Nyberg and Knudsen proved that the maximum average of differential probability (ADP_max) and the maximum average of linear probability (ALP_max) of Feistel cipher with over 4 rounds can be evaluated as ADP_max 2DCP²_max and ALP_max 2LCP²_max using the maximum of defferential characteristic probability (DCP_max) and the maximum of linear characteristic probability (LCP_max) per round. This paper shows ADP_max DCP²_max and ALP_max LCP²_max if the F function is a bijection and the Feistel cipher has more than 3 rounds. The results prove that Feistel ciphers are stronger against differential and linear cryptanalyses than previously thought. Combining this result with that of Luby and Rackoff, the implication is that the 3-round Feistel cipher could be used as a building block cipher for the construction of provable secure block cipher algorithm.

In estimating the vulnerability of a block cipher to differential cryptanalysis and linear cryptanalysis, we must consider the fact that the differential probability and the linear probability vary with the key. In the case of cryptosystems where the round key is XORed to the input data of each round, the difference in both types of probability with different keys is regarded as negligible. However, this is not the case with RC5. This paper makes a primary analysis of the key-dependency of linear probability of RC5. Throughout this paper we study "precise" linear probability. We find some linear approximations that have higher deviation (bias) for some keys than the "best linear approximation" claimed by Kaliski and Yin in CRYPTO'95. Using one linear approximation, we find 10 weak keys of RC5_-4/2/2 with linear probability 2^-1, 2 weak keys of RC5_-4/5/16 with linear probability 2^-2, and a weak key of RC5_-16/5/16 with linear probability 2^-15.4, while Kaliski-Yin's "best biases" are 2^-3, 2^-9, and 2^-17, respectively.

Weakness of a block cipher, which has provable immunity against linear cryptanalysis, is investigated. To this end, the round transformation used in MISTY, which is a data encryption algorithm recently proposed by M. Matsui from Mitsubishi Electric Corporation, is compared to the round transformation of DES from the point of view of pseudrandom generation. An important property of the MISTY cipher is that, in terms of theoretically provable resistance against linear and differential cryptanalysis, which are the most powerful cryptanalytic attacks known to date, it is more robust than the Data Encryption Standard or DES. This property can be attributed to the application of a new round transform in the MISTY cipher, which is obtained by changing the location of the basic round-function in a transform used in DES. Cryptograohic roles of the transform used in the MISTY cipher are the main focus of this paper. Our research reveals that when used for constructiong pseudorandom permutations, the transform employed by the MISTY cipher is inferior to the transform in DES, though the former is superior to the latter in terms of strength against linear and differential attacks. More specifically, we show that a 3-round (4-round, respectively) concatenation of transforms used in the MISTY cipher is not a pseudorandom (super pseudorandom, respectively) permutation.

Two methods of the second step of the elliptic curve method for factoring are known. One is the standard method that is similar to the second step of the p-1 method, and the other is the Brent method that is based on the "birthday paradox." In this paper, we propose a revised standard method and a revised Brent method. On an average, the revised standard method is the most efficient, the standard method is the second efficient, the revised Brent method is the third and the Brent method is the fourth. If the largest prime factor on the order of an elliptic curve is congruent to 1 modulo 3, then the revised Brent method becomes more efficient than the standard method. By applying these methods to unsolved problems in the Cunningham project, we found 18 new prime factors. The largest prime factor among them was 43-digits.

To speed up discrete-log based cryptographic schemes, we propose new methods of computing exponentiations {g^x1, g^x2, , g^xs} simultaneously in combination with precomputation. Two proposed methods, VAS-B and VSS-B, are based on an extension of vector addition chains and an extension of vector addition-subtraction chains, respectively. Analysis of these methods clarifies upper bounds for the number of multiplications required. The VAS-B requires less multiplications than previously proposed methods with the same amount of storage. The VSS-B requires less multiplications than previously proposed methods with less amount of storage. The VSS-B can suitably be applied to schemes over elliptic curves.

We review a fundamental weak point of the OSS digital signature scheme against cryptanalysis by Pollard et al., and propose a new scheme of digital signature which overcomes this defect. More specifically, instead of the ring of the rational integer, we use the ring of integral quaternions, which is a non-commutative Euclidean ring. Known attacks to OSS signature do not work our scheme due to the non-commutativity. On the other hand, this scheme causes little increase in the burden of generation and verification of digital signature for the legitimate users, with respect to the original OSS scheme.

In this paper, two new signature schemes whose security is based on both discrete logarithms and factorization are proposed to enhance the security of the OSS signature scheme. The major benefit of these new signature schemes is that the signer dose not need to know how to factor p-1, thus it is possible for every user to employ the same modulus p, where p is the modulus commonly used in the system. Furthermore, two identification schemes based on this advantage are also developed in this paper.

In this paper a new type of public-key cryptosystem, proxy cryptosystem, is studied. The proxy cryptosystem allows an original decryptor to transform its ciphertext to a ciphertext for a designated decryptor, proxy decryptor. Once the ciphertext transformation is executed, the proxy decryptor can compute a plaintext in place of the original decryptor. Such a cryptosystem is very useful when an entity has to deal with large amount of decrypting operation. The entity can actually speed-up the decrypting operation by authorizing multiple proxy decyptors. Concrete proxy cryptosystems are constructed for the ElGamal cryptosystem and the RSA cryptosystem. A straightforward construction of the proxy cryptosystem is given as follows. The original decryptor decrypts its ciphertext and re-encrypts an obtained plaintext under a designated proxy decryptor's public key. Then the designated proxy decryptor can read the plaintext. Our constructions are more efficient than such consecutive execution of decryption and re-encryption. Especially, the computational work done by the original decryptor is reduced in the proxy cryptosystems.

In this paper, we propose a practical and secure electronic voting scheme which meets the requirements of large scale general elections. This scheme involves voters, the administrator or so called the government and some scrutineers. In our scheme, a voter only has to communicate with the administrator three times and it ensures independence among voters without the need of any global computation. This scheme uses the threshold cryptosystem to guarantee the fairness among the candidate's campaign and to provide mechanism for achieving the function that any voter can make an open objection to the tally if his vote has not been published. This scheme preserves the privacy of a voter against the administrator, scrutineers, and other voters. Completeness, robustness, and verifiability of the voting process are ensured and hence no one can produce a false tally, corrupt or disrupt the election.

This paper presents a reshufflable and laziness tolerant mental card game protocol. First, our protocol can reshuffle any subset of cards. For example, some opened cards and some face down cards can be shuffled together. Next, we consider two types of honest players, currently active and currently nonactive. A player is currently nonactive if he dropped out the game or he declared "pass" and has not declared "rejoin" yet. In the proposed protocol, if more than half of the players are currently active, they can play the game. In this case, the privacy of the currently nonactive players are kept secret.

In this paper, we show an entropy-based approach to the privacy of multi-party protocols. First, we formulate the amount of leaked information by using mutual information for a two-party case. This is a better measure for some situations than the combinatorial measure known so far. Next, we apply multi-terminal information theoty to more than two parties and give the first formulation of the leaked information for more than two parties.

Lower bounds on the size of shares |V_i| which are more tight than |V_i>| |S| is the size of the secret, are known only for some graphical access structures. This paper shows lower bounds on |V_i| greater than |S| for some non-graphical access structures Γ. We first prove that if {P₁, P_i} Γ-for any P_i P^ = {P₂, , P_n} and Γ ^= 2P^ Γ is the access structure of a (k, n-1) -threshold scheme on P^, then
max_ilog|V_i>| n+k-3/n-1 log|S|
for P_i {P₁, P₂, , P_n}. Next, we show that max_ilog |V_i| 1.5log |S| holds for a wider class of access structures.

In this paper, we investigate statistical and perfect Knowledge Complexity (KC) with respect ot oracle entropy and average case oracle measures. As main results. we show the following: (1) for any k(n) 1/poly (n), if a language L has perfect KC k(n) + n^-ω(1) with respect to oracle entropy measure, then L has perfect KC k(n) with respect to oracle entropy measure (Theorem 3.1); (2) for any k(n) 1/poly(n), if a language L has perfect KC k(n) + n^-ω(1) with respect to average case oracle measure, then L has perfect KC k(n) with respect to average case oracle measure (Theorem 3.2); (3) if a language L has statistical KC k(n) ο(1) with respect to oracle entropy measure, then for any ε > 0, L has statistical KC k(n) + 1 + ε with respect to average case oracle measure (Theorem 4.1); and (4) if a language L has perfect KC k(n) ο(1) with respect to oracle entropy measure, then for any ε > 0, L has perfect KC k(n) + 2 + ε with respect to average case oracle measure (Theorem 4.2).

Checkers, self-testers, and self-correctors for a function f are powerful tools in designing programs that compute f. However, the relationships among them have not been known well. In this paper, we first show that (1) if oneway permutations exist, then there exists a language L that has a checker but does not have a self-corrector. We then introduce a novel notion of "self-improvers" that trans form a faulty program into a less faulty program, and show that (2) if a function f has a self-tester/corrector pair, then f has a self-improver. As the applications of self-improvers, we finally show that (3) if a function f has a self-tester/corrector pair, then f has a flexible self-tester and (4) if a function f has a self-tester/corrector pair, then f has self-improver that transforms a faulty program into an alomost correct program.

Recently, Yagisawa proposed a public key cryptosystem which is very similar to the modified Lu-Lee cryptosystem. The differences are the set of messages and the decryption. On the other hand, Brickell and Odlyzko showed that the modified Lu-Lee cryptosystem is completely broken in polynomial time. This paper shows that Yagisawa cryptosystem is completely broken in the same way.

In direction of arrival estimation, the locations of point sources are usually assumed to be fixed during the observation of data, which is reasonable in many cases. If the locations of the point sources are perturbed due to some reasons in a statistical way during the observed period and the signal sources are not far away from receiver array, however, direction of arrival estimation methods based on the fixed point source assumption may provide with incorrect results. In this paper, we propose a perturved-location source model. Under the model, an estimation method based on eigen-decomposition is investigated. In addition, the asymptotic distributions of the estimation errors of the parameters are obtained to show the statistical properties of the parameters are obtained to show the statistical properties of the estimation method.

For designing the underwater transmission system using directly projected audible sound by underwater loudspeaker to prevent a diving accident and/or to give a working instrucion, it is important to estimate the transmission loss for a wall not onl for pure tones but also for wideband signal such as voice and noise. In this paper, two practical methods of evaluating the underwater insulation effect for a single wall are discussed. One is a reconfirmation that the mass law which is frequently used in air still explains the transmission loss in water. Because parameters such as surface density and sound velocity in the mass law are widely changeable depending on the depth in water, much complexity is involved in preparing a theoretical curve for every parameter. So to avoid such complexity, a unified parameter Φ(=ωm cos θ/2ρc) is introduced to describe the mass law. This newly presented curve as a function of Φ is in good agreement with all rearranged experimental data for every kind of plates. The other is a proposition of new evaluating method of insulation effect of a wall for a wideband signal, using an idea of (100-α) percentage point of the noise level probability destribution, L_α. Firstly proposed method is confirmed experimentally and secondly proposed method is confirmed by a simulation experiment.

In this paper, new wavelet bases are presented. We address problems associated with the proposed matched filter in multirate systems, using an optimum receiver that maximises the SNR at the sampling instant. To satisfy the Nyquist (ISI-free transmission) and matched filter (maximum SNR at the sampling instant) criteria, the overall system filtering strategy requires to split the narrowest filter equally between transmitter and receiver. In data transmission systems a raised-cosine filter is therefore often used to bandlimit signals from which wavelet bases are derived. Sampling in multiresolution subspaces is also discussed.

This paper is concened with the design and implementation of a 2-channel, 2-dimensional filter bank using rectangular (analog/digital) and quincunx (digital/digital) sampling. The associated analog low-pass filters are separable where as the digital low-pass filters are non-separable for a minimum sampling density requirement. The digital low-pass filters are Butterworth type filters, N = 9, realized as LWDFs. They, when itterated, approximate a valid scaling function (raised-consine scaling function). The obtained system can be used to compute a discrete wavelet transform.

The present paper examines a two-dimensional (2-D) joint-process lattice estimator and its implementation for image restoration. The gradient adaptive lattice (GAL) algorithm is used to update the filter coefficients. The proposed adaptive lattice estimator can represent a wider class of 2-D FIR systems than the conventional 2-D lattice models. Furthermore, its structure possesses orthogonality between the backward prediction errors. These results in superior convergence and tracking properties versus the transversal and other 2-D adaptive lattice estimators. The validity of the proposed model for image restoration is evaluated through computer simulations. In the examples, the implementation of the proposed lattice estimator as 2-D adaptive noise cancellator (ANC) and 2-D adaptive line enhancer (ALE) is considered.

The convergence characteristics of the adaptive beamformer with the RLS algorithm are analyzed in this paper. In case of the RLS adaptive beamformer, the convergence characteristics are significantly affected by the spatial characteristics of the signals/noises in the environment. The purpose of this paper is to show how these physical parameters affect the convergence characteristics. In this paper, a typical environment where a few directional noises are accompanied by background noise is assumed, and the influence of each component of the environment is analyzed separately using rank analysis of the correlation matrix. For directional components, the convergence speed is faster for a smaller number of noise sources since the effective rank of the input correlation matrix is reduced. In the presence of background noise, the convergence speed is slowed down due to the increase of the effective rank. However, the convergence speed can be improved by controlling the initial matrix of the RLS algorithm. The latter section of this paper focuses on the physical interpretation of this initial matrix, in an attempt to elucidate the mechanism of the convergence characterisitics.

Roundoff error due to iterative computation with finite wordlength degrades the quality of decoded images in fractal image coding that employs a deterministic iterated function system. This paper presents a state-space approach to roundoff error analysis of fractal image coding for grey-scale images. The output noise variance matrix and the noise matrix are derived for the measures of error and the output noise variance is newly defined as the pixel mean of diagonal elements of the output noise matrix. A quantitative comparison of experimental roundoff error with analytical result is made for the output noise variance. The result shows that our analysis method is valid for the fractal image coding. Our analysis method is useful to design a real-time and low-cost decoding hardware with finite wordlength for fractal image coding.

For finite Volterra series systems, this paper investigates the stability of the exact model matching (EMM) control we have already presented. First, in order to analyze the stability of the EMM system, we present modified small gain theorems depending on the magnitude of the external input (s) in the cases of one input and two inputs. Next, with the help of the theorem for feedback systems with two inputs, we clarify the condition under which the control system is stable for the reference input magnitude within a certain range, and is also robust for small disturbances. The modified small gain theorems are effective for the stability analysis of the nonlinear feedback control systems which do not have affine finite gain.

In this paper we discuss the limiting behavior of the search direction of the steepest descent method in minimizing the Rayleigh quotient. This minimization problem is equivalent to finding the smallest eigenvalue of a matrix. It is shown that the search direction asymptotically alternates between two directions represented by linear combinations of two eigenvectors of the matrix. This is similar to the phenomenon in minimizing the quadratic form. We also show that these eigenvectors correspond to the largest and second-smallest eigenvalues, unlike in the case of the quadratic form.

It has been known that an N-vertex binary tree can be embedded into the path and grid with dilation O(N/logN) and O((N/logN)), respectively. This paper shows that an N-vertex binary tree with proper pathwidth at most k can be embedded into the path grid with dilation O(N/N^1/k) and O((N/N^1/2k)), respectively.

Recently two interesting conjectures on the linear complexity of binary complementary sequences of length 2ⁿN₀ were given by Karkkainen and Leppanen when those sequences are considered as periodic sequences with period 2ⁿN₀, where those sequences are constructed by successive concatenations or successive interleavings from a pair of kernel complementary sequences of length N₀. Their conjectures were derived from numerical examples and suggest that those sequences have very large linear complexities. In this paper we give the exact formula of characteristic polynomials for those complementary sequences and show that their conjectures are true.

So far, neuronal dendrites have been characterized as electrically passive cables. However, recent physiological findings have revealed complex dynamics due to active conductances distributed over dendrites. In particular, the voltage-gated calcium and calcium-activated conductances are essential for producing diverse neuronal dynamics and synaptic plasticity. In this paper, we investigate the functional significance of the dendritic calcium-activated dynamics by computer simulations. First, the dendritic calcium-activated responses are modeled in a discrete compartmental form based on the physiological findings. Second, the basic stimulus-response characteristics of the single compartment dendrite model are investigated. The model is shown to reproduce the neuronal responses qualitatively. Third, the spatio-temporal dynamics of the dendrite shafts are modeled by longitudinally connecting 10 single compartments with coupling constants which are responsible for the dendrite thickness. The thick dendrite models, corresponding to proximal dendrites, respond in a spatially cooperative manner to a localized constant or periodic current stimulation. In contrast, the highly activated compartments are forced to be localized in the neighborhood of the stimulation-site in the fine dendrite models corresponding to distal dendrites. These results suggest that dendritic activities are spatially cooperated in a site-dependent manner.

We analyze additive effects of nonlinear dynamics for conbinatorial optimization. We apply chaotic time series as noise sequence to neural networks for 10-city and 20-city traveling salesman problems and compare the performance with stochastic processes, such as Gaussian random numbers, uniform random numbers, 1/f^α noise and surrogate data sets which preserve several statistics of the original chaotic data. In result, it is shown that not only chaotic noise but also surrogates with similar autocorrelation as chaotic noise exhibit high solving abilities. It is also suggested that since temporal structure of chaotic noise characterized by autocorrelation affects abilities for combinatorial optimization problems, effects of chaotic sequence as additive noise for escaping from undesirable local minima in case of solving combinatorial optimization problems can be replaced by stochastic noise with similar autocorrelation.

When N oscillators are coupled by one resistor, we can see N-phase oscillation, because the system tends to minimize the current through the coupling resistor. Moreover, when the hard oscillators are coupled, we can see N, N - 1, , 3, 2-phase oscillation and get much more phase states. In this study, the two types of coupled oscillators networks with third and fifth-power nonlinear characteristics are proposed. One network has two-dimensional hexagonal structure and the other has two-dimensional lattice structure. In the hexagonal circuit, adjacent three oscillators are coupled by one coupling resistor. On the other hand, in the lattice circuit, four oscillators are coupled by one coupling resistor. In this paper we confirm the phenomena seen in the proposed networks by circuit experiments and numerical calculations. In the system with third-power nonlinear characteristics, we can see the phase patterns based on 3-phase oscillation in the hexagonal circuit, and based on anti-phase oscillation in lattice circuit. In the system with fifth-power nonlinear characteristics, we can see the phase patterns based on 3-phase and anti-phase oscillation in both hexagonal and lattice circuits. In particular, in these networks, we can see not only the synchronization based on 3-phase and anti-phase oscillation but the synchronization which is not based on 3-phase and anti-phase oscillation.

This paper obtains some new results about the existence, uniqueness, and global asymptotic stability of the equilibrium of a nonlinear continuous neural network, under a sufficient condition weaker than ones presented in the literature. The avobe obtained results can also imply the existing ones about avsolute stability of nonlinear continuous neural networks

Two high output-resistance CMOS current mirrors suitable for a low-voltage operation and achieving a high output-swing are presented. They incorporate a modified regulated-cascode, which employs a current-mode amplifier. The main architecture concepts and their detailed schematic examples are discussed. SPICE simulation comparison is shown and the properties of each architecture are pointed out.

This paper proposes a novel VLSI architecture capable of processing the Lempel-Ziv-based data compression algorithm very fast. The architecture is composed of five main blocks, i.e., a PE-based Match Block, a Consecutive Hit Checker, a Pointer Generator, a Length Generator, and a Code Packer. Flexibility of the PE-based structure makes it possible to adapt to various buffer sizes without any loss of speed or additional control overhead. Since it is designed as a VLSI-oriented architecture, it has simple control logic circuitry. It processes exactly one character per clock cycle and the update of a dictionary buffer is automatically done, therefore it does not require additional accumulated shift operations to prepare for the dictionary buffer. The shift operations have been major problems commonly found in most other architectures. When implemented with the currently available 0.5µm CMOS technology, it is proven by critical path analysis that the architecture can achieve over 100 mega samples (characters) per second with a clock frequency of 100 MHz. This is fast enough for real time data compression for many applications.

Hankel's asymptotic expansions are frequently used for numerical calculation of cylindrical functions of complex order. We beforehand need to estimate the precisions of the cylindrical functions calculated with Hankel's asymptotic expansions in order to use these expansions. This letter presents comparatively simple expressions for rough estimations of the errors of the cylindrical functions calculated with the asymptotic expansions, and features of the errors are discussed.

NPO-PB is the class of NP optimization problems with polynomially bounded values. In this paper we provide a new characterization for the class: That is, NPO-PB = MIN Σ₀. This result shows that quantifiers are not relevant in characterizing approximability for minimization problems, unlike maximization problems. In proving the result, we develop a generic reduction, which combines maximization and minimization problems. Based on the new characterization, several problems are shown to be NPO-PB-complete. All of these problems are shown to be hard to approximate and tighter bounds are given.

Recurrent neural networks have the potential of performing parallel computation for associative memory and optimization, which is realized by the electronic implementation of neural networks in VLSI technology. Since the time delays in real electronic implementation of neural networks are unavoidably encountered and they can cause systems to oscillate, it is thus practically important to investigate the qualitative properties of neural networks with time delays. In this paper, a class of sufficient conditions is obtained, under which neural networks are globally asymptotically stable independent of time delays.