| Foreword | p. xiii |
| Prehistory of Cryptography | p. 1 |
| Exercises | p. 1 |
| Mappings, etc. | p. 1 |
| A Simple Substitution Cryptogram | p. 4 |
| Product of Vigenere Ciphers | p. 5 |
| One-Time Pad | p. 5 |
| Latin Squares | p. 6 |
| Enigma | p. 6 |
| Solutions | p. 8 |
| Conventional Cryptography | p. 17 |
| Exercises | p. 17 |
| Weak Keys of DES | p. 17 |
| Semi-Weak Keys of DES | p. 17 |
| Complementation Property of DES | p. 17 |
| 3DES Exhaustive Search | p. 18 |
| 2DES and Two-Key 3DES | p. 18 |
| Exhaustive Search on 3DES | p. 19 |
| An Extension of DES to 128-bit Blocks | p. 20 |
| Attack Against the OFB Mode | p. 21 |
| Linear Feedback Shift Registers | p. 22 |
| Attacks on Cascade Ciphers | p. 23 |
| Attacks on Encryption Modes I | p. 24 |
| Attacks on Encryption Modes II | p. 28 |
| A Variant of A5/1 I | p. 29 |
| A Variant of A5/1 II | p. 31 |
| Memoryless Exhaustive Search | p. 32 |
| Solutions | p. 34 |
| Dedicated Conventional Cryptographic Primitives | p. 57 |
| Exercises | p. 57 |
| Collisions in CBC Mode | p. 57 |
| Collisions | p. 57 |
| Expected Number of Collisions | p. 58 |
| Multicollisions on Hash Functions | p. 58 |
| Weak Hash Function Designs | p. 60 |
| Collisions on a Modified MD5 | p. 62 |
| First Preimage on a Modified MD5 | p. 62 |
| Attacks on Yi-Lam Hash Function | p. 62 |
| MAC from Block Ciphers | p. 63 |
| CFB-MAC | p. 64 |
| Universal Hashing | p. 64 |
| Solutions | p. 66 |
| Conventional Security Analysis | p. 81 |
| Exercises | p. 81 |
| The SAFER Permutation | p. 81 |
| Linear Cryptanalysis | p. 81 |
| Differential and Linear Probabilities | p. 82 |
| Feistel Schemes | p. 82 |
| Impossible Differentials | p. 84 |
| Attacks Using Impossible Differential | p. 84 |
| Multipermutations | p. 86 |
| Orthomorphisms | p. 87 |
| Decorrelation | p. 88 |
| Decorrelation and Differential Cryptanalysis | p. 89 |
| Decorrelation of a Feistel Cipher | p. 89 |
| A Saturation Attack against IDEA | p. 89 |
| Fault Attack against a Block Cipher | p. 94 |
| Solutions | p. 97 |
| Security Protocols with Conventional Cryptography | p. 125 |
| Exercises | p. 125 |
| Flipping a Coin by Email | p. 125 |
| Woo-Lam Protocol | p. 126 |
| MicroMint I | p. 127 |
| MicroMint II | p. 127 |
| Bluetooth Pairing Protocol | p. 128 |
| UNIX Passwords | p. 128 |
| Key Enlargement | p. 128 |
| Solutions | p. 130 |
| Algorithmic Algebra | p. 135 |
| Exercises | p. 135 |
| Captain's Age | p. 135 |
| Roots in Z*[subscript 77] | p. 135 |
| When is Z*[subscript n] Cyclic? | p. 135 |
| Finite Fields and AES | p. 137 |
| A Special Discrete Logarithm | p. 138 |
| Quadratic Residues | p. 138 |
| Cubic Residues | p. 139 |
| Generating Generators for Z*[subscript p] | p. 139 |
| Elliptic Curves and Finite Fields I | p. 140 |
| Elliptic Curves and Finite Fields II | p. 141 |
| Solutions | p. 142 |
| Algorithmic Number Theory | p. 159 |
| Exercises | p. 159 |
| Rho Method and Distinguished Points | p. 159 |
| Factorization | p. 160 |
| Prime Numbers | p. 161 |
| Factoring n = p [middle dot] q | p. 161 |
| Strong Prime Numbers | p. 161 |
| Complexity of Eratosthenes Sieve | p. 161 |
| Hash Function Based on Arithmetics | p. 164 |
| Solutions | p. 165 |
| Elements of Complexity Theory | p. 175 |
| Exercises | p. 175 |
| Regular Language | p. 175 |
| Finite State Automaton | p. 175 |
| Turing Machine | p. 175 |
| Graph Colorability I | p. 176 |
| Graph Colorability II | p. 176 |
| Solutions | p. 177 |
| Public Key Cryptography | p. 181 |
| Exercises | p. 181 |
| Okamoto-Uchiyama Cryptosystem | p. 181 |
| RSA Cryptosystem | p. 182 |
| RSA for Paranoids | p. 182 |
| RSA - Common Moduli | p. 183 |
| Networked RSA | p. 183 |
| Repeated RSA Encryption | p. 184 |
| Modified Diffie-Hellman | p. 184 |
| Rabin Cryptosystem | p. 184 |
| Paillier Cryptosystem | p. 185 |
| Naccache-Stern Cryptosystem | p. 186 |
| Solutions | p. 188 |
| Digital Signatures | p. 199 |
| Exercises | p. 199 |
| Lazy DSS | p. 199 |
| DSS Security Hypothesis | p. 199 |
| DSS with Unprotected Parameters | p. 200 |
| Ong-Schnorr-Shamir Signature | p. 201 |
| Batch Verification of DSS Signatures | p. 201 |
| Ring Signatures | p. 203 |
| Solutions | p. 205 |
| Cryptographic Protocols | p. 211 |
| Exercises | p. 211 |
| Breaking the RDSA Identification Scheme | p. 211 |
| A Blind Signature Protocol for a Variant of DSA | p. 213 |
| Fiat-Shamir Signature I | p. 215 |
| Fiat-Shamir Signature II | p. 216 |
| Authenticated Diffie-Hellman Key Agreement Protocol | p. 216 |
| Conference Key Distribution System | p. 217 |
| Solutions | p. 220 |
| From Cryptography to Communication Security | p. 231 |
| Exercises | p. 231 |
| A Hybrid Cryptosystem Using RSA and DES | p. 231 |
| SSL/TLS Cryptography | p. 233 |
| Secure Shell (SSH) | p. 235 |
| Attack against RC5-CBC-PAD | p. 236 |
| Wired Equivalent Privacy (WEP) | p. 237 |
| Forging X.509 Certificates | p. 238 |
| Solutions | p. 240 |
| References | p. 249 |
| Table of Contents provided by Ingram. All Rights Reserved. |