… In this paper we show, that TCHo cannot be used without this construction. We present a
chosen ciphertext attack on basic TCHo that recovers the secret key after approximately d3/2 …

… mount a key recovery chosen ciphertext attack, which seemingly proves that the key recovery
… 7.2 we describe our notation and give basic definitions used throughout the paper. In Sect. …

… Inspired by fast correlation attacks on stream ciphers, we … We believe TCHo could also
fit on a passive RFID tag. … The main idea is to isolate one linear feedback shift-registers (LFSR) …

… show a key-recovery attack against … main result in this paper, we consider the problem of
finding a polynomial multiple of weight 4, which is a very relevant problem in correlation attacks …

… The trapdoor cipher TCHo has been proposed in [1] where the additive noise has been …
are basic approaches for cryptanalysis of any stream cipher: (i) the generic key recovery attacks …

It has been a real pleasure to have taken part in organizing the 12th International Conference
on Practice and Theory in Public Key Cryptography (PKC 2009). PKC 2009 was held …

… The main goal of this section is to discuss the algorithm … The trapdoor cipher TCHo has
been proposed in [66] where the … :(i) the generic key recovery attacks based on different search …

… evaluation framework [SMY09] for side-channel key recovery attacks introduced by Standaert
et al. In particular, we re-state the main proof of Chapter 9 for the masking countermeasure …

… Attacks, we can cover all possible security threats given the assumptions we have made in
on our model. Algorithm 1 gives basic pseudo-code describing how any Memoization Attack …

… Our results show that the new squaring attack allows for … of the instances used by the TCHo
cryptosystem. Secondly, we … This section introduces some basic concepts on probability …