<P></P>
  <LI><EM>Tweakable Block Ciphers</EM><BR>by Moses Liskov, Ronald L. Rivest, and 
  David Wagner.<BR><EM>Proceedings CRYPTO 2002</EM> (Springer-Verlag, Lecture 
  Notes in Computer Science No. 2442, Moti Yung(ed.), 2002), pages 31--46. <BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/LiskovRivestWagner-TweakableBlockCiphers.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/LiskovRivestWagner-TweakableBlockCiphers.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Making Mix Nets Robust for Electronic Voting by Randomized Partial 
  Checking</EM><BR>by Markus Jakobsson, Ari Juels, and Ronald L. Rivest.<BR>In 
  D. Boneh, ed., USENIX Security '02, pp. 339-353. 2002.<BR>(Also available as 
  IACR eprint 2002/025.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/JakobssonJuelsRivest-MakingMixNetsRobustForElectronicVotingByRandomizedPartialChecking.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/JakobssonJuelsRivest-MakingMixNetsRobustForElectronicVotingByRandomizedPartialChecking.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Proxy-Based Security Protocols in Networked Mobile Devices</EM><BR>by 
  M. Burnside, D. Clarke, T. Mills, A. Maywah, S. Devadas, and R. 
  Rivest.<BR>Proceedings of the 17th ACM Symposium on Applied Computing 
  (Security Track), pages 265-272, March 2002.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/BurnsideClarkeMillsMaywahDevadasRivest-ProxyBasedSecurityProtocolsInNetworkedMobileDevices.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BurnsideClarkeMillsMaywahDevadasRivest-ProxyBasedSecurityProtocolsInNetworkedMobileDevices.pdf">pdf</A>. 
    </LI></UL>
  <P></P>
  <LI><EM>A Modular Voting Architecture (``Frogs'')</EM><BR>by Shuki Bruck, 
  David Jefferson, and Ronald L. Rivest.<BR>
  <UL>
    <LI>Paper in <A 
    href="http://theory.lcs.mit.edu/~rivest/BruckJeffersonRivest-AModularVotingArchitecture.doc">word</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BruckJeffersonRivest-AModularVotingArchitecture-doc.pdf">pdf</A> 

    <LI>Slides from presentation at WOTE '01 in <A 
    href="http://theory.lcs.mit.edu/~rivest/BruckJeffersonRivest-AModularVotingArchitecture.ppt">powerpoint</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BruckJeffersonRivest-AModularVotingArchitecture-ppt.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Voting---What is, What Could Be<BR>(July 2001 Report of the 
  CalTech-MIT Voting Technology Project)</EM> 
  <UL>
    <LI><A href="http://www.vote.caltech.edu/reports/2001report.htm">CalTechMIT 
    VTP Web Site for this Report</A> 
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/CalTechMITVTP-VotingWhatIsWhatCouldBe.pdf">pdf 
    copy</A> 
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CalTechMITVotingReportPressConferenceRemarks.txt">My 
    remarks at the July 16, 2001 press conference.</A> </LI></UL>
  <P></P>
  <LI><EM>How to Leak A Secret</EM><BR>by Ronald L. Rivest, Adi Shamir, and Yael 
  Tauman.<BR>ASIACRYPT 2001, pages 552--565. Lecture Notes in Computer Science 
  (ed. Colin Boyd), Volume 2248 (Springer). 
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamirTauman-HowToLeakASecret.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamirTauman-HowToLeakASecret.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Testimony on Security Issues in Voting Technology</EM><BR>(Testimony 
  given before the U.S. House Committee on Administration, May 24, 2001.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/rivest-may-24-01-testimony.txt">text</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/rivest-may-24-01-testimony.doc">Word</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Electronic Voting</EM><BR>(Slides for talk given for Cambridge Club at 
  Harvard Faculty Club, March 5, 2001.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting-2.ppt">ppt</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting-2-ppt.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Electronic Voting</EM><BR>(Corresponds to my remarks at a panel 
  discussion at Financial Cryptography '01, 2/19--2/22.)<BR>(To appear in the 
  Proceedings of Financial Cryptography '01.)<BR>
  <UL>
    <LI>Paper: <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting.pdf">pdf</A> 

    <LI>Slides for talk: <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting.ppt">ppt</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-ElectronicVoting-ppt.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Issues in Cryptography</EM><BR>Short luncheon talk given March 7, 2001 
  at Computers, Freedom, and Privacy 2001 Conference.<BR>
  <UL>
    <LI>Slides: <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-IssuesInCryptography.ppt">powerpoint</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-IssuesInCryptography.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Certificate Chain Discovery in SPKI/SDSI</EM><BR>by Dwaine Clarke, 
  Jean-Emile Elien, Carl Ellison, Matt Fredette, Alexander Morcos, and Ronald L. 
  Rivest.<BR>(To appear in JCS.) Draft of September 13, 2001. <BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/ClarkeElElFrMoRi-CertificateChainDiscoveryInSPKISDSI.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/ClarkeElElFrMoRi-CertificateChainDiscoveryInSPKISDSI.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Two Signature Schemes</EM><BR>(Slides from talk given at Cambridge 
  University October 17, 2000; one scheme (a transitive signature scheme for 
  undirected graphs) is joint work with Silvio Micali, the other scheme (a 
  prefix aggregation scheme) is joint work with Suresh Chari and Tal Rabin.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CambridgeTalk.pdf">pdf</A> 
    </LI></UL>Here is the paper for the first scheme:<BR><EM>Transitive Signature 
  Schemes</EM><BR>by Silvio Micali and Ronald L. Rivest.<BR>(Proceedings of the 
  Cryptographer's Track at the RSA Conference 2002, Bart Preneel (ed.), Springer 
  Verlag CT-RSA 2002, LNCS 2271, pages 236--243.) 
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/MicaliRivest-TransitiveSignatureSchemes.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/MicaliRivest-TransitiveSignatureSchemes.pdf">pdf</A> 
    </LI></UL>Here is the current draft of the paper for the second scheme, by 
  Chari, Rabin, and Rivest:<BR><EM>An Efficient Signature Scheme for Route 
  Aggregation</EM><BR>by Suresh Chari, Tal Rabin, and Ronald L. Rivest<BR>(Draft 
  of February 1, 2002.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/ChariRabinRivest-AnEfficientSignatureSchemeForRouteAggregation.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/ChariRabinRivest-AnEfficientSignatureSchemeForRouteAggregation.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Are ``Strong'' Primes Needed for RSA?</EM><BR>by Ronald L. Rivest and 
  Robert D. Silverman.<BR>
  <UL>
    <LI>(version 11/22/1999) <A 
    href="http://theory.lcs.mit.edu/~rivest/RivestSilverman-AreStrongPrimesNeededForRSA.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/RivestSilverman-AreStrongPrimesNeededForRSA.pdf">pdf</A> 

    <LI><A href="http://eprint.iacr.org/2001/007/">Paper 2001/007</A> of the 
    IACR Cryptology <A href="http://eprint.iacr.org/index.html">ePrint 
    archive</A> (version 12/1/1998) </LI></UL>
  <P></P>
  <LI><EM>Pseudonym Systems</EM><BR>by Anna Lysyanskaya, Ronald L. Rivest, Amit 
  Sahai, and Stefan Wolf.<BR><EM>Selected Areas in Cryptography '99</EM> 
  (Springer Verlag Lecture Notes in Computer Science No. 1758; edited by H. Heys 
  and C. Adams, 2000), pages 184--199.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/LysyanskayaRivestSahaiWolf-PseudonymSystems.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/LysyanskayaRivestSahaiWolf-PseudonymSystems.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Unconditionally Secure Commitment and Oblivious Transfer Schemes Using 
  Private Channels and a Trusted Initializer</EM> <BR>by Ronald L. 
  Rivest.<BR>Unpublished manuscript, 11/8/99.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-commitment.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/Rivest-commitment.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Permutation Polynomials modulo 2^w</EM><BR>by Ronald L. 
  Rivest.<BR>October 6, 1999. Revised October 25, 1999. <BR>In <EM>Finite Fields 
  and their Applications</EM> Volume 7 (2001), pages 287--292.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-PermutationPolynomialsModulo2w.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-PermutationPolynomialsModulo2w.pdf">pdf</A> 
    ; <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-PermutationPolynomialsModulo2w-copyright.html">(copyright 
    notice)</A> </LI></UL>
  <P></P>
  <LI><EM>The Beer Bottle Cipher</EM><BR>by Ronald L. Rivest.<BR>Posted here 
  June 30, 1999.<BR>Published in <EM>CCE Quarterly Journal</EM> 
  (PricewaterhouseCoopers Cryptographic Center of Excellence), Issue 3 (1999), 
  28--30.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/beer.txt">text</A></EM> 
  </LI></UL>
  <P></P>
  <LI><EM>The LCS35 Time Capsule Crypto-Puzzle (description, java code, and 
  puzzle parameters)</EM><BR>by Ronald L. Rivest<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/lcs35-puzzle-description.txt">description 
    with java code and puzzle parameters</A> or <A 
    href="http://theory.lcs.mit.edu/~rivest/lcs35-puzzle-code.java">java code 
    only</A> or <A 
    href="http://theory.lcs.mit.edu/~rivest/lcs35-puzzle.txt">puzzle parameters 
    only</A> 
    <LI><A href="http://www.lcs.mit.edu/news/crypto.html">LCS page on puzzle</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Improved Analysis of Some Simplified Variants of RC6</EM><BR>by Scott 
  Contini, Ronald L. Rivest, M.J.B. Robshaw, and Yiqun Lisa Yin.<BR>in 
  <EM>Proceedings Fast Software Encryption '99</EM> (Springer Verlag, Lecture 
  Notes in Computer Science No. 1636, Lars Knudsen(ed.), 1999), pages 1--15.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/ContiniRivestRobshawYin-ImprovedAnalysisOfSomeSimplifiedVariantsOfRC6.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/ContiniRivestRobshawYin-ImprovedAnalysisOfSomeSimplifiedVariantsOfRC6.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Some Thoughts on Serial Numbers on Intel CPU's</EM><BR>by Ronald L. 
  Rivest.<BR>Unpublished note, drafted January 26, 1999; revised in minor ways 
  on August 23, 1999 and posted here.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/intel.txt">text</A></LI></UL>
  <P></P>
  <LI><EM>SPKI Certificate Theory</EM><BR>by C. Ellison, B. Frantz, B. Lampson, 
  R. Rivest, B. Thomas, and T. Ylonen.<BR>Internet Network Working Group 
  RFC2693, September 1999.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rfc2693.txt">text</A></LI></UL>
  <P></P>
  <LI><EM>Simple Public Key Certificate</EM><BR>by C. Ellison, B. Frantz, B. 
  Lampson, R. Rivest, B. Thomas, and T. Ylonen.<BR>Internet Draft, July 26, 
  1999.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/simple-public-key-certificate.txt">text</A></LI></UL>
  <P></P>
  <LI><EM>SPKI Examples</EM><BR>by C. Ellison, B. Frantz, B. Lampson, R. Rivest, 
  B. Thomas, and T. Ylonen.<BR>Internet Draft, March 10, 1998.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/spki-examples.txt">text</A></LI></UL>
  <P></P>
  <LI><EM>The Case against Regulating Encryption Technology</EM><BR>by Ronald L. 
  Rivest.<BR>Scientific American, October 1998, pages 116--117. 
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/sciam98.txt">text</A></LI></UL>