Jan-Hendrik Evertse

Linear equations in variables which lie in a multiplicative group

Let K be a field of characteristic 0 and let n be a natural number. Let r be a subgroup of the multiplicative group (K*) n of finite rank r. Given a 1 ,...,a n E K* write A(a 1 ,...,a n , Γ) for the number of solutions x = (x 1 ,..., x n ) ∈ Γ of the equation a 1 x 1 +... + a n x n = 1, such that no proper subsum of a 1 x 1 + ...+ a n x n vanishes. We derive an explicit upper bound for A(a 1 ,.., a n , r) which depends only on the dimension n and on the rank r.

Demonstrating possession of a discrete logarithm without revealing it

Techniques are presented that allow A to convince B that she knows a solution to the Discrete Log Problem--i.e. that she knows an x such that ?x ? s (mod N) holds--without revealing anything about x to B. Protocols are given both for N prime and for N composite. We prove these protocols secure under a formal model which is of interest in its own right. We also show how A can convince B that two elements ? and s generate the same subgroup in ZN*, without revealing how to express either as a power of the other.

Cryptanalysis of DES with a reduced number of rounds

A blockcipher is said to have a linear factor if, for all plaintexts and keys, there is a fixed non-empty set of key bits whose simultaneous complementation leaves the exclusive-or sum of a fixed non-empty set of ciphertext bits unchanged.textabstractA blockcipher is said to have a linear factor if, for all plaintexts and keys, there is a fixed non-empty set of key bits whose simultaneous complementation leaves the exclusive-or sum of a fixed non-empty set of ciphertext bits unchanged.

Linear structures in blockciphers

A blockcipher maps each pair of plaintext and key onto a ciphertext in such a way that for every fixed key, the relationship between plaintexts and ciphertexts is one-to-one. It is assumed that plaintexts and ciphertexts belong to a message space comprising all bit-strings (sequences of zeros and ones) of a given length; keys are taken from a key space made up of aU bitstrings of a possibly Merent given length. A well-known blockcipher is the NBS Data Encryption Standard (DES) [6], whch is the iteration of sixteen essentially equal “rounds”.

The number of solutions of decomposable form equations

has only finitely many solutions. The Diophantine approximation techniques of Thue and Mahler and improvements by Siegel, Dyson, Roth and Bombieri made it possible to derive good explicit upper bounds for the number of solutions of (1.1). The best such upper bound to date, due to Bombieri [1] is 2× (12r) (Bombieri assumed that F is irreducible and r ≥ 6 which was not essential in his proof). For t = 0, i.e. |F (x, y)| = 1 in x, y ∈ Z, Bombieri and Schmidt [2] derived the upper bound constant×r which is best possible in terms of r.

Diophantine inequalities on projective varieties

then the set of solutions of (1.1) lies in the union of finitely many proper linear subspaces of P. We give an equivalent formulation on which we shall focus in this paper. Let {l0, . . . , lN} be the union of the sets {l0v, . . . , lnv} (v ∈ S). Define the map φ : P → P by y 7→ ( l0(y) : · · · : lN(y) ) . Put X := φ(P); then X is a linear subvariety of P of dimension n defined over K. Write xi = li(y) (i = 0, . . . , N), x = (x0 : · · · : xN) = φ(y). For v ∈ S, let Iv be the set of indices given by {li : i ∈ Iv} = {l0v, . . . , lnv}, put civ := djv if li = ljv and civ = 0 if i 6∈ Iv. Then (apart from some modifications in the norms and the height) we can rewrite (1.1) as

A Generalization of the Subspace Theorem With Polynomials of Higher Degree

1.1 The Subspace Theorem can be stated as follows. Let K be a number field (assumed to be contained in some given algebraic closure Open image in new window of ℚ), n a positive integer, 0 < δ ≤ 1 and S a finite set of places of K. For v ∈ S, let \( L_0^{\left( v \right)} , \ldots ,L_n^{\left( v \right)} \) be linearly independent linear forms in Open image in new window [x 0,...,x n ]. Then the set of solutions x ∈ℙn(K) of

Effective results for unit equations over finitely generated integral domains

\log \left( {\prod\limits_{v \in S} {\prod\limits_{i = 0}^n {\frac{{\left| {L_i^{\left( v \right)} \left( x \right)} \right|_v }} {{\left\| x \right\|_v }}} } } \right) \leqslant - \left( {n + 1 + \delta } \right)h\left( x \right)