Abstract: One of Needham and Schroeder's proposed signature authentication protocols is shown to fail when there is a possibility of compromised keys: this invalidates one of the applications of their technique. A more elaborate mechanism is proposed which does not require a network clock, but does require a third party to the transaction. The latter approach is shown to be reliable in a fairly strong sense.

Abstract: A set of required security criteria is developed which assures that the personal verification processes at different institutions in an interchange environment are isolated from one another. It is assumed that only information stored on the bank card and information remembered by a systerm user are employed for personal verification. Under that assumption, it is shown that only through the use of a secret quantity (a personal cryptographic key) stored on the bank card will the set of required criteria be satisfied. With a personal key, the same degree of isolation can be achieved for authentication of transaction request messages sent from the entry point to the issuer. However, authentication of transaction response messages sent from the issuer to the entry point requires a system key unknoun to the user.

Abstract: The problem of computer security can be considered to consist of four distinct components: secrecy (ensuring that information is only disclosed to authorized users), authentication (ensuring that information is not forged), integrity (ensuring that information is not destroyed), and availability (ensuring that access to information can not be maliciously interrupted).The paper describes a new protection mechanism called cryptographic sealing that provides primitives for secrecy and authentication. The mechanism is enforced with a synthesis of classical cryptography, public-key cryptography, and a threshold scheme.