Search

One method of constructing $(a^2+1, 2,a, 1)$-SEDFs (i.e., strong external difference families) in $\mathbb{Z}_{a^2+1}$ makes use of $\alpha$-valuations of complete bipartite graphs $K_{a,a}$. We explore this approach and we provide a classification theorem which shows that all such $\alpha$-valuations can be constructed recursively via a sequence of ``blow-up'' operations. We also enumerate all $(a^2+1, 2,a, 1)$-SEDFs in $\mathbb{Z}_{a^2+1}$ for $a \leq 14$ and we show that all these SEDFs are equivalent to $\alpha$-valuations via affine transformations. Whether this holds for all $a > 14$ as well is an interesting open problem. We also study SEDFs in dihedral groups, where we show that two known constructions are equivalent.

We study two types of nestings of balanced incomplete block designs (BIBDs). In both types of nesting, we wish to add a point (the nested point) to every block of a $(v,k,\lambda)$-BIBD in such a way that we end up with a partial $(w,k+1,\lambda+1)$-BIBD for some $w \geq v$. In the case where $w > v$, we are introducing $w-v$ new points. This is called a weak nesting. A strong nesting satisfies the stronger property that no pair containing a new point occurs more than once in the partial $(w,k+1,\lambda+1)$-BIBD. In both cases, the goal is to minimize $w$. We prove lower bounds on $w$ as a function of $v$, $k$ and $\lambda$ and we find infinite classes of $(v,2,1)$- and $(v,3,2)$-BIBDs that have optimal nestings.

In a nesting of a balanced incomplete block design (or BIBD), we wish to add a point (the \emph{nested point}) to every block of a $(v,k,\lambda)$-BIBD in such a way that we end up with a partial $(v,k+1,\lambda+1)$-BIBD. In the case where the partial $(v,k+1,\lambda+1)$-BIBD is in fact a $(v,k+1,\lambda+1)$-BIBD, we have a \emph{perfect nesting}. We show that a nesting is perfect if and only if $k = 2 \lambda + 1$. Perfect nestings were previously known to exist in the case of Steiner triple systems (i.e., $(v,3,1)$-BIBDs) when $v \equiv 1 \bmod 6$, as well as for some symmetric BIBDs. Here we study nestings of $(v,4,1)$-BIBDs, which are not perfect nestings. We prove that there is a nested $(v,4,1)$-BIBD if and only if $v \equiv 1 \text{ or } 4 \bmod 12$, $v \geq 13$. This is accomplished by a variety of direct and recursive constructions.

The obvious way to construct a GDD (group-divisible design) recursively is to use Wilson's Fundamental Construction for GDDs (WFC). Then a PBD (pairwise balanced design) is often obtained by adding a new point to each group of the GDD. However, after constructing such a PBD, it might be the case that we then want to identify a parallel class of blocks. In this short note, we explore some possible ways of doing this.

(Strong) circular external difference families (which we denote as CEDFs and SCEDFs) can be used to construct nonmalleable threshold schemes. They are a variation of (strong) external difference families, which have been extensively studied in recent years. We provide a variety of constructions for CEDFs based on graceful labellings ($\alpha$-valuations) of lexicographic products $C_n \boldsymbol{\cdot} K_{\ell}^c$, where $C_n$ denotes a cycle of length $n$. SCEDFs having more than two subsets do not exist. However, we can construct close approximations (more specifically, certain types of circular algebraic manipulation detection (AMD) codes) using the theory of cyclotomic numbers in finite fields.

In situations where every item in a data set must be compared with every other item in the set, it may be desirable to store the data across a number of machines in such a way that any two data items are stored together on at least one machine. One way to evaluate the efficiency of such a distribution is by the largest fraction of the data it requires to be allocated to any one machine. The all-to-all comparison (ATAC) data limit for $m$ machines is a measure of the minimum of this value across all possible such distributions. In this paper we further the study of ATAC data limits. We observe relationships between them and the previously studied combinatorial parameters of fractional matching numbers and covering numbers. We also prove a lower bound on the ATAC data limit that improves on one of Hall, Kelly and Tian, and examine the special cases where equality in this bound is possible. Finally, we investigate the data limits achievable using various classes of combinatorial designs. In particular, we examine the cases of transversal designs and projective Hjelmslev planes., Comment: 16 pages, 1 figure

Various notions of non-malleable secret sharing schemes have been considered. In this paper, we review the existing work on non-malleable secret sharing and suggest a novel game-based definition. We provide a new construction of an unconditionally secure non-malleable threshold scheme with respect to a specified relation. To do so, we introduce a new type of algebraic manipulation detection (AMD) code and construct examples of new variations of external difference families, which are of independent combinatorial interest.

A $k$-dispersed labelling of a graph $G$ on $n$ vertices is a labelling of the vertices of $G$ by the integers $1, \dots , n$ such that $d(i,i+1) \geq k$ for $1 \leq i \leq n-1$. $DL(G)$ denotes the maximum value of $k$ such that $G$ has a $k$-dispersed labelling. In this paper, we study upper and lower bounds on $DL(G)$. Computing $DL(G)$ is NP-hard. However, we determine the exact values of $DL(G)$ for cycles, paths, grids, hypercubes and complete binary trees. We also give a product construction and we prove a degree-based bound., Comment: To be published in Australasian Journal of Combinatorics

In this paper, we study skew frame starters, which are strong frame starters that satisfy an additional "skew" property. We prove three new non-existence results for cyclic skew frame starters of certain types. We also construct several small examples of previously unknown cyclic skew frame starters by computer.

Non-overlapping codes have been studied for almost 60 years. In such a code, no proper, non-empty prefix of any codeword is a suffix of any codeword. In this paper, we study codes in which overlaps of certain specified sizes are forbidden. We prove some general bounds and we give several constructions in the case of binary codes. Our techniques also allow us to provide an alternative, elementary proof of a lower bound on non-overlapping codes due to Levenshtein in 1964., Comment: 17 pages. Theorems etc renumbered

In this expository paper, I survey Room frames and Kirkman frames, concentrating on the early history of these objects. I mainly look at the basic construction techniques, but I also provide some historical remarks and discussion. I also briefly discuss some other types of frames that have been investigated as well as some applications of frames to the construction of other types of designs.

In this paper, I survey frame starters, as well as orthogonal and strong frame starters, in abelian groups. I mainly recall and re-examine existence and nonexistence results, but I will prove some new results as well.

The integer $\beta (\rho, v, k)$ is defined to be the maximum number of blocks in any $(v, k)$-packing in which the maximum partial parallel class (or PPC) has size $\rho$. This problem was introduced and studied by Stinson for the case $k=3$. Here, we mainly consider the case $k = 4$ and we obtain some upper bounds and lower bounds on $\beta (\rho, v, 4)$. We also provide some explicit constructions of $(v,4)$-packings having a maximum PPC of a given size $\rho$. For small values of $\rho$, the number of blocks of the constructed packings are very close to the upper bounds on $\beta (\rho, v, 4)$. Some of our methods are extended to the cases $k > 4$.

Sport climbing was a new Olympic event introduced at the Tokyo 2020 Olympics. It was composed of three disciplines, and the final rankings were determined by computing the product of each climber's rankings in the three disciplines, with the lowest score winning. In this paper, we compare this product-based scoring method with the more usual sum-based method. As well, we propose and analyze a new method based on taking the sum of the square roots of each climber's rankings.

In this paper, we initiate a study of asymmetric all-or-nothing transforms (or asymmetric AONTs). A (symmetric) $t$-all-or-nothing transform is a bijective mapping defined on the set of $s$-tuples over a specified finite alphabet. It is required that knowledge of all but $t$ outputs leaves any $t$ inputs completely undetermined. There have been numerous papers developing the theory of AONTs as well as presenting various applications of AONTs in cryptography and information security. In this paper, we replace the parameter $t$ by two parameters $t_o$ and $t_i$, where $t_i \leq t_o$. The requirement is that knowledge of all but $t_o$ outputs leaves any $t_i$ inputs completely undetermined. When $t_i < t_o$, we refer to the AONT as asymmetric. We give several constructions and bounds for various classes of asymmetric AONTs, especially those with $t_i = 1$ or $t_i = 2$. We pay particular attention to linear transforms, where the alphabet is a finite field $\mathbb{F}_q$ and the mapping is linear.

A splitting BIBD is a type of combinatorial design that can be used to construct splitting authentication codes with good properties. In this paper we show that a design-theoretic approach is useful in the analysis of more general splitting authentication codes. Motivated by the study of algebraic manipulation detection (AMD) codes, we define the concept of a group generated splitting authentication code. We show that all group-generated authentication codes have perfect secrecy, which allows us to demonstrate that algebraic manipulation detection codes can be considered to be a special case of an authentication code with perfect secrecy. We also investigate splitting BIBDs that can be "equitably ordered". These splitting BIBDs yield authentication codes with splitting that also have perfect secrecy. We show that, while group generated BIBDs are inherently equitably ordered, the concept is applicable to more general splitting BIBDs. For various pairs $(k,c)$, we determine necessary and sufficient (or almost sufficient) conditions for the existence of $(v, k \times c,1)$-splitting BIBDs that can be equitably ordered. The pairs for which we can solve this problem are $(k,c) = (3,2), (4,2), (3,3)$ and $(3,4)$, as well as all cases with $k = 2$.

All-or-nothing transforms have been defined as bijective mappings on all s-tuples over a specified finite alphabet. These mappings are required to satisfy certain "perfect security" conditions specified using entropies of the probability distribution defined on the input s-tuples. Alternatively, purely combinatorial definitions of AONTs have been given, which involve certain kinds of "unbiased arrays". However, the combinatorial definition makes no reference to probability definitions. In this paper, we examine the security provided by AONTs that satisfy the combinatorial definition. The security of the AONT can depend on the underlying probability distribution of the s-tuples. We show that perfect security is obtained from an AONT if and only if the input s-tuples are equiprobable. However, in the case where the input s-tuples are not equiprobable, we still achieve a weaker security guarantee. We also consider the use of randomized AONTs to provide perfect security for a smaller number of inputs, even when those inputs are not equiprobable.

For an integer $\rho$ such that $1 \leq \rho \leq v/3$, define $\beta(\rho,v)$ to be the maximum number of blocks in any partial Steiner triple system on $v$ points in which the maximum partial parallel class has size $\rho$. We obtain lower bounds on $\beta(\rho,v)$ by giving explicit constructions, and upper bounds on $\beta(\rho,v)$ result from counting arguments. We show that $\beta(\rho,v) \in \Theta (v)$ if $\rho$ is a constant, and $\beta(\rho,v) \in \Theta (v^2)$ if $\rho = v/c$, where $c$ is a constant. When $\rho$ is a constant, our upper and lower bounds on $\beta(\rho,v)$ differ by a constant that depends on $\rho$. Finally, we apply our results on $\beta(\rho,v)$ to obtain infinite classes of sequenceable partial Steiner triple systems.

We prove new existence and nonexistence results for modular Golomb rulers in this paper. We completely determine which modular Golomb rulers of order $k$ exist, for all $k\leq 11$, and we present a general existence result that holds for all $k \geq 3$. We also derive new nonexistence results for infinite classes of modular Golomb rulers and related structures such as difference packings, optical orthogonal codes, cyclic Steiner systems and relative difference families., Comment: Typos in Corollary 3.4 were corrected

We define a new type of Golomb ruler, which we term a resolvable Golomb ruler. These are Golomb rulers that satisfy an additional "resolvability" condition that allows them to generate resolvable symmetric configurations. The resulting configurations give rise to progressive dinner parties. In this paper, we investigate existence results for resolvable Golomb rulers and their application to the construction of resolvable symmetric configurations and progressive dinner parties. In particular, we determine the existence or nonexistence of all possible resolvable symmetric configurations and progressive dinner parties having block size at most 13, with nine possible exceptions. For arbitrary block size k, we prove that these designs exist if the number of points is divisible by k and at least k^3.

I recently came across a combinatorial design problem involving progressive dinner parties (also known as safari suppers). In this note, I provide some elementary methods of designing schedules for these kinds of dinner parties., Comment: revised version corrects a few small typos and removes the exception in Theorem 3.7

In this paper, we show a "direct" equivalence between certain authentication codes and robust secret sharing schemes. It was previously known that authentication codes and robust secret sharing schemes are closely related to similar types of designs, but direct equivalences had not been considered in the literature. Our new equivalences motivate the consideration of a certain "key-substitution attack." We study this attack and analyze it in the setting of "dual authentication codes." We also show how this viewpoint provides a nice way to prove properties and generalizations of some known constructions.

A cyclic ordering of the points in a Mendelsohn triple system of order $v$ (or MTS$(v)$) is called a sequencing. A sequencing $D$ is $\ell$-good if there does not exist a triple $(x,y,z)$ in the MTS$(v)$ such that (1) the three points $x,y,$ and $z$ occur (cyclically) in that order in $D$; and (2) $\{x,y,z\}$ is a subset of $\ell$ cyclically consecutive points of $D$. In this paper, we prove some upper bounds on $\ell$ for MTS$(v)$ having $\ell$-good sequencings and we prove that any MTS$(v)$ with $v \geq 7$ has a $3$-good sequencing. We also determine the optimal sequencings of every MTS$(v)$ with $v \leq 10$.

A Mendelsohn triple system of order $v$ (or MTS$(v)$) is a decomposition of the complete graph into directed 3-cyles. We denote the directed 3-cycle with edges $(x,y)$, $(y,z)$ and $(z,x)$ by $(x,y,z)$, $(y,z,x)$ or $(z,x,y)$. An $\ell$-good sequencing of a MTS$(v)$ is a permutation of the points of the design, say $[x_1 \; \cdots \; x_v]$, such that, for every triple $(x,y,z)$ in the design, it is not the case that $x = x_i$, $y = x_j$ and $z = x_k$ with $i < j < k$ and $k-i+1 \leq \ell$; or with $j < k < i$ and $i-j+1 \leq \ell$; or with $k < i < j$ and $j-k+1 \leq \ell$., Comment: 121 pages

A directed triple system of order $v$ (or, DTS$(v)$) is decomposition of the complete directed graph $\vec{K_v}$ into transitive triples. A $v$-good sequencing of a DTS$(v)$ is a permutation of the points of the design, say $[x_1 \; \cdots \; x_v]$, such that, for every triple $(x,y,z)$ in the design, it is not the case that $x = x_i$, $y = x_j$ and $z = x_k$ with $i < j < k$. We prove that there exists a DTS$(v)$ having a $v$-good sequencing for all positive integers $v \equiv 0,1 \bmod {3}$. Further, for all positive integers $v \equiv 0,1 \bmod {3}$, $v \geq 7$, we prove that there is a DTS$(v)$ that does not have a $v$-good sequencing. We also derive some computational results concerning $v$-good sequencings of all the nonisomorphic DTS$(v)$ for $v \leq 7$.

A directed triple system of order $v$ (or, DTS$(v)$) is a decomposition of the complete directed graph $\vec{K_v}$ into transitive triples. An $\ell$-good sequencing of a DTS$(v)$ is a permutation of the points of the design, say $[x_1 \; \cdots \; x_v]$, such that, for every triple $(x,y,z)$ in the design, it is $not$ the case that $x = x_i$, $y = x_j$ and $z = x_k$ with $i < j < k$ and $k-i+1 \leq \ell$. In this report we provide a maximum $\ell$-good sequencing for each DTS$(v)$, $v \leq 7$., Comment: 305 pages

An $\ell$-good sequencing of an STS$(v)$ is a permutation of the points of the design such that no $\ell$ consecutive points in this permutation contain a block of the design. We prove that, for every integer $\ell \geq 3$, there is an $\ell$-good sequencing of any STS$(v)$ provided that $v$ is sufficiently large. We also prove some new nonexistence results for $\ell$-good sequencings of STS$(v)$.

A partial Steiner triple system is is $sequenceable$ if the points can be sequenced so that no proper segment can be partitioned into blocks. We show that, if $0 \leq a \leq (n-1)/3$, then there exists a nonsequenceable PSTS$(n)$ of size $\frac{1}{3}\binom{n}{2}-a$, for all $n \equiv 1 \pmod{6}$ except for $n=7$.

Given an STS(v), we ask if there is a permutation of the points of the design such that no $\ell$ consecutive points in this permutation contain a block of the design. Results are obtained in the cases $\ell = 3,4$.

We construct orthogonal arrays OA$_{\lambda} (k,n)$ (of strength two) having a row that is repeated $m$ times, where $m$ is as large as possible. In particular, we consider OAs where the ratio $m / \lambda$ is as large as possible; these OAs are termed optimal. We provide constructions of optimal OAs for any $k \geq n+1$, albeit with large $\lambda$. We also study basic OAs; these are optimal OAs in which $\gcd(m,\lambda) = 1$. We construct a basic OA with $n=2$ and $k =4t+1$, provided that a Hadamard matrix of order $8t+4$ exists. This completely solves the problem of constructing basic OAs wth $n=2$, modulo the Hadamard matrix conjecture.

In this expository paper, we mainly study orthogonal arrays (OAs) of strength two having a row that is repeated $m$ times. It turns out that the Plackett-Burman bound (\cite{PB}) can be strengthened by a factor of $m$ for orthogonal arrays of strength two that contain a row that is repeated $m$ times. This is a consequence of a more general result due to Mukerjee, Qian and Wu \cite{Muk} that applies to orthogonal arrays of arbitrary strength $t$. We examine several proofs of the Plackett-Burman bound and discuss which of these proofs can be strengthened to yield the aforementioned bound for OAs of strength two with repeated rows. We also briefly discuss related bounds for $t$-designs, and OAs of strength $t$, when $t > 2$.

A repairable threshold scheme (which we abbreviate to RTS) is a $(\tau,n)$-threshold scheme in which a subset of players can "repair" another player's share in the event that their share has been lost or corrupted. This will take place without the participation of the dealer who set up the scheme. The repairing protocol should not compromise the (unconditional) security of the threshold scheme. Combinatorial repairable threshold schemes (or combinatorial RTS) were recently introduced by Stinson and Wei. In these schemes, "multiple shares" are distributed to each player, as defined by a suitable combinatorial design called the distribution design. In this paper, we study the reliability of these combinatorial repairable threshold schemes in a setting where players may not be available to take part in a repair of a given player's share. Using techniques from network reliability theory, we consider the probability of existence of an available repair set, as well as the expected number of available repair sets, for various types of distribution designs.

The purpose of this paper is to describe and analyze the Cayley-Purser algorithm, which is a public-key cryptosystem proposed by Flannery in 1999. I will present two attacks on it, one of which is apparently new. I will also examine a variant of the Cayley-Purser algorithm that was patented by Slavin in 2008, and show that it is also insecure., Comment: submitted for publication

We consider ordered pairs $(X,\mathcal{B})$ where $X$ is a finite set of size $v$ and $\mathcal{B}$ is some collection of $k$-element subsets of $X$ such that every $t$-element subset of $X$ is contained in exactly $\lambda$ "blocks" $B\in \mathcal{B}$ for some fixed $\lambda$. We represent each block $B$ by a zero-one vector $\mathbf{c}_B$ of length $v$ and explore the ideal $\mathcal{I}(\mathcal{B})$ of polynomials in $v$ variables with complex coefficients which vanish on the set $\{ \mathbf{c}_B \mid B \in \mathcal{B}\}$. After setting up the basic theory, we investigate two parameters related to this ideal: $\gamma_1(\mathcal{B})$ is the smallest degree of a non-trivial polynomial in the ideal $\mathcal{I}(\mathcal{B})$ and $\gamma_2(\mathcal{B})$ is the smallest integer $s$ such that $\mathcal{I}(\mathcal{B})$ is generated by a set of polynomials of degree at most $s$. We first prove the general bounds $t/2 < \gamma_1(\mathcal{B}) \le \gamma_2(\mathcal{B}) \le k$. Examining important families of examples, we find that, for symmetric 2-designs and Steiner systems, we have $\gamma_2(\mathcal{B}) \le t$. But we expect $\gamma_2(\mathcal{B})$ to be closer to $k$ for less structured designs and we indicate this by constructing infinitely many triple systems satisfying $\gamma_2(\mathcal{B})=k$., Comment: 26 pages, 1 figure

In 1996, Jackson and Martin proved that a strong ideal ramp scheme is equivalent to an orthogonal array. However, there was no good characterization of ideal ramp schemes that are not strong. Here we show the equivalence of ideal ramp schemes to a new variant of orthogonal arrays that we term augmented orthogonal arrays. We give some constructions for these new kinds of arrays, and, as a consequence, we also provide parameter situations where ideal ramp schemes exist but strong ideal ramp schemes do not exist.

A $(t, s, v)$-all-or-nothing transform is a bijective mapping defined on $s$-tuples over an alphabet of size $v$, which satisfies the condition that the values of any $t$ input co-ordinates are completely undetermined, given only the values of any $s-t$ output co-ordinates. The main question we address in this paper is: for which choices of parameters does a $(t, s, v)$-all-or-nothing transform (AONT) exist? More specifically, if we fix $t$ and $v$, we want to determine the maximum integer $s$ such that a $(t, s, v)$-AONT exists. We mainly concentrate on the case $t=2$ for arbitrary values of $v$, where we obtain various necessary as well as sufficient conditions for existence of these objects. We consider both linear and general (linear or nonlinear) AONT. We also show some connections between AONT, orthogonal arrays and resilient functions., Comment: 13 pages

In this paper, we study the existence of $(v,m,k,\lambda)$-strong external difference families (SEDFs). We use character-theoretic techniques to show that no SEDF exists when $v$ is prime, $k > 1$ and $m > 2$. In the case where $v$ is the product of two distinct odd primes, some necessary conditions are derived, which can be used to rule out certain parameter sets. Further, we show that, when $m=3$ or $4$ and $v > m$, a $(v,m,k,\lambda)$-SEDF does not exist., Comment: Revision notes: Result on abelian 2-groups has been retracted. Other minor errors corrected; notational consistency is improved

In this paper, we consider methods whereby a subset of players in a $(k,n)$-threshold scheme can "repair" another player's share in the event that their share has been lost or corrupted. This will take place without the participation of the dealer who set up the scheme. The repairing protocol should not compromise the (unconditional) security of the threshold scheme, and it should be efficient, where efficiency is measured in terms of the amount of information exchanged during the repairing process. We study two approaches to repairing. The first method is based on the "enrollment protocol" from \cite{NSG} which was originally developed to add a new player to a threshold scheme (without the participation of the dealer) after the scheme was set up. The second method distributes "multiple shares" to each player, as defined by a suitable combinatorial design. This method results in larger shares, but lower communication complexity, as compared to the first method.

There has been considerable recent interest in "cloud storage" wherein a user asks a server to store a large file. One issue is whether the user can verify that the server is actually storing the file, and typically a challenge-response protocol is employed to convince the user that the file is indeed being stored correctly. The security of these schemes is phrased in terms of an extractor which will recover the file given any "proving algorithm" that has a sufficiently high success probability. This forms the basis of \emph{proof-of-retrievability} ($\mathsf{PoR}$) systems. In this paper, we study multiple server $\mathsf{PoR}$ systems. We formalize security definitions for two possible scenarios: (i) when a threshold of servers succeed with high enough probability (worst-case) and (ii) when the average of the success probability of all the servers is above a threshold (average-case). We also motivate the study of confidentiality of the outsourced message. We give $\mathsf{M}\mbox{-}\mathsf{PoR}$ schemes which are secure under both these security definitions and provide reasonable confidentiality guarantees even when there is no restriction on the computational power of the servers. We also show how classical statistical techniques used by Paterson, Stinson and Upadhyay (Journal of Mathematical Cryptology: 7(3)) can be extended to evaluate whether the responses of the provers are accurate enough to permit successful extraction. We also look at one specific instantiation of our construction when instantiated with the unconditionally secure version of the Shacham-Waters scheme (Asiacrypt, 2008). This scheme gives reasonable security and privacy guarantee. We show that, in the multi-server setting with computationally unbounded provers, one can overcome the limitation that the verifier needs to store as much secret information as the provers., Comment: 22 pages

We continue a study of unconditionally secure all-or-nothing transforms (AONT) begun in \cite{St}. An AONT is a bijective mapping that constructs s outputs from s inputs. We consider the security of t inputs, when s-t outputs are known. Previous work concerned the case t=1; here we consider the problem for general t, focussing on the case t=2. We investigate constructions of binary matrices for which the desired properties hold with the maximum probability. Upper bounds on these probabilities are obtained via a quadratic programming approach, while lower bounds can be obtained from combinatorial constructions based on symmetric BIBDs and cyclotomy. We also report some results on exhaustive searches and random constructions for small values of s., Comment: 23 pages

In this paper, we present a new lower bound on the size of separating hash families of type {w_1^{q-1},w_2} where w_1 < w_2. Our result extends the paper by Guo et al. on binary frameproof codes. This bound compares well against known general bounds, and is especially useful when trying to bound the size of strong separating hash families. We also show that our new bound is tight by constructing hash families that meet the new bound with equality.

This paper provides a mathematical analysis of optimal algebraic manipulation detection (AMD) codes. We prove several lower bounds on the success probability of an adversary and we then give some combinatorial characterizations of AMD codes that meet the bounds with equality. These characterizations involve various types of generalized difference families. Constructing these difference families is an interesting problem in its own right.