arXiv++ Combinatorics

The design of protocols for local differential privacy (or LDP) has been a topic of considerable research interest in recent years. LDP protocols utilise the randomised encoding of outcomes of an experiment using a transition probability matrix (TPM). Several authors have observed that balanced incomplete block designs (BIBDs) provide nice examples of TPMs for LDP protocols. Indeed, it has been shown that such BIBD-based LDP protocols provide optimal estimators. In this primarily expository paper, we give a detailed introduction to LDP protocols and their connections with block designs. We prove that a subclass of LDP protocols known as pure LDP protocols are equivalent to $(r,λ)$-designs (which contain balanced incomplete block designs as a special case). An unbiased estimator for an LDP scheme is a left inverse of the transition probability matrix. We show that the optimal estimators for BIBD-based TPMs are precisely those obtained from the Moore-Penrose inverse of the corresponding TPM. We also review some existing work on optimal LDP protocols in the context of pure protocols.

Intersection distribution and non-hitting index are concepts introduced recently by Li and Pott as a new way to view the behaviour of a collection of finite field polynomials. With both an algebraic interpretation via the intersection of a polynomial with a set of lines, and a geometric interpretation via a $(q+1)$-set possessing an internal nucleus, the concepts have proved their usefulness as a new way to view various long-standing problems, and have applications in areas such as Kakeya sets. In this paper, by exploiting connections with diverse areas including the theory of algebraic curves, cyclotomy and the enumeration of irreducible polynomials, we establish new results and resolve various Open Problems of Li and Pott. We prove geometric results which shed new light on the relationship between intersection distribution and projective equivalence of polynomials, and algebraic results which describe and characterise the degree of $S_f$ - the index of the largest non-zero entry in the intersection distribution of $f$. We provide new insights into the non-hitting spectrum, and show the limitations of the non-hitting index as a tool for characterisation. Finally, the benefits provided by the connections to other areas are evidenced in two short new proofs of the cubic case.

We investigate near-factorizations of nonabelian groups, concentrating on dihedral groups. We show that some known constructions of near-factorizations in dihedral groups yield equivalent near-factorizations. In fact, there are very few known examples of nonequivalent near-factorizations in dihedral or other nonabelian groups; we provide some new examples with the aid of the computer. We also analyse a construction for near-factorizations in dihedral groups from near-factorizations in cyclic groups, due to Pêcher, and we investigate when nonequivalent near-factorizations can be obtained by this method.

In this expository note, we discuss a ``balls-and-urns'' probability puzzle posed by Daniel Litt.

Cyclotomy, the study of cyclotomic classes and cyclotomic numbers, is an area of number theory first studied by Gauss. It has natural applications in discrete mathematics and information theory. Despite this long history, there are significant limitations to what is known explicitly about cyclotomic numbers, which limits the use of cyclotomy in applications. The main explicit tool available is that of uniform cyclotomy, introduced by Baumert, Mills and Ward in 1982. In this paper, we present an extension of uniform cyclotomy which gives a direct method for evaluating all cyclotomic numbers over $GF(q^n)$ of order dividing $(q^n-1)/(q-1)$, for any prime power $q$ and $n \geq 2$, which does not use character theory nor direct calculation in the field. This allows the straightforward evaluation of many cyclotomic numbers for which other methods are unknown or impractical. Our methods exploit connections between cyclotomy, Singer difference sets and finite geometry.

One method of constructing $(a^2+1, 2,a, 1)$-SEDFs (i.e., strong external difference families) in $\mathbb{Z}_{a^2+1}$ makes use of $α$-valuations of complete bipartite graphs $K_{a,a}$. We explore this approach and we provide a classification theorem which shows that all such $α$-valuations can be constructed recursively via a sequence of ``blow-up'' operations. We also enumerate all $(a^2+1, 2,a, 1)$-SEDFs in $\mathbb{Z}_{a^2+1}$ for $a \leq 14$ and we show that all these SEDFs are equivalent to $α$-valuations via affine transformations. Whether this holds for all $a > 14$ as well is an interesting open problem. We also study SEDFs in dihedral groups, where we show that two known constructions are equivalent.

(Strong) circular external difference families (which we denote as CEDFs and SCEDFs) can be used to construct nonmalleable threshold schemes. They are a variation of (strong) external difference families, which have been extensively studied in recent years. We provide a variety of constructions for CEDFs based on graceful labellings ($α$-valuations) of lexicographic products $C_n \boldsymbol{\cdot} K_{\ell}^c$, where $C_n$ denotes a cycle of length $n$. SCEDFs having more than two subsets do not exist. However, we can construct close approximations (more specifically, certain types of circular algebraic manipulation detection (AMD) codes) using the theory of cyclotomic numbers in finite fields.

A splitting BIBD is a type of combinatorial design that can be used to construct splitting authentication codes with good properties. In this paper we show that a design-theoretic approach is useful in the analysis of more general splitting authentication codes. Motivated by the study of algebraic manipulation detection (AMD) codes, we define the concept of a group generated splitting authentication code. We show that all group-generated authentication codes have perfect secrecy, which allows us to demonstrate that algebraic manipulation detection codes can be considered to be a special case of an authentication code with perfect secrecy. We also investigate splitting BIBDs that can be "equitably ordered". These splitting BIBDs yield authentication codes with splitting that also have perfect secrecy. We show that, while group generated BIBDs are inherently equitably ordered, the concept is applicable to more general splitting BIBDs. For various pairs $(k,c)$, we determine necessary and sufficient (or almost sufficient) conditions for the existence of $(v, k \times c,1)$-splitting BIBDs that can be equitably ordered. The pairs for which we can solve this problem are $(k,c) = (3,2), (4,2), (3,3)$ and $(3,4)$, as well as all cases with $k = 2$.

In this paper, we show a "direct" equivalence between certain authentication codes and robust secret sharing schemes. It was previously known that authentication codes and robust secret sharing schemes are closely related to similar types of designs, but direct equivalences had not been considered in the literature. Our new equivalences motivate the consideration of a certain "key-substitution attack." We study this attack and analyze it in the setting of "dual authentication codes." We also show how this viewpoint provides a nice way to prove properties and generalizations of some known constructions.

A collection of disjoint subsets ${\cal A}=\{A_1,A_2,\dotsc,A_m\}$ of a finite abelian group is said to have the \emph{bimodal} property if, for any non-zero group element $δ$, either $δ$ never occurs as a difference between an element of $A_i$ and an element of some other set $A_j$, or else for every element $a_i$ in $A_i$ there is an element $a_j\in A_j$ for some $j\neq i$ such that $a_i-a_j=δ$. This property arises in various familiar situations, such as the cosets of a fixed subgroup or in a group partition, and has applications to the construction of optimal algebraic manipulation detection (AMD) codes. In this paper, we obtain a structural characterisation for bimodal collections of sets.

In this paper, we provide a mathematical framework for characterizing AMD codes that are R-optimal. We introduce a new combinatorial object, the reciprocally-weighted external difference family (RWEDF), which corresponds precisely to an R-optimal weak AMD code. This definition subsumes known examples of existing optimal codes, and also encompasses combinatorial objects not covered by previous definitions in the literature. By developing structural group-theoretic characterizations, we exhibit infinite families of new RWEDFs, and new construction methods for known objects such as near-complete EDFs. Examples of RWEDFs in non-abelian groups are also discussed.

We consider strong external difference families (SEDFs); these are external difference families satisfying additional conditions on the patterns of external diferences that occur, and were first defined in the context of classifying optimal strong algebraic manipulation detection codes. We establish new necessary conditions for the existence of (n; m; k; lambda)-SEDFs; in particular giving a near-complete treatment of the lambda = 2 case. For the case m = 2, we obtain a structural characterization for partition type SEDFs (of maximum possible k and lambda), showing that these correspond to Paley partial difference sets. We also prove a version of our main result for generalized SEDFs, establishing non-trivial necessary conditions for their existence.

This paper provides a mathematical analysis of optimal algebraic manipulation detection (AMD) codes. We prove several lower bounds on the success probability of an adversary and we then give some combinatorial characterizations of AMD codes that meet the bounds with equality. These characterizations involve various types of generalized difference families. Constructing these difference families is an interesting problem in its own right.

We study a method for key predistribution in a network of $n$ users where pairwise keys are computed by hashing users' IDs along with secret information that has been (pre)distributed to the network users by a trusted entity. A communication graph $G$ can be specified to indicate which pairs of users should be able to compute keys. We determine necessary and sufficient conditions for schemes of this type to be secure. We also consider the problem of minimizing the storage requirements of such a scheme; we are interested in the total storage as well as the maximum storage required by any user. Minimizing the total storage is NP-hard, whereas minimizing the maximum storage required by a user can be computed in polynomial time.

There has been considerable recent interest in "cloud storage" wherein a user asks a server to store a large file. One issue is whether the user can verify that the server is actually storing the file, and typically a challenge-response protocol is employed to convince the user that the file is indeed being stored correctly. The security of these schemes is phrased in terms of an extractor which will recover or retrieve the file given any "proving algorithm" that has a sufficiently high success probability. This paper treats proof-of-retrievability schemes in the model of unconditional security, where an adversary has unlimited computational power. In this case retrievability of the file can be modelled as error-correction in a certain code. We provide a general analytical framework for such schemes that yields exact (non-asymptotic) reductions that precisely quantify conditions for extraction to succeed as a function of the success probability of a proving algorithm, and we apply this analysis to several archetypal schemes. In addition, we provide a new methodology for the analysis of keyed POR schemes in an unconditionally secure setting, and use it to prove the security of a modified version of a scheme due to Shacham and Waters under a slightly restricted attack model, thus providing the first example of a keyed POR scheme with unconditional security. We also show how classical statistical techniques can be used to evaluate whether the responses of the prover are accurate enough to permit successful extraction. Finally, we prove a new lower bound on storage and communication complexity of POR schemes.

Several different "hat games" have recently received a fair amount of attention. Typically, in a hat game, one or more players are required to correctly guess their hat colour when given some information about other players' hat colours. Some versions of these games have been motivated by research in complexity theory and have ties to well-known research problems in coding theory, and some variations have led to interesting new research. In this paper, we review Ebert's Hat Game, which garnered a considerable amount of publicity in the late 90's and early 00's, and the Hats-on-a-line Game. Then we introduce a new hat game which is a "hybrid" of these two games and provide an optimal strategy for playing the new game. The optimal strategy is quite simple, but the proof involves an interesting combinatorial argument.

A honeycomb array is an analogue of a Costas array in the hexagonal grid; they were first studied by Golomb and Taylor in 1984. A recent result of Blackburn, Etzion, Martin and Paterson has shown that (in contrast to the situation for Costas arrays) there are only finitely many examples of honeycomb arrays, though their bound on the maximal size of a honeycomb array is too large to permit an exhaustive search over all possibilities. The present paper contains a theorem that significantly limits the number of possibilities for a honeycomb array (in particular, the theorem implies that the number of dots in a honeycomb array must be odd). Computer searches for honeycomb arrays are summarised, and two new examples of honeycomb arrays with 15 dots are given.

A two-dimensional grid with dots is called a \emph{configuration with distinct differences} if any two lines which connect two dots are distinct either in their length or in their slope. These configurations are known to have many applications such as radar, sonar, physical alignment, and time-position synchronization. Rather than restricting dots to lie in a square or rectangle, as previously studied, we restrict the maximum distance between dots of the configuration; the motivation for this is a new application of such configurations to key distribution in wireless sensor networks. We consider configurations in the hexagonal grid as well as in the traditional square grid, with distances measured both in the Euclidean metric, and in the Manhattan or hexagonal metrics. We note that these configurations are confined inside maximal anticodes in the corresponding grid. We classify maximal anticodes for each diameter in each grid. We present upper bounds on the number of dots in a pattern with distinct differences contained in these maximal anticodes. Our bounds settle (in the negative) a question of Golomb and Taylor on the existence of honeycomb arrays of arbitrarily large size. We present constructions and lower bounds on the number of dots in configurations with distinct differences contained in various two-dimensional shapes (such as anticodes) by considering periodic configurations with distinct differences in the square grid.

A distinct difference configuration is a set of points in $\mathbb{Z}^2$ with the property that the vectors (\emph{difference vectors}) connecting any two of the points are all distinct. Many specific examples of these configurations have been previously studied: the class of distinct difference configurations includes both Costas arrays and sonar sequences, for example. Motivated by an application of these structures in key predistribution for wireless sensor networks, we define the $k$-hop coverage of a distinct difference configuration to be the number of distinct vectors that can be expressed as the sum of $k$ or fewer difference vectors. This is an important parameter when distinct difference configurations are used in the wireless sensor application, as this parameter describes the density of nodes that can be reached by a short secure path in the network. We provide upper and lower bounds for the $k$-hop coverage of a distinct difference configuration with $m$ points, and exploit a connection with $B_{h}$ sequences to construct configurations with maximal $k$-hop coverage. We also construct distinct difference configurations that enable all small vectors to be expressed as the sum of two of the difference vectors of the configuration, an important task for local secure connectivity in the application.