Blockchain Papers

Rafael Pass, Abhi Shelat

No abstract is available for this record.

Matt Lepinski, Silvio Micali, Abhi Shelat

No abstract is available for this record.

Endre Bangerter, Jan Camenisch, Ueli Maurer

No abstract is available for this record.

Craig Gentry, Dávid Molnár, Zulfikar Ramzan

Abstract. Most prior designated confirmer signature schemes either prove security in the random oracle model (ROM) or use general zeroknowledge proofs for NP statements (making them impractical). By slightly modifying the definition of designated confirmer signatures, Goldwasser and Waisbard presented an approach in which the Confirm and ConfirmedSign protocols could be implemented without appealing to general zero-knowledge proofs for NP statements (their Disavow protocol still requires them). The Goldwasser-Waisbard approach could be instantiated using Cramer-Shoup, GMR, or Gennaro-Halevi-Rabin signatures. In this paper, we provide an alternate generic transformation to convert any signature scheme into a designated confirmer signature scheme, without adding random oracles. Our key technique involves the use of a signature on a commitment and a separate encryption of the random string used for commitment. By adding this “layer of indirection, ” the underlying protocols in our schemes admit efficient instantiations (i.e., we can avoid appealing to general zero-knowledge proofs for NP statements) and furthermore the performance of these protocols is not tied to the choice of underlying signature scheme. We illustrate this using the Camenisch-Shoup variation on Paillier’s cryptosystem and Pedersen commitments. The confirm protocol in our resulting scheme requires 10 modular exponentiations (compared to 320 for Goldwasser-Waisbard) and our disavow protocol requires 41 modular exponentiations (compared to using a general zero-knowledge proof for Goldwasser-Waisbard). Previous schemes use the encryption of a signature paradigm, and thus run into problems when trying to implement the confirm and disavow protocols efficiently. 1

Salil Vadhan

We prove a number of general theorems about CZK, the class of problems possessing computational zero knowledge proofs. Our results are unconditional, in contrast to most previous works on CZK which rely on the assumption that one-way functions exist. We establish several new characterizations of CZK, and use these characterizations to prove results such as: 1) Honest-verifier CZK equals general CZK. 2) Public-coin CZK equals private-coin CZK. 3) CZK is closed under union (and more generally, "monotone formula closure"). 4) CZK with imperfect completeness equals CZK with perfect completeness. 5) Any problem in CZK /spl cap/ NP can be proven in computational zero knowledge by a BPP/sup NP/ prover. 6) CZK with black-box simulators equals CZK with general, non-black-box simulators. The above equalities refer to the resulting class of problems (and do not necessarily preserve other efficiency measures such as round complexity). Our approach is to combine the conditional techniques previously used in the study of CZK with the unconditional techniques developed in the study of SZK, the class of problems possessing statistical zero knowledge proofs. To enable this combination, we prove that every problem in CZK can be decomposed into a problem in SZK together with a set of instances from which a one-way function can be constructed.

Stephen Fenner, Yong Zhang

We study two group theoretic problems, GROUP INTERSECTION and DOUBLE COSET MEMBERSHIP, in the setting of black-box groups, where DOUBLE COSET MEMBERSHIP generalizes a set of problems, including GROUP MEMBERSHIP, GROUP FACTORIZATION, and COSET INTERSECTION. No polynomial-time classical algorithms are known for these problems. We show that for solvable groups, there exist efficient quantum algorithms for GROUP INTERSECTION if one of the underlying solvable groups has a smoothly solvable commutator subgroup, and for DOUBLE COSET MEMBERSHIP if one of the underlying solvable groups is smoothly solvable. We also study the decision versions of STABILIZER and ORBIT COSET, which generalizes GROUP INTERSECTION and DOUBLE COSET MEMBERSHIP, respectively. We show that they reduce to ORBIT COSET under certain conditions. Finally, we show that DOUBLE COSET MEMBERSHIP and DOUBLE COSET NONMEMBERSHIP have zero knowledge proof systems.

Achim Thomzig, Sashko Spassov, Manuela Friedrich, Dieter Naumann · 5 authors

For the surveillance of transmissible spongiform encephalopathies (TSEs) in animals and humans, the discrimination of different TSE strains causing scrapie, BSE, or Creutzfeldt-Jakob disease constitutes a substantial challenge. We addressed this problem by Fourier transform-infrared (FT-IR) spectroscopy of pathological prion protein PrP27–30. Different isolates of hamster-adapted scrapie (263K, 22A-H, and ME7-H) and BSE (BSE-H) were passaged in Syrian hamsters. Two of these agents, 22A-H and ME7-H, caused TSEs with indistinguishable clinical symptoms, neuropathological changes, and electrophoretic mobilities and glycosylation patterns of PrP27–30. However, FT-IR spectroscopy revealed that PrP27–30 of all four isolates featured different characteristics in the secondary structure, allowing a clear distinction between the passaged TSE agents. FT-IR analysis showed that phenotypic information is mirrored in β-sheet and other secondary structure elements of PrP27–30, also in cases where immunobiochemical typing failed to detect structural differences. If the findings of this study hold true for nonexperimental TSEs in animals and humans, FT-IR characterization of PrP27–30 may provide a versatile tool for molecular strain typing without antibodies and without restrictions to specific TSEs or mammalian species. For the surveillance of transmissible spongiform encephalopathies (TSEs) in animals and humans, the discrimination of different TSE strains causing scrapie, BSE, or Creutzfeldt-Jakob disease constitutes a substantial challenge. We addressed this problem by Fourier transform-infrared (FT-IR) spectroscopy of pathological prion protein PrP27–30. Different isolates of hamster-adapted scrapie (263K, 22A-H, and ME7-H) and BSE (BSE-H) were passaged in Syrian hamsters. Two of these agents, 22A-H and ME7-H, caused TSEs with indistinguishable clinical symptoms, neuropathological changes, and electrophoretic mobilities and glycosylation patterns of PrP27–30. However, FT-IR spectroscopy revealed that PrP27–30 of all four isolates featured different characteristics in the secondary structure, allowing a clear distinction between the passaged TSE agents. FT-IR analysis showed that phenotypic information is mirrored in β-sheet and other secondary structure elements of PrP27–30, also in cases where immunobiochemical typing failed to detect structural differences. If the findings of this study hold true for nonexperimental TSEs in animals and humans, FT-IR characterization of PrP27–30 may provide a versatile tool for molecular strain typing without antibodies and without restrictions to specific TSEs or mammalian species. Transmissible spongiform encephalopathies (TSEs) 1The abbreviations used are: TSE, transmissible spongiform encephalopathy; BSE, bovine spongiform encephalopathy; FT-IR, Fourier-transform infrared; mAb, monoclonal antibody; TBS, Tris-buffered saline; BE, brain equivalents; TME, transmissible mink encephalopathy; dpi, days postinfection. such as scrapie in sheep, bovine spongiform encephalopathy (BSE) in cattle, and Creutzfeldt-Jakob disease (CJD) in humans are invariably fatal neurodegenerative disorders of the central nervous system. After the initial reports on the emergence of BSE and variant Creutzfeldt-Jakob disease, in 1986 and 1996, respectively, compelling evidence has gradually accumulated that the latter can most likely be attributed to transmissions, presumably via contaminated food, of BSE agent from cattle to man (1Bruce M.E. Will R.G. Ironside J.W. McConnell I. Drummond D. Suttie A. McCardle L. Chree A. Hope J. Birkett C. Cousens S. Fraser H. Bostock C.J. Nature. 1997; 389: 498-501Crossref PubMed Scopus (1727) Google Scholar, 2Cousens S.N. Linsell L. Smith P.G. Chandrakumar M. Wilesmith J.W. Knight R.S.G. Zeidler M. Stewart G. Will R.G. Lancet. 1999; 353: 18-21Abstract Full Text Full Text PDF PubMed Scopus (37) Google Scholar, 3Hill A.F. Desbruslais M. Joiner S. Sidle K.C. Gowland I. Collinge J. Doey L.J. Lantos P. Nature. 1997; 389: 448-526Crossref PubMed Scopus (1208) Google Scholar, 4Scott M.R. Will R. Ironside J. Nguyen H.O.B. Tremblay P. DeARmond S.J. Prusiner S.B. Proc. Natl. Acad. Sci. U. S. A. 1999; 96: 15137-15142Crossref PubMed Scopus (462) Google Scholar). Therefore, effective infection control measures for the containment and repression of BSE have become a matter of crucial importance to public health. According to the present state of knowledge, the countermeasures implemented in response to the BSE epidemic are expected to minimize or even eliminate the risk of new primary variant Creutzfeldt-Jakob disease infections of humans directly originating from bovines (5Bradley R. Rabenau H.F. Cinatl J. Doerr H.W. Prions: A Challenge for Science, Medicine, and the Public Health System. S. Karger AG, Basel, Switzerland2004: 146-185Google Scholar). However, further challenges in the area of infection control arise from the hypothetical risk that the BSE agent might have spread via contaminated feed such as meat and bone meal to sheep (5Bradley R. Rabenau H.F. Cinatl J. Doerr H.W. Prions: A Challenge for Science, Medicine, and the Public Health System. S. Karger AG, Basel, Switzerland2004: 146-185Google Scholar) and that BSE, like scrapie, might now be sustained in the ovine population. The clinical symptoms of scrapie, which has been endemic in sheep for centuries without any apparent association with human disease, cannot be reliably distinguished from those exhibited by experimentally challenged BSE-infected ovines. “While it is possible to demonstrate the presence of a TSE by several laboratory techniques using microscopy, electron microscopy, or immunological methods which detect the abnormal form of the prion protein, distinguishing between one strain of scrapie and another, and between BSE and scrapie, is not straightforward” (6, Spongiform Encephalopathy Advisory Committee (1999) http://www.seac.gov.uk/publicats/sub-rep.pdf,Google Scholar). So far, reliable differentiation of BSE and scrapie in sheep has required time-consuming and expensive strain-typing in mice using lesion profiles (7Fraser H. Dickinson A.G. J. Comp. Pathol. 1973; 83: 29-40Crossref PubMed Scopus (279) Google Scholar). Therefore, the development of new methods for an inexpensive, robust, and rapid discrimination between BSE and scrapie constitutes a topical challenge in the surveillance of ovine TSEs addressed in a variety of studies (8Baron T.G. Madec J.Y. Calavas D. J. Clin. Microbiol. 1999; 37: 3701-3704Crossref PubMed Google Scholar, 9Hope J. Wood S.C. Birkett C.R. Chong A. Bruce M.E. Cairns D. Goldmann W. Hunter N. Bostock C.J. J. Gen. Virol. 1999; 80: 1-4Crossref PubMed Scopus (145) Google Scholar). During the past few years, considerable progress has been achieved in this field of TSE research, predominantly by using immunobiochemical techniques (10Kuczius T. Groschup M.H. Mol. Med. 1999; 5: 406-418Crossref PubMed Google Scholar, 11Stack M.J. Chaplin M.J. Clark J. Acta Neuropathol. 2002; 104: 279-286Crossref PubMed Scopus (182) Google Scholar, 12Lezmi S. Martin S. Simon S. Comoy E. Bencsik A. Deslys J.P. Grassi J. Jeffrey M. Baron T. J. Virol. 2004; 78: 3654-3662Crossref PubMed Scopus (70) Google Scholar, 13Thuring C.M. Erkens J.H. Jacobs J.G. Bossers A. Van Keulen L.J. Garssen G.J. Van Zijderveld F.G. Ryder S.J. Groschup M.H. Sweeney T. Langeveld J.P. J. Clin. Microbiol. 2004; 42: 972-980Crossref PubMed Scopus (114) Google Scholar). However, apart from having some practical intricacies (14Notari S. Capellari S. Giese A. Westner I. Baruzzi A. Ghetti B. Gambetti P. Kretzschmar H.A. Parchi P. J. Biol. Chem. 2004; 279: 16797-16804Abstract Full Text Full Text PDF PubMed Scopus (123) Google Scholar), these approaches require specific adjustments for each individual combination of TSE strain and host species. Therefore, alternative methods of strain differentiation, which do not require specific antibodies and can also be applied to a broad spectrum of TSEs and host species, would substantially improve our means for the molecular typing of TSE agents not only in sheep but also potentially in cattle and humans. The causative agent of TSEs is widely considered to represent a new biological principle of infection. The prion hypothesis (15Prusiner S.B. Science. 1982; 216: 136-144Crossref PubMed Scopus (4106) Google Scholar) holds that TSE agents (“prions”) consist essentially not of prion protein The of this protein is in and other of According to the of the prion TSE agents a molecular in which as a or which prion protein and it structure a S.B. Proc. Natl. Acad. Sci. U. S. A. PubMed Scopus Google Scholar). that the phenotypic of different scrapie and other TSE agents, of which have been in different of mice M.E. Med. PubMed Scopus Google Scholar), be in the or structure of or in specific and only β-sheet structure, is substantially of and a A. D. PubMed Scopus Google Scholar, M. R. Prusiner S.B. Proc. Natl. Acad. Sci. U. S. A. PubMed Scopus Google Scholar, M. Nguyen J. M. A. D. I. Proc. Natl. Acad. Sci. U. S. A. PubMed Scopus Google Scholar). Therefore, the of the of the prion the secondary structure the of as for the phenotypic characteristics of TSE During the past few it has been that several different TSE strains can be distinguished by immunobiochemical typing of the electrophoretic mobilities and glycosylation characteristics of in the J. Sidle K.C. J. Ironside J. A.F. Nature. PubMed Scopus Google Scholar, P. R. Capellari S. Ghetti B. M. Gambetti P. PubMed Scopus Google Scholar, P. Capellari S. Gambetti P. N. P. T. J. Giese A. Kretzschmar H. Nature. 1997; PubMed Scopus Google Scholar, Chong A. Birkett C.R. Wood S.C. Hope J. Nature. 1997; PubMed Scopus Google Scholar). strains of hamster-adapted transmissible mink encephalopathy and the of PrP27–30 from and by with exhibited different apparent molecular of and J. Virol. PubMed Google Scholar). evidence for the presence of in and most be for by in the of the prion protein that were from with an with these a has further evidence that from and as as from other hamster-adapted TSE strains have in the structure of J. H. D. H. M. Prusiner S.B. Med. PubMed Scopus Google Scholar). Fourier transform-infrared (FT-IR) spectroscopy used to directly the structure of prion with different TSE the were and substantially by that from and in different β-sheet B. G.J. J. Biol. Chem. Full Text Full Text PDF PubMed Scopus Google Scholar). as as to phenotypic information of TSE agents or mirrored in the secondary structure of FT-IR structural of or PrP27–30, a that in the secondary structure of the protein, as a tool for the molecular typing and differentiation of TSE agents. this the in this to in laboratory animals TSE agents that TSEs and the challenge of distinguishing isolates that can be by the clinical symptoms or neuropathological by the immunobiochemical of For this Syrian were as animals as have the between different TSE strains and and of such isolates in the it is possible to reliably and other TSE agents by FT-IR structural characterization of PrP27–30 from the the on an that FT-IR of PrP27–30 potentially a for the differentiation of TSE agents, those that are or even to by a variety of approaches for strain the animals used in our study have information this may be of a that the rapid and reliable discrimination of strains in nonexperimental TSEs of animals and humans. TSE and of hamster-adapted scrapie strains ME7-H, and 22A-H and of a new hamster-adapted BSE by infection of Syrian with of in from scrapie strain J. Gen. Virol. PubMed Scopus Google Scholar) by R. H. and has been passaged for in our and 22A-H by and in Fraser H. J. Gen. Virol. PubMed Scopus Google Scholar), were by the for of and of 22A-H were used for the of these TSE agents the in our laboratory one of BSE agent from cattle in mice and to hamsters. H. and M. in of brain in from a BSE in a from the were between and days to fatal disease with clinical symptoms of transmissible spongiform of brain in from a were hamsters. symptoms between and in For the present all were on the of ME7-H, and 22A-H in our which showed of and days as the of disease, respectively, and on a of with an of in further not of ME7-H, and 22A-H the in our hamsters. were for clinical symptoms and by the of After the were and further as were in for with for to in for and After in an were in from the were and in for The of as (7Fraser H. Dickinson A.G. J. Comp. Pathol. 1973; 83: 29-40Crossref PubMed Scopus (279) Google Scholar). of S. N. W. D. Giese A. Groschup M.H. Kretzschmar H.A. J. Pathol. Full Text Full Text PDF PubMed Scopus Google Scholar) of brain as M. Bruce M. H. Kretzschmar H.A. M. J. Virol. PubMed Scopus Google Scholar). were in for with for to in for and using a brain After in an were in were on and for For to S. N. W. D. Giese A. Groschup M.H. Kretzschmar H.A. J. Pathol. Full Text Full Text PDF PubMed Scopus Google Scholar), were in TBS, with and with in a and for were in in in and with R. M. R. H. J. Virol. PubMed Google After with the secondary for were with and to the The were for using a For brain were in of to with secondary of of brain in TBS, were with of and of and for M. E. S. H. P. P. J. Gen. Virol. PubMed Scopus Google Scholar). The by of in and and for of the to of brain were in a Nature. PubMed Scopus Google Scholar) or in and using the The were with in for and with in bovine in After in and for with the secondary in bovine in a for used After the in TBS, to using a of and as The of and in each were by for a of the glycosylation were in for each with from four animals with 22A-H, and the of to Different of brain in from with the four different TSE strains the of were in to of and were with as a of for After the by and for were to and with as FT-IR of and prion protein PrP27–30 from the of Syrian the of disease, using a by H. M. M. Simon D. I. M. Ironside J.W. 1997; PubMed Scopus Google Scholar) with some were used of as each of the that required of new were used of by in of in to of the protein with from the The in of to with and and and of brain and in a using a for The and the protein were For of the protein were with of and for The protein by with as M. E. S. H. P. P. J. Gen. Virol. PubMed Scopus Google Scholar). The of the protein by and as M. E. S. H. P. P. J. Gen. Virol. PubMed Scopus Google Scholar), and PrP27–30 also by using as The of protein in the in the of FT-IR of PrP27–30 were with a FT-IR applied for a and a of used an of For each spectrum were and FT-IR were and between and the with to The FT-IR were in the of an FT-IR with a For FT-IR of in the protein from and using a for in of in to a protein to of from the of the were used to for from the protein The of PrP27–30 were from in with a of were to an from in one of which a with a PrP27–30 from of ME7-H, 22A-H, and were each For and the were between and to of the were using a the study on approaches for the characterization and discrimination of TSE agents in would also be for a strain differentiation field such as the or techniques such as strain typing by lesion in mice (7Fraser H. Dickinson A.G. J. Comp. Pathol. 1973; 83: 29-40Crossref PubMed Scopus (279) Google Scholar, M.E. Med. PubMed Scopus Google Scholar) as and the for and with scrapie showed and of animals were and in by and which and and from a animals challenged with or 22A-H scrapie agent exhibited with and scrapie and animals were and not by or and to from a of or as in scrapie were not but the animals showed of with were also to and in a and However, in to the and apparent to by and as in and 22A-H scrapie, exhibited from a and an to to the which showed of and without the scrapie were to from a and not and and symptoms to scrapie and from each other as as from and However, a discrimination between the latter not clinical the lesion profiles caused by ME7-H, 22A-H, and profiles provide a tool for the typing of TSE strains in mice by the and the of in brain (7Fraser H. Dickinson A.G. J. Comp. Pathol. 1973; 83: 29-40Crossref PubMed Scopus (279) Google Scholar). For with or lesion profiles showed but between each other and with to and 22A-H with the latter scrapie the most were in the and in the and for or in the the and the and for the other scrapie isolates and 22A-H patterns of in the of which are of to the analysis for brain from our animals were also for the of for strain differentiation S.J. A. R. A. D. Prusiner S.B. Proc. Natl. Acad. Sci. U. S. A. PubMed Scopus Google Scholar) using the S. N. W. D. Giese A. Groschup M.H. Kretzschmar H.A. J. Pathol. Full Text Full Text PDF PubMed Scopus Google Scholar). For each of the four TSE isolates passaged in our of brain from that revealed patterns for ME7-H, 22A-H, and The most in the and of were the four in with in which by not any or for the four different TSE of the findings in of as a tool for the phenotypic characterization of TSE agents. our this to a distinction between and and to of these isolates from and However, as with lesion that would a of and 22A-H not be of the revealed by in brain of with ME7-H, 22A-H, or of in ME7-H, and 22A-H for it and of the of in ME7-H, and 22A-H for it and in a new of to the electrophoretic mobilities and glycosylation characteristics of PrP27–30, brain from with the four different TSE isolates were with to and using the which is in for molecular differentiation of TSE strains J. Sidle K.C. J. Ironside J. A.F. Nature. PubMed Scopus Google Scholar, P. R. Capellari S. Ghetti B. M. Gambetti P. PubMed Scopus Google Scholar, P. Capellari S. Gambetti P. N. P. T. J. Giese A. Kretzschmar H. Nature. 1997; PubMed Scopus Google Scholar), revealed glycosylation patterns of PrP27–30 for and and For these the of the protein PrP27–30 with and agent cannot be by the glycosylation or it can be distinguished by the different electrophoretic of the and of and by to in the protein structure protein PrP27–30 from exhibited characteristics a of the and a molecular of the A.F. Desbruslais M. Joiner S. Sidle K.C. Gowland I. Collinge J. Doey L.J. Lantos P. Nature. 1997; 389: 448-526Crossref PubMed Scopus (1208) Google Scholar, J. Sidle K.C. J. Ironside J. A.F. Nature. PubMed Scopus Google Scholar, P. Capellari S. Gambetti P. N. P. T. J. Giese A. Kretzschmar H. Nature. 1997; PubMed Scopus Google Scholar, T.G. Madec J.Y. Calavas D. PubMed Scopus Google Scholar) for infections in a variety of other species. PrP27–30 from and showed or from those for and and and exhibited electrophoretic patterns for all PrP27–30 and immunobiochemical typing of pathological prion protein not to a distinction between and the of to Different the of to by a further for the distinction of TSE agents J.Y. A. A. J. P. Baron T. Virol. 1997; PubMed Scopus Google Scholar, R. S. 42: PubMed Scopus Google Scholar). this brain from with ME7-H, and 22A-H were to different between and to and using revealed profiles for the of to as in this it possible to and from each as as of from and 22A-H the scrapie showed a of with gradually and For from the other TSE agents, the most to in the of from showed or by of and and with from and 22A-H but it also that from with scrapie and However, also in this be for and 22A-H scrapie and FT-IR of to information the secondary structure of from the different TSE agents on a molecular PrP27–30 from each by FT-IR the from PrP27–30 of ME7-H, 22A-H, and in the secondary between The used for the of pathological prion protein from brain has been for scrapie to PrP27–30 in which the of with other is not H. M. M. Simon D. I. M. Ironside J.W. 1997; PubMed Scopus Google Scholar). by and revealed only such as H. M. M. Simon D. I. M. Ironside J.W. 1997; PubMed Scopus Google Scholar) and in the of for the PrP27–30 of ME7-H, 22A-H, and some in with to the of this not substantially the FT-IR for the four different TSE several different of evidence that the FT-IR from our in structural of PrP27–30 those of different The essentially from of of the protein and is the most for secondary structure studies of by FT-IR spectroscopy S. J. Chem. PubMed Scopus Google Scholar, J. PubMed Scopus Google Scholar). this PrP27–30 from the four different TSE isolates exhibited specific patterns as by in the and of the and by in individual of secondary structure characteristics by FT-IR spectroscopy of PrP27–30 from of with ME7-H, 22A-H, and agent for in only in a new strains in showed in the of which can be attributed to different β-sheet H. PubMed Scopus Google Scholar, M. PubMed Scopus Google Scholar, N. M. E. J. Chem. Scopus Google Scholar). A for all TSE agents the but the β-sheet for each of the individual isolates for for ME7-H, for and for the β-sheet were in the of and ME7-H, for the is only for the 22A-H, the as a of the β-sheet these that the PrP27–30 from the different TSE agents in β-sheet and respectively, TSE agents (263K, and which to PrP27–30 from and showed also and respectively, which might be attributed to the of β-sheet J. PubMed Scopus Google Scholar, H. PubMed Scopus Google Scholar). strains showed a with which is to D. PubMed Scopus Google Scholar, H. of Scholar). and were for 22A-H and such be in the of and The of this have been to from structure in several H. PubMed Scopus Google Scholar). However, the might also an structure to by between and or by the of to S. J. Chem. PubMed Scopus Google Scholar, D. PubMed Scopus Google Scholar). with the FT-IR in our study secondary structure are not our revealed in the patterns of PrP27–30 from the four passaged TSE agents. evidence that PrP27–30 from and featured in β-sheet and other secondary structure elements and to all passaged TSE agents from each For our typing used different scrapie strains passaged in (263K, 22A-H, and ME7-H) and an of hamster-adapted BSE agent in our Two of the passaged agents, 22A-H and ME7-H, to TSEs with indistinguishable and clinical symptoms, indistinguishable lesion and indistinguishable electrophoretic mobilities or glycosylation patterns of PrP27–30. methods for neuropathological or differentiation, such as analysis of the or typing of pathological prion protein different respectively, were a reliable discrimination between and 22A-H not the latter strains only with to but this would not provide a field in our animals and 22A-H by Fraser H. J. Gen. Virol. PubMed Scopus Google Scholar). The for this is but might be for by of the agents to our of Syrian hamsters. with the or immunobiochemical methods all four and 22A-H, be by FT-IR characterization of pathological prion on the that PrP27–30 from or showed attributed to in β-sheet structure but also to in other secondary structure TSE with in the past few a of has several of evidence that with TSE agents in the and with different J. Sidle K.C. J. Ironside J. A.F. Nature. PubMed Scopus Google Scholar, P. R. Capellari S. Ghetti B. M. Gambetti P. PubMed Scopus Google Scholar, J. Virol. PubMed Google Scholar, J. H. D. H. M. Prusiner S.B. Med. PubMed Scopus Google Scholar). has also been by FT-IR on PrP27–30 from different TSE strains B. G.J. J. Biol. Chem. Full Text Full Text PDF PubMed Scopus Google Scholar). to the study by B. G.J. J. Biol. Chem. Full Text Full Text PDF PubMed Scopus Google Scholar), the of PrP27–30 from our this has the of the of to secondary structure may be by the of A. D. PubMed Scopus Google Scholar, H. of Scholar). our characteristics in the for PrP27–30 from scrapie that were to FT-IR A. D. PubMed Scopus Google Scholar). The the and the β-sheet and were and in the secondary structure of PrP27–30, which by different methods in from hamsters. However, the β-sheet in our from PrP27–30 of in is not by the β-sheet and in the by A. D. PubMed Scopus Google Scholar). might be caused by in the of to our study were to the FT-IR by B. G.J. J. Biol. Chem. Full Text Full Text PDF PubMed Scopus Google Scholar) with a different of scrapie strains and a hamster-adapted BSE this be substantially by for the in the FT-IR of PrP27–30 from TSE and 22A-H, which showed indistinguishable electrophoretic mobilities or glycosylation patterns and this progress not have been achieved without FT-IR from of PrP27–30 in which a any our findings that phenotypic information of different hamster-adapted TSE agents is mirrored in β-sheet and other secondary structure elements of also immunobiochemical typing to detect structural in the pathological prion the of also in this study with ME7-H, 22A-H, and provide the molecular for phenotypic characteristics of different TSE strains J. Virol. PubMed Google Scholar, G.J. S. B. Nature. PubMed Scopus Google Scholar) or the of an as or in the agent to be of this study the of FT-IR spectroscopy for TSE strain that structural characterization of pathological prion protein is to of PrP27–30 from different TSE agents, which can be by immunobiochemical The and of FT-IR spectroscopy in this have to be by of the to a spectrum of TSE agents, host species, and possible in this to scrapie and BSE agents from sheep, such studies also isolates from with different of or human the emergence of new BSE in cattle has been from and A.G. Ryder S. Baron T. 2004; 5: PubMed Scopus Google Scholar, C. G. P. S. L. S. M. Proc. Natl. Acad. Sci. U. S. A. 2004; PubMed Scopus Google Scholar) and the as as public FT-IR of pathological prion protein a tool that not only to the further of the isolates these BSE cases but would potentially improve the surveillance of TSE agents in as as We for and this by and We also and A. for for in to scrapie strains and 22A-H and for the BSE to mice and hamsters.

Ellen Waldman, Marybeth Herald

In his decade-long exploration of female sexuality, Sigmund Freud professed to be on a mission to answer the elusive question: What do women want? Unfortunately, the 19th-century psychiatrist was unable to separate that question from the one he ultimately answered: What do men want women to want? In some sense, Freud's inquiries provide an apt metaphor for the medical profession's stance toward female experience. When confronted with the difference presented by the female body as well as women's unique life experiences, the medical field has responded with approaches that range from bemusement to hostility to intense indifference. Although the pernicious effect of gender bias on healthcare delivery is well-known, less attention has been paid to its secondary effects. Disinterest in or hostility to the female experience leads to an informational vacuum that allows for the development of ideas, theories, and assumptions founded on cognitive bias, rationalization, and wishful thinking rather than empirically-based knowledge. These biases, then, are imported into the legal field where they undergird juridical movements that serve to disadvantage women. This essay explores how, in the medical context, the stunted development of knowledge about women, becomes, in the legal context, a dangerous thing. In examining the interplay between medical and social science information and legal dogma, this essay will discuss how bodies of knowledge are selectively pursued, exploited, or ignored in the service of patriarchal assumptions that achieve expression in legal responses to emerging social dilemmas. Selective information flows between the medical and legal professions result in untoward consequences in a wide variety of settings. Here, we limit our focus to two such untoward consequences. The first part of the essay discusses the impoverished medical discourse on female sexuality and how inattention to female sexual fulfillment has led to legal rules that disproportionately affect women's expression as sexual beings. The second part examines available social science data detailing the distinction between psychological and genetic parenthood and shows how that data has been ignored in favor of judicial presumptions that privilege men and disadvantage women in disputes over frozen embryos. A close look at these contested arenas of sexuality and reproduction demonstrates the difficulty of charting women's progress toward equality. On the surface, in both law and medicine, norms of gender equity command facial allegiance. Medicine disavows its earlier efforts to exclude women from the profession, while law proffers the equal protection doctrine as proof that sexist behavior can be rooted out in a zero-tolerance legal culture. Under the waterline, though, unconscious beliefs and stereotypes hold sway. These unruly currents lead to rationalizations and cognitive errors that elude rigorous examination, but affect women at work, at home, and in the bedroom.

Matthias Bauer

We present a protocol for verification of ``no such entry'' replies from databases. We introduce a new cryptographic primitive as the underlying structure, the keyed hash tree, which is an extension of Merkle's hash tree. We compare our scheme to Buldas et al.'s Undeniable Attesters and Micali et al.'s Zero Knowledge Sets.

Dorian Goldfeld, Alexander Lubotzky, László Pyber

Let Γ denote the modular group SL(2,Z) and Cn(Γ) the number of congruence subgproups of Γ of index at most n. We prove that lim n→∞ log Cn(Γ) (log n)2/ log log n = 3−2 √ 2 4 . Some extensions of this result for other arithmetic groups are presented as well as a general conjecture. §0. Introduction Let k be an algebraic number field, O its ring of integers, S a finite set of valuations of k (containing all the archimedean ones), and OS = { x ∈ k ∣∣ v(x) ≥ 0, ∀v ∈ S}. Let G be a semisimple, simply connected, connected algebraic group defined over k with a fixed embedding into GLd. Let Γ = G(OS) = G ∩ GLd(OS) be the corresponding S-arithmetic group. We assume that Γ is an infinite group. For every non-zero ideal I of OS let Γ(I) = Ker ( Γ → GLd(OS/I) ) . A subgroup of Γ is called a congruence subgroup if it contains Γ(I) for some I. For n > 0, define Cn(Γ) = # { congruence subgroups of Γ of index at most n } . Theorem 1. There exist two positive real numbers α− and α+ such that for all sufficiently large positive integers n n log n log log nα− ≤ Cn(Γ) ≤ n log n log log nα+ . This theorem is proved in [Lu], although the proof of the lower bound presented there requires the prime number theorem on arithmetic progressions in an interval where its validity depends on the GRH (generalized Riemann hypothesis for arithmetic progressions). The first two authors research is supported in part by the NSF. The third author’s Research is supported in part by OTKA T 034878. All three authors would like to thank Yale University for its hospitality. Typeset by AMS-TEX 1 2 DORIAN GOLDFELD ALEXANDER LUBOTZKY LASZLO PYBER In §2 below, we show that by appealing to a theorem of Linnik [Li1, Li2] on the least prime in an arithmetic progression, the proof can be made unconditional. Following [Lu] we define: α+(Γ) = lim logCn(Γ) λ(n) , α−(Γ) = lim logCn(Γ) λ(n) , where λ(n) = (log n) 2 log log n . It is not difficult to see that α+ and α− are independent of both the choice of the representation of G as a matrix group, as well as independent of the choice of S. Hence α± depend only on G and k. The question whether α+(Γ) = α−(Γ) and the challenge to evaluate them for Γ = SL2(Z) and other groups were presented in [Lu]. It was conjectured by Rademacher that there are only finitely many congruence subgroups of SL2(Z) of genus zero. This counting problem has a long history. Petersson [Pe, 1974] proved that the number of all subgroups of index n and fixed genus goes to infinity exponentially as n → ∞. Dennin [De, 1975] proved that there are only finitely many congruence subgroups of SL2(Z) of given fixed genus and solved Rademacher’s conjecture. It does not seem possible, however, to accurately count all congruence subgroups of index at most n in SL2(Z) by using the theory of Riemann surfaces of fixed genus. Here we prove: Theorem 2. α+(SL2(Z)) = α−(SL2(Z)) = 3−2 √ 2 4 = 0.0428932 . . . We believe that SL2(Z) represents the general case and we expect that α+ = α− for all groups. The proof of the lower bound in Theorem 2 is based on the Bombieri-Vinogradov Theorem [Bo], [Da], [Vi], i.e., the Riemann hypothesis on the average. The upper bound, on the other hand, is proved by first reducing the problem to a counting problem for subgroups of abelian groups and then solving that extremal counting problem. We will, in fact, show a more remarkable result: the answer is independent of O! Theorem 3. Let k be a number field with Galois group g = Gal(k/Q) and with ring of integers O. Let S be a finite set of primes, and OS as above. Assume GRH (generalized Riemann hypothesis) for k and all cyclotomic extensions k(ζ ) with a rational prime and ζ a primitive th root of unity. Then α+(SL2(OS)) = α−(SL2(OS)) = 3 − 2 √ 2 4 . The GRH is needed only for establishing the lower bound. It can be dropped in many cases by appealing to a theorem of Murty and Murty [MM] which generalizes the Bombieri– Vinogradov Theorem cited earlier. COUNTING CONGRUENCE SUBGROUPS 3 Theorem 4. Theorem 3 can be proved unconditionally for k if either (a) g = Gal(k/Q) has an abelian subgroup of index at most 4 (this is true, for example, if k is an abelian extension); (b) d = deg[k : Q] < 42. We conjecture that for every Chevalley group scheme G, the upper and lower limiting constants, α±(G(OS)), depend only on G and not on O. In fact, we have a precise conjecture, for which we need to introduce some additional notation. Let G be a Chevalley group scheme of dimension d = dim(G) and rank = rk(G). Let κ = |Φ+| denote the number of positive roots in the root system of G. Letting R = R(G) = d− 2 = κ , we see that R = +1 2 , (resp. , , −1, 3, 6, 6, 9, 15) if G is of type A (resp. B , C , D , G2, F4, E6, E7, E8). Conjecture. Let k,O, and S be as in Theorem 3, and suppose that G is a simple Chevalley group scheme. Then α+(G(OS)) = α−(G(OS)) = (√ R(R + 1) −R )2 4R2 . The conjecture reflects the belief that “most” subgroups of H = G(Z/mZ) lie between the Borel subgroup B of H and the unipotent radical of B. Our proof covers the case of SL2 and we are quite convinced that this will hold in general. For general G, we do not have such an in depth knowledge of the subgroups of G(Fq) as we do for G = SL2, yet we can still prove: Theorem 5. Let k,O, and S be as in Theorem 3. Let G be a simple Chevalley group scheme of dimension d and rank , and R = R(G) = d− 2 , then: (a) Assuming GRH or the assumptions of Theorem 4; α−(G(OS)) ≥ (√ R(R + 1) −R )2

Haixia Jia, Cristopher Moore

Many backtracking algorithms exhibit heavy-tailed distributions, in which their running time is often much longer than their median. We analyze the behavior of two natural variants of the Davis-Putnam-Logemann-Loveland (DPLL) algorithm for Graph 3-Coloring on sparse random graphs G(n,p=c/n). Let P_c(b) be the probability that DPLL backtracks b times. First, we calculate analytically the probability P_c(0) that these algorithms find a 3-coloring with no backtracking at all, and show that it goes to zero faster than any analytic function as c \to c^* = 3.847... Then we show that even in the ``easy'' phase 1 &lt; c &lt; c^* where P_c(0) &gt; 0, including just above the emergence of the giant component, the expected number of backtracks is exponentially large with positive probability. To our knowledge this is the first rigorous proof that the running time of a natural backtracking algorithm has a heavy tail for graph coloring. Moreover, our results show that these algorithms take exponential time, not just below the 3-colorability threshold, but just above the degree c=1 at which the giant component first appears. In addition, we give experimental evidence and heuristic arguments that this tail takes the form P_c(b) ~ b^{-1} up to an exponential cutoff.

Masayuki Abe, Serge Fehr

Abstract. We propose the first distributed discrete-log key generation (DLKG) protocol from scratch which is adaptively-secure in the nonerasure model, and at the same time completely avoids the use of interactive zero-knowledge proofs. As a consequence, the protocol can be proven secure in a universally-composable (UC) like framework which prohibits rewinding. We prove the security in what we call the singleinconsistent-player UC model, which guarantees arbitrary composition as long as all protocols are executed by the same players. As an application, we propose a fully UC threshold Schnorr signature scheme. Our results are based on a new adaptively-secure Feldman VSS scheme. Although adaptive security was already addressed by Feldman in the original paper, the scheme requires secure communication, secure erasure, and either a linear number of rounds or digital signatures to resolve disputes. Our scheme overcomes all of these shortcomings, but on the other hand requires some restriction on the corruption behavior of the adversary, which however disappears in some applications including our new DLKG protocol. We also propose several new adaptively-secure protocols, which may find other applications, like a sender non-committing encryption scheme, a distributed trapdoor-key generation protocol for Pedersen’s commitment scheme, or distributed-verifier proofs for proving relations among commitments or even any NP relations in general. 1

Boaz Barak, Rafael Pass

No abstract is available for this record.

Rafael Pass

Zero-knowledge proofs are one of the most important cryptographic notions. Since their introduction in the early 80&amp;apos;s by Goldwasser, Micali and Racko, they have proven very useful in the design of cryptographic protocols. Nevertheless, many limitations (in terms of e ciency and robustness under concurrent executability of protocols) have also been noticed. In order to overcome these limitations two lines of research have been investigated in the literature: 1. Models with some limited intervention of a trusted party (for example during a set-up phase). 2. Weakenings of the notion of zero-knowledge. In this thesis we attempt to further the understanding of the notion of zero-knowledge proofs by addressing both the above lines of research. More precisely, 1. Concerning the rst line of research, we show that the de nition of zeroknowledge in certain popular models (namely the Common Reference

Ivan Damgård, Serge Fehr, Louis Salvail

The concept of zero-knowledge (ZK) has become of fundamental importance in cryptography. However, in a setting where entities are modeled by quantum computers, classical arguments for proving ZK fail to hold since, in the quantum setting, the concept of rewinding is not generally applicable. Moreover, known classical techniques that avoid rewinding have various shortcomings in the quantum setting.&lt;br /&gt; &lt;br /&gt;We propose new techniques for building &lt;em&gt;quantum&lt;/em&gt; zero-knowledge (QZK) protocols, which remain secure even under (active) quantum attacks. We obtain computational QZK proofs and perfect QZK arguments for any NP language in the common reference string model. This is based on a general method converting an important class of classical honest-verifier ZK (HVZK) proofs into QZK proofs. This leads to quite practical protocols if the underlying HVZK proof is efficient. These are the first proof protocols enjoying these properties, in particular the first to achieve perfect QZK.&lt;br /&gt; &lt;br /&gt;As part of our construction, we propose a general framework for building unconditionally hiding (trapdoor) string commitment schemes, secure against quantum attacks, as well as concrete instantiations based on specific (believed to be) hard problems. This is of independent interest, as these are the first unconditionally hiding string commitment schemes withstanding quantum attacks.&lt;br /&gt; &lt;br /&gt;Finally, we give a partial answer to the question whether QZK is possible in the plain model. We propose a new notion of QZK, &lt;em&gt;non-oblivious verifier&lt;/em&gt; QZK, which is strictly stronger than honest-verifier QZK but weaker than full QZK, and we show that this notion can be achieved by means of efficient (quantum) protocols.

Henk van den Belt

On May 20, 1999, Nature published a brief report on an experiment performed by researchers at Cornell University that indicated that pollen from genetically modified (GM) Bt corn (Zea mays) could kill the larvae of monarch butterflies (Danaus plexippus). In laboratory tests, caterpillars fed milkweed (Asclepias curassavica) leaves dusted with pollen from a Bt corn hybrid showed retarded growth and increased mortality. “These results,” the authors stated, “have potentially profound implications for the conservation of monarch butterflies” (Losey et al., 1999). In a press release announcing the publication in Nature, the principal investigator on the Cornell study, John Losey, had expressed due caution: “Pollen from Bt-corn could represent a serious risk to populations of monarchs and other butterflies, but we can't predict how serious the risk is until we have a lot more data. And we can't forget that Bt-corn and other transgenic crops have a huge potential for reducing pesticide use and increasing yields. This study is just the first step, we need to do more research and then objectively weigh the risks versus the benefits of this new technology” (Cornell News, 1999). Such caution was wasted on Greenpeace International. The day the findings of the Cornell study were published it already demanded that authorities in the United States, Argentina, Canada, and the European Union take immediate action and prohibit the growing of genetically engineered maize crops. The environmentalist nongovernmental organization (NGO) reiterated its earlier call for a ban on all releases of genetically modified organisms (GMOs). Less than a month later, in a media-oriented action, members of Greenpeace dressed up as butterflies confronted a meeting of European Union environment ministers held in Luxembourg, carrying banners demanding “Give butterflies a chance.” In Europe, their campaign apparently found resonance among the authorities: The European Commission decided to freeze the approval process for new Bt maize varieties. The Cornell study did not show that monarch butterfly populations in the wild were actually endangered by Bt corn. However, when Monsanto and Novartis, the companies that sold Bt corn at that time, correctly pointed out that the detrimental effects had so far only been shown in the laboratory, Greenpeace branded them as irresponsible. A spokesperson declared: “Such reactions are the precise opposite to precaution and follow the same pattern of denial these companies have employed for decades, when health and environmental effects of their chemical pesticides were exposed. However, in the case of these GMOs we are talking about living toxins that can reproduce in nature and transmit their dangerous traits to wild species. We cannot consider GMOs harmless until harmful effects are fully proven (sic)” (Greenpeace, 1999a). (The last sentence is obviously a—Freudian?—slip of the tongue and should be read: “We cannot consider GMOs harmless until the absence of harmful effects is fully proven.”) For Greenpeace, not just monarchs were supposed to be endangered. The NGO drew up a list of over 100 species of butterflies that it believed could be harmed by GM maize. It accused biotech companies and regulatory authorities of fully ignoring these risks (Greenpeace, 1999b). More recent field research performed in the American Midwest, however, seems to indicate that monarch butterfly populations are hardly affected, if at all, by the large-scale cultivation of Bt maize in this region (Ortman et al., 2001). The monarch butterfly case is only one among many occasions in which the so-called Precautionary Principle (PP) has been invoked to advocate preventative action to forestall possible harm even before the likelihood or the possible extent of the latter has been scientifically well established. This principle is highly contested. With many other environmentalist NGOs, Greenpeace champions its adoption as a central principle of international law against tenacious opposition from the United States, Canada, and Australia (Greenpeace, 2002). The principle is also at issue in recent World Trade Organization trade disputes between the United States and the European Union. But why does the PP play such a central role? The PP is an outgrowth of increased environmentalist awareness since the 1970s. The conviction took hold that humanity finds itself in a historically unprecedented situation in which our technological capacity and the potential scale of our actions far exceed our predictive knowledge. According to the German philosopher Hans Jonas, this discrepancy between the ability to foresee and the power to act itself assumes ethical importance and asks for humility and responsible restraint on our part. Jonas maintains that it is possible to extract from this situation of profound scientific uncertainty a rule or principle of decision making that is itself not uncertain at all, namely the rule “to give in matters of a certain magnitude—those with apocalyptic potential—greater weight to the prognosis of doom than to that of bliss” (Jonas, 1984). The supreme moral imperative in the new age, Jonas holds, is that humankind may not put its own existence and survival at stake in the wager of technological progress. If we want to find a philosophical basis for the PP, we must look for it in Jonas' book on the imperative of responsibility (although he himself did not use the expression PP). Environmentalists often hold that modern biotechnology has “apocalyptic potential” because it tampers with the basic processes of life. If we release GMOs into the environment, the ultimate consequences for the natural flora and fauna are extremely hard to predict but may well be irreversible. However, many environmentalists, just like Jonas, believe that we possess a decision rule or principle for dealing with fundamental scientific uncertainty that is itself not the least uncertain. That rule is the PP. Thus, in almost any debate, it seems that the PP can be brought in as a trump card to override all other considerations and arguments. But what exactly is the PP? Proponents of the PP assert that the principle is already “enshrined” in such international agreements as the Convention on Biological Diversity and the Cartagena Protocol on Biosafety, but existing definitions of it are at best partial and incomplete. In the context of dealing with environmental hazards, the Rio Declaration of 1992 presented the following formulation of what a precautionary approach entails: “Where there are threats of serious or irreversible damage, lack of full scientific certainty shall not be used as a reason for postponing cost-effective measures to prevent environmental degradation.” A well-known definition of the PP was spelled out in a January 1998 meeting at Wingspread in Racine, Wisconsin. The Wingspread Statement summarized the principle thus: “When an activity raises threats of harm to human health or the environment, precautionary measures should be taken even if some cause and effect relationships are not fully established scientifically” (Raffensberger and Tickner, 1999). Definitions such as these beg many questions. Is there ever full scientific certainty? Do we need a minimal threshold of scientific certainty or plausibility before we may (or should) undertake preventative action? And do we really know how to prevent harm if we are so much ignorant about the underlying cause-effect relationships? The definitions that are currently on offer fail to spell out the precise conditions that have to be fulfilled before the PP may be invoked or the nature of the preventative action that has to be taken. The types of action suggested range from implementing a ban, imposing a moratorium while further research is conducted, allowing the potentially harmful activity to proceed while closely monitoring its effects, to just conducting more research. The PP does not have a very precise meaning as long as such crucial aspects are left largely unanswered. In practice, however, the PP is often given a more definite meaning by reducing it to an absurdity. Normally, no minimal threshold of plausibility is specified as a “triggering” condition, so that even the slightest indication that a particular product or activity might possibly produce some harm to human health or the environment will suffice to invoke the principle. And just as often no other preventative action is contemplated than an outright ban on the incriminated product or activity. The intervention of Greenpeace in the monarch butterfly case seems to fit this pattern. Closely linked to various versions of the PP is the idea of reversing the onus of proof. Thus, the adherents of the Wingspread Statement declare that “the applicant or proponent of an activity or process or chemical needs to demonstrate that the environment and public health will be safe. The proof must shift to the party or entity that will benefit from the activity and that is most likely to have the information” (Raffensberger and Tickner, 1999). Greenpeace also holds that effective implementation of the PP requires a shift in the burden of proof (Greenpeace, 2001). Shifting the burden of proof seems a fairly straightforward way to ensure, as Jonas demanded, that greater weight will be given to the “prognosis of doom” than to the “prognosis of bliss.” Before looking into the proper assignment of the burden of proof, we must first examine more closely the underlying justification for the strong version of the PP. Why should the prospect of harmful effects of a new technology take precedence over the prospect of beneficial effects, quite apart from the inherent likelihood of each of these possibilities? The obvious answer seems to be that such a priority is defensible only when the harmful effects are of such magnitude that they carry catastrophic (or, as Jonas would say, “apocalyptic”) potential. The infinite costs of a possible catastrophic outcome necessarily outweigh even the slightest probability of its occurrence. This type of reasoning exhibits a remarkable resemblance to a well-known example of a “zero-infinity dilemma,” namely Pascal's famous “wager.” When it comes to wagering on the existence of God, the 17th century French philosopher argued incisively in his Pensées that it is better to be safe than sorry (Haller, 2000; Graham, 2002; Manson, 2002). Given an unknown but nonzero probability of God's existence and the infinity of the reward of an eternal life, the rational option would be to conduct one's earthly life as if God exists. Alas, Pascal's reasoning contains a fatal flaw. His argument is vulnerable to the “many gods” objection (Manson, 2002). Consider the possible existence of another deity than God, say Odin. If Odin is jealous, he will resent our worship of God, and we will have to pay an infinite price for our mistake. Never mind that Odin's existence may not seem likely or plausible to us. It is sufficient that we cannot exclude the possibility that he exists with absolute certainty. Therefore, the very same logic of Pascal's wager would lead us to adopt the opposite conclusion not to worship God. Pascal's argument, then, cannot be valid. If the wager argument is not valid, the strong version of the PP (which Manson dubs the “catastrophe principle”) cannot be valid either. Take the application of this principle to the problem of global warming. Environmentalists often argue that even if it is not conclusively established that the emission of carbon dioxide and other gases causes an enhanced greenhouse effect, the mere prospect of an ecological catastrophe due to such a scenario should lead us to drastically curb our emissions of greenhouse gases now. By the same logic, however, one could conjure up the possibility of a coming ice age. The mere prospect of this equally catastrophic scenario should then induce us to avert this outcome by stepping up the emission of greenhouse gases. Thus, the strong version of the PP would lead to contradictory recommendations (compare with Graham, 2002). In a similar way, it could be argued that this principle commits us to each of two contradictory policies: (a) We must not develop GM crops, and (b) We must develop GM crops. The first alternative is argued vehemently by many environmentalists who appeal to the PP. To support the second possibility, Gary Comstock conjures up a dramatic scenario in which people are forced to seize upon the remaining reserves of nature in a desperate effort to overcome food shortages resulting from global warming. He then argues, in the style of the environmentalists, that “lack of full scientific certainty that GM crops will prevent environmental degradation shall not be used as a reason for postponing this potentially cost-effective measure” (Comstock, 2000). Therefore, the strong version of the PP is untenable. But what about the proposed shifting of the onus of proof toward those who advocate a new technology or activity? Reversing the burden of proof would amount to substituting the maxim “guilty until proven innocent” for the age-old legal principle “innocent until proven guilty.” Biotech enthusiasts and antiregulationists resent this departure from what they consider time-honored legal sanity (Miller and Conko, 2000). They are prone to counter the frequent invocation of the PP with an equally insistent demand of “sound science.” The same opposition is also at the center of the present World Trade Organization trade disputes between the United States and the European Union and their disagreement on the regulation of GM crops. One side claims the moral high ground, whereas the other side attempts to seize the scientific high ground. The situation is highly polarized because various economic and political interests are at stake (Fig. 1). Wheat (Triticum aestivum) fields in the Palouse region of the state of Washington in the United States. The polarized discussion about the PP and the adoption of GM crops has become a proxy for everything that Europeans and environmentalists in other countries don't like about modern agriculture. The rejection of agricultural biotechnology may perhaps be tolerated as a European indulgence but hardly makes sense on a global scale. The critics of the PP assert that the burden that environmentalists and regulators want to impose on the proponents of new technologies tends to be unbearable (Miller and Conko, 2000). In the name of absolute safety, the latter are asked nothing less than to demonstrate conclusively that the new technologies they advocate offer no possible harm. This is a formidable, perhaps even logically impossible, task. You cannot prove a negative (compare with Wildavsky, 1995). Moreover, a risk-free world is not a real option. Thus, a consistent application of the PP would in the final analysis stifle all innovation. A closer analysis of what is involved in applying the classical principle “innocent until proven guilty,” however, reveals that the situation need not be as black and white as it seems at first sight. Take the paradigm case of criminal justice. There are two main ways in which a miscarriage of justice can come about. Either the suspect did not commit the crime, but the verdict found him guilty; or the suspect did commit the crime, but the verdict found him not guilty. In a civilized system of justice, the risks of the first type of error are minimized as far as possible. That is what is meant by the phrase “innocent until proven guilty.” The system contains safeguards and precautions in the form of high standards of proof so as to ensure that a suspect will be condemned for a certain criminal offense only if it has been established “beyond reasonable doubt” that he in fact committed the alleged offense. Alas, there is a price to be paid for this cautious and civilized approach, namely the possibly large number of wrongdoers who have to be acquitted due to “lack of sufficient proof.” To a certain extent, the risks of the two types of error are inversely related. We may to the risk of an by demanding ever more standards of proof but only at the of increasing the risk of Therefore, we must that there is an involved in the of our system of criminal justice. We may to our standards as high as we but a must be the system will become by making it to sentence on the of there is a similar to be between the of a type or a type the of when it is in fact or to the when in fact it is By a we a particular this should on our of the and with of the two types of The analysis that the at issue is not just to burden of proof. as we for more or less standards of proof, an of In other the burden we want to put on the of one or the other party more or less on we our standards of proof more or less This may us to from the polarized opposition of PP versus In most companies to GM crops have to their to for health effects and environmental This can be more or less The of those who by “sound is a fully risk However, it is only possible to this in more and such as or are at then the expression “sound is because it the that necessarily into the of of and between type and type In other or more ecological effects are at the of the fully risk is of “sound will be to such less straightforward as or risks that can be However, as the proponents of the PP are in lack of of harm is not of lack of harm. If we are really about such hazards, we can put in effort to more about their plausibility or It would be to our with an appeal to “sound science.” A recent European on the release of GMOs into the environment that any that to or a transgenic should carry out a environmental risk into immediate and 2001). This new regulation of GM crops much further than some American also argue for a more approach et al., 2001). The new European a burden of proof on biotech companies to or not they are to take that burden on their will on the definition of a or for conducting environmental risk The to be is that the on these companies will become them at the of regulatory and for of environmental This will be enhanced by the fact that the of the has been by the PP and that regulatory authorities may give to the of GMOs only they have been that the release will be safe for human health and the The fairly of the environmental risk need not be in if of play for the regulation of GM crops can be More is also about the that have to be taken into in The outcome of the is for on or not in are taken as a or or not a strong to as a option is 2001). The and of a Bt maize hybrid or any other transgenic might be quite in than in the United States. Europeans are to because their countries lack of and other of regulatory at holds that the in on GM is not about safety, but is in fact a proxy for a on how should be 2001). GM crops have become a for all that Europeans don't like in modern agriculture. a for and a rejection of agricultural biotechnology perhaps may be tolerated as a European the prospect hardly makes sense on a global scale. this is what Greenpeace us as a the NGO us a serious answer to the of how to a growing world and natural the of modern biotechnology (compare with 1999). We can even press the environmentalist organization by the Thus, it that the polarized on the PP is just a proxy for a on the of world agriculture.

Jonathan D. Moreno

In 1986, the German sociologist Ulrich Beck published the first edition of his book, Risk Society.1 Beck's book has attained wide popularity, especially in Europe, for his analysis of the distance between scientific expertise and popular opinion in the understanding of potential harms. Time and again, Beck points out, the public complains that there is a harmful process at work, while the scientists who are appointed by authorities to assess the complaints conclude that there is no objective basis for concern. Too often, though, the scientific conclusions are advanced without involving the public and without taking into account conditions outside of the laboratory. Subsequent experiences, such as the Mad Cow disaster in British livestock, have only reinforced the problem. Public skepticism about genetically modified organisms and the food supply can be traced to the same roots. On both sides of the Atlantic, the example of HIV in the blood supply, the halting management of the crisis, and the resulting loss of public confidence in the system, constitute an all-too-familiar case for readers of this journal. These kinds of examples and the conditions that Beck describes and explicates helped lead to the development of a policy standard, again especially in Europe, called the precautionary principle. In a 1992 statement, the European Environment Agency gave a succinct statement of the principle: [I]n order to protect the environment, a precautionary approach should be widely applied, meaning that where there are threats of serious or irreversible damage to the environment, lack of full scientific certainty should not be used as a reason for postponing cost-effective measures to prevent environmental degradation. Further, The precautionary principle permits a lower level of proof of harm to be used in policy-making whenever the consequences of waiting for higher levels of proof may be very costly and/or irreversible (emphasis added).2 Paradoxically, technologic advancement itself is the source of the risks that concern us. In other words, scientific expertise has created the very conditions that society now doubts the experts fully appreciate. In Risk Society, Beck defines risk as “a systematic way of dealing with hazards and insecurities induced and introduced by modernization itself.” He goes on, “Risks, as opposed to older dangers, are consequences which relate to the threatening force of modernization and to its globalization of doubt.” The social and political conditions that affect current issues in transfusion medicine are thus part of a much larger “globalization of doubt” about expertise. Although he does not allude to transfusion medicine per se, it is a paradigm case of risk in the sense that Beck writes about, for it has been a modernizing development in medical care and the risks it brings about would not exist without that modernization. The tensions within a “risk society” are brought to the surface when a new incident reignites doubt, such as concerns about West Nile virus in the summer of 2002. Sensitized by previous failures to satisfy public concern, responsible officials leap into action, often shifting their attention and energy away from known and measurable risks to persuade society that the unknown and often nonmeasurable risk is being taken seriously. This reaction, while understandable in light of the critique leveled by Beck and many others, should give us pause. Along with policies intended to drastically reduce risk, it is an example of the way that the precautionary principle has been both transformed into a dogma and taken out of its original context. I call these tendencies “creeping precautionism” because the adoption of a precautionary stance may not even be noticed until it is too late, and because a reasonable principle can easily be turned into a self-defeating ideology. Consider two recent policies that public health and blood industry experts have cited in conversation as examples that might reflect creeping precautionism: p24 antigen testing for HIV, which may have prevented one case per year at a cost of tens of millions a year; and deferral of donors who have been European residents, when the risk of CJD risk remains highly theoretical with no documented case of transmission, and hundreds of thousands of units have been lost as a result. I am no authority on the complex medical and public health issues involved, but suppose for the sake of argument that these policies raise valid questions. How did they come to pass? Clearly many elements came into play in these policy decisions. One that has not previously been identified is the fact that, as these policies were being formed, the precautionary principle came to have a great deal of influence in environmental health circles. In fact, I believe that we live in a period in which the principle has, without argument and often without conscious awareness, both been taken out of context, applied to problems other than catastrophic health concerns, and misinterpreted. The original context was environmentalism, where ecologic complexities and uncertainties present risks that, for all intents and purposes, may truly be inestimable and irreversible. Those conditions may not apply in other policy contexts. The misinterpretation has been to suppose that precautionism requires that only zero risk is acceptable, or at least something quite close to zero risk. Even advocates of the principle would recognize these subtle shifts in thinking as errors. In particular, it is clear that no action or inaction is risk free, and that any decision has opportunity costs. The opportunity costs of precautionism in the blood industry are, among others, the loss of many usable units of blood and the alienation of potential donors. I am not arguing that the policies in question are without merit nor that they should be repealed. Rather, I urge that a discussion begin in the blood services community about whether unwarranted precautionism has in fact crept into policymaking. This discussion should also take into account the peculiar stresses upon the role of expertise in a modern democracy. To step back for a moment, it is useful to recall the classical origins of the idea of expertise. In his seminal work, The Republic, Plato uses an allegory to characterize the situation of the truly knowledgeable person. He spins a tale about a group of slaves bound to their places since birth, unable to turn their heads, and only able to view a wall in front of them. Behind them are carried ordinary objects, whose shadows fall upon the wall. Knowing nothing better, the slaves assume that the shadows are the real objects. Now suppose, Plato continues, a slave manages to break his bonds and escape to the mouth of the cave. Unaccustomed to the light, he will at first be blinded by the sun, then realize to his horror that all his life what he has thought was reality was merely illusion. He tries to enlighten (pun intended) his comrades, but they mock him as mad. Discouraged, he takes his place among the slaves again. The allegory implies that knowledge is painful, hard to achieve, and subject to ridicule by the ignorant. This is the uncomfortable position of the expert. The problem is especially grave in medicine, whose practitioners are supposed to be sensitive to the uninitiated. Yet, too much sensitivity is incompatible with the detachment and decorum that the physician requires to be effective. Sir William Osler, generally regarded as the father of internal medicine, commented on this dilemma of the health care expert over a century ago. Imperturbability. . . . It is the quality which is most appreciated by the laity though often misunderstood by them; and the physician who has the misfortune to be without it, who betrays indecision and worry, and who shows that he is flustered and flurried in ordinary emergencies, loses rapidly the confidence of his patients.3 I write as a product and professor of the bioethical revolution in medicine, which is characterized by a deep suspicion of expertise, manifested as the insistence on informed consent and truth telling by doctors. This revolution is only about 30 years old in practice and would have shocked my father, a 1917 graduate of the University of Vienna medical school. The emergence of bioethics in the 1970s (my father died in 1974, too soon to experience the sweeping changes in medical ethics) is of a piece with the appearance of the precautionary principle of the 1980s. Both are rooted in skepticism of professional authority, and both have advocated lay involvement in medical decisions. I do not advocate repudiating the new medical ethics. As the Yale University psychiatrist and law professor Jay Katz has long pointed out, the doctor-patient relationship was for eons characterized by a doctor-dominated paradigm that is best left behind. Yet, I worry that the critique of modernism, of expertise, has swung too far. In the clinical setting, I have seen this phenomenon manifested as the reluctance of physicians to give advice to patients who are facing a complex treatment decision. Often I hear complaints that doctors respond to patients’ requests for guidance with the demurrer that it is their decision, that they must exercise their self-determination. This is a case of turning patient autonomy into a shield behind which doctors can hide. The ethical principle of autonomy should not be an excuse for abandoning the counseling that patients crave. Similarly, in the long run I think it is bad for the profession to give up the moral authority that comes with expertise. Perhaps those with expertise in public health and blood should open a conversation about whether they have succumbed to creeping protectionism in an honest attempt to learn from the horrors of the HIV experience. I cannot say whether this is the case, only that the signs point to this possibility. On the importance of a philosophical view of scientific expertise, consider Osler again. A rare and precious gift is the Art of Detachment, by which a man may so separate himself from a life-long environment as to take a panoramic view of the conditions under which he has lived and moved: it frees him from Plato's den long enough to see the realities as they are, the shadows as they appear. Could a physician attain to such an art he would find in the state of his profession a theme calling as well for the exercise of the highest faculties of description and imagination as for the deepest philosophic insight.4 In our time, scientists have learned about the pitfalls of an aristocratic attitude. The challenge is to balance those lessons with society's continuing need for unshackled expertise. To this end, efforts should be made to develop evidence that quantifies, or at least aids in prioritizing risks, with the goal of evidence-based risk assessment. Scientists and physicians should then recognize their social obligation to participate in policy debates in which their expert opinions can help the public balance imminent and more remote risks and evaluate the costs associated with risk-minimizing initiatives. In this way, perhaps we can all meet the Platonic challenge of doing science in a democracy.

Charles Go, Shelley Murdock

In an effort to prevent tragic incidents like Columbine from recurring, bully-proofing programs are being implemented with the premise that bullies should be identified and an intervention program administered while victims are taught to defend themselves against bullies. However, our survey of middle school students showed that youth could be both bullies and victims at the same time and under variable conditions. The research results call into question the likelihood of success in bully-proofing programs. Instead, the results suggest that promoting positive youth development programs and creating a sense of safety in schools and neighborhoods may be more effective approaches.

Amit Sahai, Salil Vadhan

We present the first complete problem for SZK, the class of promise problems possessing statistical zero-knowledge proofs (against an honest verifier). The problem, called Statistical Difference, is to decide whether two efficiently samplable distributions are either statistically close or far apart. This gives a new characterization of SZK that makes no reference to interaction or zero knowledge .We propose the use of complete problems to unify and extend the study of statistical zero knowledge. To this end, we examine several consequences of our Completeness Theorem and its proof, such as:---A way to make every (honest-verifier) statistical zero-knowledge proof very communication efficient, with the prover sending only one bit to the verifier (to achieve soundness error 1/2).---Simpler proofs of many of the previously known results about statistical zero knowledge, such as the Fortnow and Aiello--Hεstad upper bounds on the complexity of SZK and Okamoto's result that SZK is closed under complement.---Strong closure properties of SZK that amount to constructing statistical zero-knowledge proofs for complex assertions built out of simpler assertions already shown to be in SZK.---New results about the various measures of "knowledge complexity," including a collapse in the hierarchy corresponding to knowledge complexity in the "hint" sense.---Algorithms for manipulating the statistical difference between efficiently samplable distributions, including transformations that "polarize" and "reverse" the statistical relationship between a pair of distributions.

Michael Ben-Or, Gutfreund

No abstract is available for this record.

Oded Goldreich, Salil Vadhan

We consider the following (promise) problem, denoted ED (for Entropy Difference): The input is a pair of circuits, and YES instances (resp., NO instances) are such pairs in which the first (resp., second) circuit generates a distribution with noticeably higher entropy. On one hand we show that any language having a (honest-verifier) statistical zero-knowledge proof is Karp-reducible to ED. On the other hand, we present a public-coin (honest-verifier) statistical zero-knowledge proof for ED. Thus, we obtain an alternative proof of Okamoto's result by which HVSZK: (i.e., honest-verifier statistical zero knowledge) equals public-coin HVSZK. The new proof is much simpler than the original one. The above also yields a trivial proof that HVSZK: is closed under complementation (since ED easily reduces to its complement). Among the new results obtained is an equivalence of a weak notion of statistical zero knowledge to the standard one.

Anna Redz

This thesis is written for the Swedish degree Licentiate ofScience, Teknisk Licentiat.It is a university degree, between that of master andthat of doctor.The main focus of the thesis is on the construction ofsecure protocols for comparing the underlying plain-texts inElGamal encryptions. The protocols make use of the malleabilityof the ElGamal encryption scheme. More specifically they usethe multiplicative homomorphic property of ElGamal.We present fully verifiable protocols for both thetwo-party setting and the multi-party setting. These protocolsare built on sub-protocols, which are specially constructed tofit the present setting. We also present full proofs forcompleteness, soundness, and zero-knowledge for all the givenprotocols, in the random oracle model.

Mario Di Raimondo, Rosario Gennaro

No abstract is available for this record.

Jens Groth

No abstract is available for this record.