The Twofish AES submission document contains a partial chosen-key and a related-key attack against ten rounds of Twofish without whitening, using 256-bit keys. This attack does not work; it makes use of a postulated class of weak key pairs which has the S-box keys and eight successive round keys equal, but no such pairs exist. In this report we analyze the occurrence of this kind of weak key pa...

The Fudenberg and Maskin folk theorem for discounted repeated games assumes that the set of feasible payoffs is full dimensional . We obtain the same conclusion using a weaker condition. This condition is that no pair of players has equivalent von Neumann-Morgenstern utilities over outcomes. We term this condition NEU ("non-equivalent utilities"). The condition is weak, easily interpreted, and ...

We deene a property of substructures of models of arithmetic, that of being length-initial , and show that sharply bounded formulae are absolute between a model and its length-initial submodels. We use this to prove independence results for some weak fragments of bounded arithmetic by constructing appropriate models as length-initial submodels of some given model.

In many practical situations, we are not satisfied with the accuracy of the existing measurements. There are two possible ways to improve the measurement accuracy: • first, instead of a single measurement, we can make repeated measurements; the additional information coming from these additional measurements can improve the accuracy of the result of this series of measurements; • second, we can...

In this note we show that for analytic semigroups the so-called Weiss condition of uniform boundedness of the operators Re(λ) 1/2C(λ+A)−1, Re(λ) > 0 on the complex right half plane and weak Lebesgue L2,∞–admissibility are equivalent. Moreover, we show that the weak Lebesgue norm is best possible in the sense that it is the endpoint for the ’Weiss conjecture’ within the scale of Lorentz spaces L...

• Banach-Alaoglu: compactness of polars • Variant Banach-Steinhaus/uniform boundedness • Second polars • Weak boundedness implies boundedness • Weak-to-strong differentiability The comparison of weak and strong differentiability is due to Grothendieck, although the original sources are not widely available.

An AES-like lightweight block cipher, namely Zorro, was proposed in CHES 2013. While it has a 16-byte state, it uses only 4 S-Boxes per round. This weak nonlinearity was widely criticized, insofar as it has been directly exploited in all the attacks on Zorro reported by now, including the weak key, reduced round, and even full round attacks. In this paper, using some properties discovered by Wa...

We present an invariant subspace attack on the block cipher Midori64, proposed at Asiacrypt 2015. Our analysis shows that Midori64 has a class of 232 weak keys. Under any such key, the cipher can be distinguished with only a single chosen query, and the key can be recovered in 216 time with two chosen queries. As both the distinguisher and the key recovery have very low complexities, we confirm...