Many protocols and experiments in quantum information science are described in terms of simple measurements on qubits. However, in an experimental implementation, the exact description of the measurement is usually more complicated. If there is a claim made from the results of an experiment by using the simplified measurement description, then do the claims still hold when the more realistic description is taken into account? We present a "squashing" model that decomposes the realistic measurement description into first a map, followed by a simplified measurement. The squashing model then provides a connection between a realistic measurement and an ideal measurement. If the squashing model exists for a given measurement, then all claims made about a measurement using the simplified description also apply to the complicated one. We give necessary and sufficient conditions to determine when this model exists. We show how it can be applied to quantum key distribution, entanglement verification, and other quantum communication protocols. We also consider several examples of detectors commonly used in quantum communication to determine if they have squashing models.

With the remarkable progress in microelectronics and low-power semiconductor technologies, Radio Frequency IDentification technology (RFID) has moved from obscurity into mainstream applications, which essentially provides an indispensable foundation to realize ubiquitous computing and machine perception. However, the catching and exclusive characteristics of RFID systems introduce growing security and privacy concerns. To address these issues are particularly challenging for low-cost RFID systems, where tags are extremely constrained in resources, power and cost. The primary reasons are: (1) the security requirements of low-cost RFID systems are even more rigorous due to large operation range and mass deployment; and (2) the passive tags' modest capabilities and the necessity to keep their prices low present a novel problem that goes beyond the well-studied problems of traditional cryptography. This thesis presents our research results on the design and the analysis of security schemes for low-cost RFID systems. Motivated by the recent attention on exploiting physical layer resources in the design of security schemes, we investigate how to solve the eavesdropping, modification and one particular type of relay attacks toward the tag-to-reader communication in passive RFID systems without requiring lightweight ciphers. To this end, we propose a novel physical layer scheme, called Backscatter modulation- and Uncoordinated frequency hopping-assisted Physical Layer Enhancement (BUPLE). The idea behind it is to use the amplitude of the carrier to transmit messages as normal, while to utilize its periodically varied frequency to hide the transmission from the eavesdropper/relayer and to exploit a random sequence modulated to the carrier's phase to defeat malicious modifications. We further improve its eavesdropping resistance through the coding in the physical layer, since BUPLE ensures that the tag-to-eavesdropper channel is strictly noisier than the tag-to-reader channel. Three practical Wiretap Channel Codes (WCCs) for passive tags are then proposed: two of them are constructed from linear error correcting codes, and the other one is constructed from a resilient vector Boolean function. The security and usability of BUPLE in conjunction with WCCs are further confirmed by our proof-of-concept implementation and testing. Eavesdropping the communication between a legitimate reader and a victim tag to obtain raw data is a basic tool for the adversary. However, given the fundamentality of eavesdropping attacks, there are limited prior work investigating its intension and extension for passive RFID systems. To this end, we firstly identified a brand-new attack, working at physical layer, against backscattered RFID communications, called unidirectional active eavesdropping, which defeats the customary impression that eavesdropping is a ``passive" attack. To launch this attack, the adversary transmits an un-modulated carrier (called blank carrier) at a certain frequency while a valid reader and a tag interacts at another frequency channel. Once the tag modulates the amplitude of reader's signal, it causes fluctuations on the blank carrier as well. By carefully examining the amplitude of the backscattered versions of the blank carrier and the reader's carrier, the adversary could intercept the ongoing reader-tag communication with either significantly lower bit error rate or from a significantly greater distance away. Our concept is demonstrated and empirically analyzed towards a popular low-cost RFID system, i.e., EPC Gen2. Although active eavesdropping in general is not trivial to be prohibited, for a particular type of active eavesdropper, namely a greedy proactive eavesdropper, we propose a simple countermeasure without introducing extra cost to current RFID systems. The needs of cryptographic primitives on constraint devices keep increasing with the growing pervasiveness of these devices. One recent design of the lightweight block cipher is Hummingbird-2. We study its cryptographic strength under a novel technique we developed, called Differential Sequence Attack (DSA), and present the first cryptanalytic result on this cipher. In particular, our full attack can be divided into two phases: preparation phase and key recovery phase. During the key recovery phase, we exploit the fact that the differential sequence for the last round of Hummingbird-2 can be retrieved by querying the full cipher, due to which, the search space of the secret key can be significantly reduced. Thus, by attacking the encryption (decryption resp.) of Hummingbird-2, our algorithm recovers 36-bit (another 28-bit resp.) out of 128-bit key with $2^{68}$ ($2^{60}$ resp.) time complexity if particular differential conditions of the internal states and of the keys at one round can be imposed. Additionally, the rest 64-bit of the key can be exhaustively searched and the overall time complexity is dominated by $2^{68}$. During the preparation phase, by investing $2^{81}$ effort in time, the adversary is able to create the differential conditions required in the key recovery phase with at least 0.5 probability. As an additional effort, we examine the cryptanalytic strength of another lightweight candidate known as A2U2, which is the most lightweight cryptographic primitive proposed so far for low-cost tags. Our chosen-plaintext-attack fully breaks this cipher by recovering its secret key with only querying the encryption twice on the victim tag and solving 32 sparse systems of linear equations (where each system has 56 unknowns and around 28 unknowns can be directly obtained without computation) in the worst case, which takes around 0.16 second on a Thinkpad T410 laptop.

In this dissertation we study the problem of making electronic voting trustworthy through the use of cryptographic end-to-end (E2E) audits. In particular, we present a series of novel proposals for cryptographic election verification with a focus on real-world practicality. We begin by outlining fundamental requirements of E2E election verification, important properties for a real-world settings, and provide a review of previous and concurrent related work. Our research results are then presented across three parts. In the first part we examine how E2E election verification can be made more procedurally familiar to real-world voters and election administrators. We propose and implement an E2E add-on for conventional optical-scan based voting systems, and highlight our experiences running an election using this system in a United States municipality. In the second part we examine how E2E election verification can be made more conceptually and procedurally simple for election verifiers/auditors. We present a non-cryptographic E2E system based on physical document security assumptions as an educational tool. We extend this system to a cryptographic setting to show how the procedures of cryptographic election verification can be completed with relatively tiny software code bases, or by using common-place programs such as a desktop spreadsheet. We then present an approach that allows verifiers to conduct cryptographic audits without having to plan for it prior to an election. In the third part we examine how the methods in the first part can be extended to provide a level of privacy/distribution of trust similar to that of classical cryptographic voting protocols, while maintaining the (comparatively) intuitive optical-scan interface. To that end, we propose a novel paradigm for secure distributed document printing that allows optical-scan ballots to be printed in a way that still lets voters check their ballots have been counted, while keeping their voting preferences secret from election officials and everyone else. Finally we outline how the results obtained in each of the three parts can be combined to create a cryptographically end-to-end verifiable voting system that simultaneously offers a conventional optical-scan ballot, ballot secrecy assured by a distribution of trust, and a simple, cryptographically austere set of audit procedures.

We study codes that have identifiable parent property. Such codes are called IPP codes. Research on IPP codes is motivated by design of schemes that protect against piracy of digital products. Construction and decoding of maximum IPP codes have been studied in rich literature. General bounds on F(n,q), the maximum size of IPP codes of length n over an alphabet with q elements, have been obtained through the use of techniques from graph theory and combinatorial design. Improved bounds on F(3,q) and F(4,q) are obtained. Probabilistic techniques are also used to prove the existence of certain IPP codes. We prove a precise formula for F(3,q), construct maximum IPP codes with size F(3,q), and give an efficient decoding algorithm for such codes. The main techniques used in this thesis are from graph theory and nonlinear optimization. Our approach may be used to improve bounds on F(2k+1, q). For example, we characterize the associated graphs of maximum IPP codes of length 5, and obtain bounds on F(5,q).

Due to resource-saving and efficiency consideration, electronic voting (e-voting) gradually replaces traditional paper-based voting in some developed countries. An anonymous e-voting system that can be used in elections with large electorates must meet various security requirements, such as anonymity, uncoercibility, tally correctness, unrecastability, verifiability, and so on. Especially, the uncoercibility property is an essential property which can greatly reduce the possibility of coercion and bribe. Since each voter can obtain one and only one voting receipt in an electronic voting system, coercers or bribers can enforce legal voters to show their voting receipts to identify whether the enforced voters follow their will or not. It turns out that the coercion and bribe will succeed more easily in digital environments than that in traditional paper-based voting. In this dissertation, we analyze four possible scenarios leading to coercion and discover that the randomization property is necessary to blind-signature-based e-voting systems against coercion. Based on this result, we extend our research and come up with two provably secure randomized blind signature schemes from different cryptographic primitives, which can be adopted as key techniques for an electronic voting system against coercion and bribery.

In the VANET environment, the security of traffic information between vehicles is very important. The messages need to be real-time, and the complexity of authentication should be low. Our proposed method focus on the identity verification based on bilinear pairing, therefore, vehicles, roadside units (RSUs), central authorities (CAs) and trust authority (TA) can verify the identity of each other. After the identity authentication, RSUs will broadcast messages containing chameleon hashing values of verified vehicles, to the other RSUs and vehicles. In the future, vehicles can communicate with the verified vehicles, and verify the messages by these chameleon hashing values. The advantages of the propose method is mainly: 1. Based on the identity-based cryptography (i.e. IBC), the vehicles, RSUs, CAs and TA can verify the message each other. 2. The vehicles can verify the source and legitimacy of the public/private key. 3. The vehicles do not need to show any certificate to verify the identity, avoiding the certificate is exposed for a long time and causing attacks. 4. We can verify the messages through chameleon function and does not need to wait for RSU to verify, it would have good latency performance. 5. We don¡¦t need to re-verify the identity and consult the common keys when the vehicles hand off within the different cover ranges of the RSUs. 6. Not only within the RSUs, our proposal but also can execute in somewhere without RSU. Finally, our proposal method can fulfill the authentication, data integrity, non-repudiation, condition-privacy and untraceable.

Vehicular ad-hoc network (VANETs) has been a hot research topic in recent years. In this environment, each vehicle can broadcast messages to other vehicles and inform drivers to change their route right away in order to enhance the efficiency of driving and to avoid accidents. Since vehicles communicate through wireless tunnel, many malicious attacks may occur during the transmission of messages. Consequently, ensuring the correctness of receiving messages and verifying the authenticity of the sender is necessary. Besides, we also need to protect the real identities of vehicles from revealing to guarantee the privacy. To satisfy these security properties, many related researches have been proposed. However, they all have some drawbacks. For example: 1. The cost of the certificate management and the exposure problem of the certificate. 2. Waiting for RSU to verify the messages: Once more vehicles need RSU, RSU will have much more overhead and it can¡¦t achieve real-time authentication. In this thesis, we come up with an anonymous authentication and key agreement scheme based on chameleon hashing and ID-based cryptography in the vehicular communication environment. In our scheme, every vehicle can generate many different chameleon hash values to represent itself, and others can prove the ownership of chameleon hash value. Furthermore, unlike other pseudonymous authentication schemes, we also achieve one-to-one private communication via ID-based cryptography. Finally, we not only overcome some problems in previous works but also fulfill some necessary security requirements in vehicular communication environment.

Due to low computation cost and convenient portability, smart cards are usually adopted to store the personal secret information of users for remote authentication. Although many remote authentication schemes using smart cards have been introduced in the literatures, they still suffer from some possible attacks or cannot guarantee the quality of performance for smart cards. In this thesis, we classify the security criteria of remote authentication and propose a new remote login scheme using smart cards to satisfy all of these criteria. Not only does the proposed scheme achieve the low computation requirement for smart cards, but it can withstand the replay and the off-line dictionary attacks as well. Moreover, our scheme requires neither any password table for verification nor clock synchronization between each user and the server while providing both mutual authentication and the uniqueness of valid cards.

Due to the growing interest in electronic commerce, more and more transactions now happen online. Thus, fair transactions between customers and merchants are getting important. To gain the fairness of the exchange of digital items, fair exchange protocols have been proposed and well studied. Most of the traditional fair exchange protocols are concerned about the exchange of digital items, such as digital signatures, contracts, and documents. Recently, researchers pay attention to the exchange of digital goods along with electronic cash, and have proposed some fair transaction protocols based on electronic cash. To buy digital contents via electronic cash through network, the anonymity property as traditional cash possesses must be guaranteed. It means that the payment information of the customer cannot be revealed to anyone else including the trusted third party (TTP) who helps the customer and the merchant with resolving possible disputes in the protocol. Since the customer and the merchant may not trust each other in an electronic transaction. In a fair exchange protocol, a TTP is employed to achieve true fairness. An on-line TTP has to take part in all transactions while they are proceeding. Despite it can gain true fairness, it is inefficient due to on-line interaction with the TTP. On the other hand, an off-line TTP does not need to join in the transaction protocol in normal cases. Instead, it participates in the protocol only when disputes happen. It is efficient and fair, and more feasible in practical situations. In this thesis, we propose a fair transaction protocol based on electronic cash. With the extended research on electronic cash, we have designed a fair transaction protocol that is suitable for any electronic cash system. By using an off-line TTP, the protocol is more efficient and practical. Furthermore, payment information of the customer cannot be known to anyone else including the TTP, and thus, the anonymity of the customer is protected completely in our protocol.

The technology of electronic cash makes it possible to transmit digital money over communication networks during electronic transactions. Owing to the untraceability and unforgeability properties, electronic cash can protect the privacy of customers and guarantee the security of payments in the transactions. This manuscript introduces an efficient electronic cash protocol where it only requires minimal storage for each customer to withdraw w dollars from the bank and spend the w dollars in a sequence of transactions. Compared with traditional electronic cash protocols, the proposed method greatly reduces not only the storage required for the customers but the communication traffic in the transactions as well. Furthermore, the computation cost of the entire protocol is lower than the traditional ones and it also achieves the customer efficiency property. It turns out that the proposed protocol is much more suitable for the storage-limited or hardware-limited environments, such as smart card computing or mobile commerce, than the traditional electronic cash protocols in a sequence of payments. In addition, we examine the security of the proposed electronic cash protocol from the customer¡¦s, the shop¡¦s, and the bank¡¦s points of view, respectively. Since the proposed protocol is based on a generic partially blind signature scheme, it can be implemented by any partially blind signature scheme as long as it is secure and user efficient.