
"... We show that, under some natural conditions, the pairs (r, s) produced by the ElGamal signature scheme are uniformly distributed. In particular this implies that values of r and s are not correlated. The results is based on some news estimates of exponential sums. Keywords: ElGamal signature scheme, ..."
Abstract

Cited by 1 (1 self)
 Add to MetaCart
We show that, under some natural conditions, the pairs (r, s) produced by the ElGamal signature scheme are uniformly distributed. In particular this implies that values of r and s are not correlated. The results is based on some news estimates of exponential sums. Keywords: ElGamal signature scheme, Exponential sums, Uniform distribution Running header: Distribution of the ElGamal Signature 1 1 Introduction Let p # 3 be a prime and let g be a primitive root modulo p, that is, gcd(g, p) = 1 and g k ## 1 (mod p), k = 1, . . . , p  2. For an integer m # 2 we also denote by ZZ m the set of integers k # [0, m 1] and by ZZ # m the subset of ZZ # m consisting the integers k with gcd(k, m) = 1. The ElGamal signature scheme, can be described in the following way. Let M be a finite set of messages to be signed and let h : M# ZZ p1 be an arbitrary function, usually called a hashfunction. We assume that the primitive root g is publicly known. For an integer k we define the...
On The Distribution Of The DiffieHellman Pairs
, 1999
"... Let IF p be a prime field of p elements and let g be an element of IF p of multiplicative order t modulo p. We show that for any " ? 0 and t p 1=3+" the DiffieHellman pairs (x; g x ) are uniformly distributed in the Descartes product ZZ t \Theta IF p , where x runs through ffi the residue ..."
Abstract

Cited by 1 (0 self)
 Add to MetaCart
Let IF p be a prime field of p elements and let g be an element of IF p of multiplicative order t modulo p. We show that for any " ? 0 and t p 1=3+" the DiffieHellman pairs (x; g x ) are uniformly distributed in the Descartes product ZZ t \Theta IF p , where x runs through ffi the residue ring ZZ t modulo t (that is, as in the classical DiffieHellman scheme); ffi the all ksums x = a i 1 + : : : + a i k , 1 i 1 ! : : : ! i k n, where a 1 ; : : : ; a n 2 ZZ t are selected at random (that is, as in the recently introduced DiffieHellman scheme with precomputation). These results are new and nontrivial even if t = p \Gamma 1, that is, if g is a primitive root. The method based on some bounds of exponential sums. Key words and phrases: DiffieHellman cryptosystem, Uniform distribution, Precomputation, Exponential sums Address for correspondence: Igor Shparlinski, Department of Computing, Macquarie University, North Ryde, NSW 2109, Australia FAX: [61  2] 98509551 Email: i...
On the linear complexity profile of the power generator
 IEEE Trans. Inf. Theory
, 1998
"... Abstract We obtain a lower bound on the linear complexity profile of the power generator of pseudorandom numbers modulo a Blum integer. A different method is also proposed to estimate the linear complexity profile of the BlumBlumShub generator. In particular, these results imply that lattice redu ..."
Abstract

Cited by 1 (0 self)
 Add to MetaCart
Abstract We obtain a lower bound on the linear complexity profile of the power generator of pseudorandom numbers modulo a Blum integer. A different method is also proposed to estimate the linear complexity profile of the BlumBlumShub generator. In particular, these results imply that lattice reduction attacks on such generators are not feasible.
Some Doubly Exponential Sums over ...
"... Let # # ZZ m , gcd(#, m) = 1 and suppose that # has multiplicative order t. We show that provided t # m 19/20+# the triples (# x , # y , # xy ), x, y = 1, . . . , t, are uniformly distributed modulo m. This is based on the upper bounds t X x,y=1 exp ..."
Abstract
 Add to MetaCart
Let # # ZZ m , gcd(#, m) = 1 and suppose that # has multiplicative order t. We show that provided t # m 19/20+# the triples (# x , # y , # xy ), x, y = 1, . . . , t, are uniformly distributed modulo m. This is based on the upper bounds t X x,y=1 exp