<P></P>
  <LI><EM>Self-Delegation with Controlled Propagation -- or -- What If You Lose 
  Your Laptop</EM><BR>by Oded Goldreich and Birgit Pfitzmann and Ronald L. 
  Rivest<BR><EM>Proceedings CRYPTO '98</EM> (Springer-Verlag, Lecture Notes in 
  Computer Science No. 1462, Hugo Krawczyk(ed), 1998), pages 153--168. (Also 
  Cryptology ePrint Archive 1997/012.)<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/GoldreichPfitzmannRivest-SelfDelegationWithControlledPropagation.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/GoldreichPfitzmannRivest-SelfDelegationWithControlledPropagation.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>The Security of the RC6 Block Cipher</EM><BR>by Scott Contini, Ronald 
  L. Rivest, M.J.B. Robshaw, and Yiqun Lisa Yin.<BR>Posted at <A 
  href="http://www.rsa.com/rsalabs/rc6">RSA's RC6 page.</A> (August 20, 1998) 
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/ContiniRivestRobshawYin-TheSecurityOfTheRC6BlockCipher.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/ContiniRivestRobshawYin-TheSecurityOfTheRC6BlockCipher.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>The RC6 Block Cipher</EM><BR>by Ronald L. Rivest, M.J.B. Robshaw, R. 
  Sidney, and Y.L. Yin<BR>Posted at <A 
  href="http://www.rsa.com/rsalabs/rc6">RSA's RC6 page.</A> (Version 1.1; August 
  20, 1998). 
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rc6.ps">postscript</A> or <A 
    href="http://theory.lcs.mit.edu/~rivest/rc6.pdf">pdf</A><BR>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rc6aes.ppt">Powerpoint slides 
    from AES1 conference (8/21/1998).</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rc6-notes.txt">Further notes 
    on RC6</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rc6-final-4.ppt">Powerpoint 
    slides from AES3 conference (4/14/2000).</A> </LI></UL>
  <P></P>
  <LI><EM>Can We Eliminate Certificate Revocation Lists?</EM><BR>by Ronald L. 
  Rivest<BR>(Proceedings of Financial Cryptography '98; Springer Lecture Notes 
  in Computer Science No. 1465 (Rafael Hirschfeld, ed.), February 1998), pages 
  178--183.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CanWeEliminateCertificateRevocationLists.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CanWeEliminateCertificateRevocationLists.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>On the Design and Security of RC2</EM><BR>By Lars R. Knudsen, Vincent 
  Rijmen, Ronald L. Rivest, and M.J.B. Robshaw.<BR>(Proceedings Fifth Fast 
  Software Encryption Workshop FSE '98, (Springer Lecture Notes in Computer 
  Science, No. 1372, March 1998, Serge Vaudenay (ed.)), pages 206--221.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/rc2-fse.ps">postscript</A> or 
    <A href="http://theory.lcs.mit.edu/~rivest/rc2-fse.pdf">pdf</A> </LI></UL>
  <P></P>
  <LI><EM>Chaffing and Winnowing: Confidentiality without Encryption</EM><BR>by 
  Ronald L. Rivest.<BR><EM>CryptoBytes</EM> (RSA Laboratories), volume 4, number 
  1 (summer 1998), 12--17.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/chaffing.txt">Version of 
    March 18, 1998</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/chaff.ppt">``Chaffing and 
    Winnowing'' and Comments on Crypto Policy (Powerpoint slides)</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/chaffing-980701.txt">Version 
    of July 1, 1998</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/chaffing-remarks.txt">Some 
    further remarks on winnowing and chaffing. (November 14, 2000.</A> </LI></UL>
  <P></P>
  <LI><EM>Cryptography as Duct Tape</EM><BR>by Ronald L. Rivest<BR>(a short note 
  written to the Senate Commerce and Judiciary Committees in opposition to 
  mandatory key recovery proposals).<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/ducttape.txt">Version of June 
    12, 1997</A> </LI></UL>
  <P></P>
  <LI><EM>The Risks of Key Recovery, Key Escrow, and Trusted Third Party 
  Encryption</EM><BR>By Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh 
  Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Peter G. Neumann, Ronald 
  L. Rivest, Jeffery I. Schiller, and Bruce Schneier.<BR>May, 1997.<BR>
  <UL>
    <LI><A href="http://www.crypto.com/key_study/">Report Home Page at 
    CDT</A><BR></LI></UL>
  <P></P>
  <LI><EM>Electronic Lottery Tickets as Micropayments</EM>,<BR>by Ronald L. 
  Rivest.<BR>Proceedings of Financial Cryptography '97 Conference, Springer 
  Lecture Notes in Computer Science #1318 (1997), 307--314.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/lottery.ps">postscript</A> or 
    <A href="http://theory.lcs.mit.edu/~rivest/lottery.pdf">pdf</A> </LI></UL>
  <P></P>
  <LI><EM>Perspectives on Financial Cryptography</EM><BR>by Ronald L. 
  Rivest.<BR>Proceedings of Financial Cryptography '97 Conference, Springer 
  Lecture Notes in Computer Science #1318 (1997), 145--149.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/fc97-paper.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/fc97-paper.pdf">pdf</A> 
    <LI><A href="http://theory.lcs.mit.edu/~rivest/fc97-slides.ppt">PowerPoint 
    slides</A> </LI></UL>
  <P></P>
  <LI>SDSI---A Simple Distributed Security Infrastructure<BR>(By Ronald L. 
  Rivest and Butler Lampson).<BR>(See also the <A 
  href="http://theory.lcs.mit.edu/~cis/sdsi.html">SDSI Page</A>)<BR>
  <UL>
    <LI>[Version 1.0]<BR>
    <UL>
      <LI><A href="http://theory.lcs.mit.edu/~rivest/sdsi10.html">html</A> or <A 
      href="http://theory.lcs.mit.edu/~rivest/sdsi10.ps">postscript</A> 
      <LI>Powerpoint slides: <A 
      href="http://theory.lcs.mit.edu/~rivest/sdsi10-usenix.ppt">USENIX '96</A>, 
      <A href="http://theory.lcs.mit.edu/~rivest/sdsi10-rsalab96.ppt">RSA-Labs 
      '96</A>, <A 
      href="http://theory.lcs.mit.edu/~rivest/sdsi10-crypto96b.ppt">CRYPTO 
      '96</A> </LI></UL>
    <LI>[Version 1.1]<BR>
    <UL>
      <LI><A 
      href="http://theory.lcs.mit.edu/~rivest/sdsi11.html">html</A><BR></LI></UL>
    <LI>[Version 2.0]<BR>
    <UL>
      <LI><A 
      href="http://theory.lcs.mit.edu/~rivest/sdsi20-maryland.ppt">PowerPoint 
      slides for Maryland Theoretical Computer Science Day 4/11/97</A> 
    <BR></LI></UL></LI></UL>
  <P></P>
  <LI><EM>All-Or-Nothing Encryption and The Package Transform</EM><BR>by Ronald 
  L. Rivest.<BR>Proceedings of the 1997 Fast Software Encryption Conference. 
  Springer Lecture Notes in Computer Science #1267 (1997), 210--218.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/fusion.ps">postscript</A> or 
    <A href="http://theory.lcs.mit.edu/~rivest/fusion.pdf">pdf</A> </LI></UL>
  <P></P>
  <LI><EM>Minimal Key Lengths for Symmetric Ciphers to Provide Adequate 
  Commercial Security</EM><BR>by Matt Blaze, Whitfield Diffie, Ronald L. Rivest, 
  Bruce Schneier, Tsutomu Shimomura, Eric Thompson, and Michael Wiener.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/bsa-final-report.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/bsa-final-report.pdf">pdf</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/bsa-final-report.txt">text</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Translucent Cryptography---An Alternative to Key Escrow, and its 
  Implementation via Fractional Oblivious Transfer</EM><BR>by Mihir Bellare and 
  Ronald L. Rivest.<BR>MIT/LCS Technical Report 683 (18 Feb 1996):<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/BellareRivest-translucent.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BellareRivest-translucent.pdf">pdf</A> 
    </LI></UL>Journal of Cryptology</A> (vol. 12, no. 2, Spring 1999, pages 
  117--140):<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/BellareRivest-translucent2.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BellareRivest-translucent2.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Multi-grade cryptography</EM><BR>by Ronald L. Rivest<BR>Unpublished 
  manuscript.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-multigrade.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/Rivest-multigrade.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Time-lock puzzles and timed-release Crypto</EM><BR>by Ronald L. 
  Rivest, Adi Shamir, and David A. Wagner.<BR>(This has appeared as LCS 
  technical memo MIT/LCS/TR-684 (February 1996).)<BR>
  <UL>
    <LI>Version of 3/10/96: <A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamirWagner-timelock.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamirWagner-timelock.pdf">pdf</A><BR></LI></UL>
  <P></P>
  <LI><EM>Geometric Cryptography</EM><BR>by Mike Burmester, Ronald L. Rivest, 
  and Adi Shamir.<BR>Unpublished.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/BurmesterRivestShamir-geometric.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/BurmesterRivestShamir-geometric.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>PayWord and MicroMint--Two Simple Micropayment Schemes</EM><BR>by 
  Ronald L. Rivest and Adi Shamir.<BR>CryptoBytes, volume 2, number 1 (RSA 
  Laboratories, Spring 1996), 7--11.<BR>Also in <EM>Proceedings of 1996 
  International Workshop on Security Protocols</EM>, (ed. Mark Lomas), 
  (Springer, 1997), Lecture Notes in Computer Science No. 1189, pages 
69--87.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamir-mpay.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/RivestShamir-mpay.pdf">pdf</A> 

    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/RivestShamir-mpay.ppt">PowerPoint 
    slides for RSA '96 conference.</A> </LI></UL>
  <P></P>
  <LI><EM>The RC5 Encryption Algorithm</EM><BR>by Ronald L. 
  Rivest.<BR>Proceedings of the 1994 Leuven Workshop on Fast Software Encryption 
  (Springer 1995), pages 86-96.<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/Rivest-rc5.ps">postscript</A> 
    or <A href="http://theory.lcs.mit.edu/~rivest/Rivest-rc5.pdf">pdf</A> 
    <LI>3/20/97: <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-rc5rev.txt">correction 
    note</A>, revised <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-rc5rev.ps">postscript</A> or 
    <A href="http://theory.lcs.mit.edu/~rivest/Rivest-rc5rev.pdf">pdf</A> 
  </LI></UL>(Also see <A 
  href="http://theory.lcs.mit.edu/~rivest/Rivest-TheRC5EncryptionAlgorithm">The 
  RC5 Encryption Algorithm (pdf)</A> in <EM>Dr. Dobbs Journal</EM> number 226 
  (January 1995), pages 146-148.)<BR>
  <P></P>
  <LI><EM>The MD5 Message Digest Algorithm</EM><BR>by Ronald L. 
  Rivest.<BR>Internet RFC 1321 (April 1992).<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/Rivest-MD5.txt">text</A> 
  </LI></UL>
  <P></P>
  <LI><EM>The MD4 Message Digest Algorithm</EM><BR>by Ronald L. 
  Rivest.<BR>Internet RFC 1320 (April 1992).<BR>
  <UL>
    <LI><A href="http://theory.lcs.mit.edu/~rivest/Rivest-MD4.txt">text</A> 
  </LI></UL>
  <P></P>
  <LI><EM>Cryptography and Machine Learning</EM><BR>by Ronald L. 
  Rivest.<BR>Proceedings ASIACRYPT '91 (Springer 1993), 427--439.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CryptographyAndMachineLearning.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-CryptographyAndMachineLearning.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Finding Four Million Large Random Primes</EM><BR>by Ronald L. 
  Rivest.<BR>Proc. CRYPTO 90 (Springer 1991), 625--626.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-FindingFourMillionLargeRandomPrimes.ps">postscript</A> 
    or <A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-FindingFourMillionLargeRandomPrimes.pdf">pdf</A> 
    </LI></UL>
  <P></P>
  <LI><EM>Cryptography</EM><BR>by Ronald L. Rivest.<BR>Chapter 13 of 
  <EM>Handbook of Theoretical Computer Science</EM>, (ed. J. Van Leeuwen) vol. 1 
  (Elsevier, 1990), 717--755.<BR>
  <UL>
    <LI><A 
    href="http://theory.lcs.mit.edu/~rivest/Rivest-Cryptography.ps">postscript</A> 
    or <A