On March 2, 2014, Scott Vanstone passed away at his home in Campbellville, Canada, after a short battle with cancer.

Scott completed his Ph.D. in 1974 under the supervision of Ron Mullin at the University of Waterloo. His Ph.D. thesis and much of his early work was in combinatorial design theory. In the 1980s he started working in cryptography. During his career, he made many contributions to the fields of design theory and cryptography. He was very influential in the development, standardization, deployment and commercialization of elliptic curve cryptography. He authored several widely-used books including An Introduction to Error Correction Codes with Applications (with Paul van Oorschot), Applications of Finite Fields (with Ian Blake, Shuhong Gao, Alfred Menezes, Ron Mullin and Tomik Yaghoobian), Handbook of Applied Cryptography (with Alfred Menezes and Paul van Oorschot), Guide to Elliptic Curve Cryptography (with Darrel Hankerson and Alfred Menezes), and Introduction to Mathematical Thinking: Algebra and Number Systems (with Will Gilbert). In 1990, he co-founded the journal Designs, Codes and Cryptography with Dieter Jungnickel and Ron Mullin, and served as its Editor-in-Chief until 1999.

This volume of Designs, Codes and Cryptography is a recognition of Scott’s contributions and influence in the areas of cryptography, coding theory, combinatorial design theory, and finite fields. It begins with tributes written by Dieter Jungnickel, Neal Koblitz, Esther Lamken, Peter Landrock and Ron Mullin, and complete lists of his Ph.D. students and publications. This is followed by the contributed papers, written by some of Scott’s close collaborators, colleagues and friends.

Scott had an impressive ability to determine interesting and important problems. His enthusiasm and imagination for research together with a tireless energy in pursuing it were hallmarks of his career. He was among the first to recognize the significance and potential of the discrete logarithm problem on elliptic curves, an area that generated enormous interest over the past few decades. His generosity in sharing his ideas and working with friends, colleagues and new researchers to the field was unparalleled. His wonderful sense of humour, outgoing personality and constant friendship will be missed by those of us fortunate enough to have known and worked with him.

1 Scott A. Vanstone (1947–2014)

figure a

1.1 Dieter Jungnickel

The first time Scott and I met was in May 1978, during an Oberwolfach meeting on Finite Geometries. We kept meeting at conferences, and in 1984 (when I was visiting the University of Toronto) Scott invited me for my first talk in Waterloo. We made plans for collaborating then, and during the years from 1986 to 1999 we published 17 joint papers. From 1985 to 1999, I visited Waterloo regularly, since 1994 as an Adjunct Professor. I am very grateful for this long and fruitful research collaboration. During one of my visits, we conceived the idea of starting a new high-level journal, which led to the foundation of Designs, Codes and Cryptography in 1990, jointly with Ron Mullin.

Of course I cannot describe everything we worked on, the areas ranging from designs and finite geometries via finite fields to graphs and codes. So I’ll just mention one topic in more detail, namely graphical codes. It had been known for some time that the cycle space of a connected graph G yields an interesting binary code, which goes back to pioneering papers by Bredeson and Hakimi in the late 1960s: if G has m edges, n vertices, and girth g, one obtains a binary \([m,m-n+1, g]\)-code. We decided to study this topic in more depth, which resulted in seven papers [167, 170, 171, 174, 175, 179, 180]. In particular, we analyzed two construction methods which can be used to augment the cycle space codes and which tend to produce graphical codes of large dimensions. We then used techniques from combinatorial optimization to devise decoding procedures which turned out to have basically linear complexity (in the length of the code) and were thus considerably more efficient than previous approaches to decoding graphical codes. These results were then also extended to ternary and even general q-ary codes.

Moreover, we found interesting connections between extensions of codes based on complete graphs, (shortened) Hamming codes, and codes with minimum distance 5. Finally, we also managed to apply graphical codes to graphical enumeration, where we gave an elegant proof of Read’s theorem on the generating function for the number of Eulerian graphs with p vertices and also obtained a new analogous result for bipartite Eulerian graphs.

It was a real privilege to know Scott, not only for our research but also very much on a personal level: over the years, a close friendship developed. I can recall a multitude of pleasant non-mathematical encounters, like going to the theatre or concerts or simply meeting for drinks or dinner, mostly in Canada but also several times when Scott came to Germany. I am sure that his legacy will remain alive for a long time, and that he will always be fondly remembered by his many friends and associates. Personally, I deeply miss him.

1.2 Neal Koblitz

I first met Scott at Crypto ’88. He had a few questions and observations about elliptic curve cryptography (ECC) and told me about the work he was doing on implementation. At that time he was the only person I knew who believed that ECC could be commercialized in the immediate future as a practical alternative to RSA.

Soon after, he invited me to visit Waterloo, where he was leading an interdisciplinary team that had developed improved algorithms and chips for finite field arithmetic and was starting to do the same for elliptic curve computations. Scott’s team of mathematicians, computer scientists, and engineers, which included faculty, graduate students, and even undergraduates, was ahead of its time. This was well before “transdisciplinarity,” “vertical integration,” and “undergraduate research” became buzzwords in academia.

Many researchers work on problems in math and computer science that are peripherally related to cryptography and obtain results that have little or no significance for real-world data security. Not Scott. He consistently focused on mathematical problems that are of central importance in practice. For example, in 1993, in joint work with Menezes and Okamoto [159], he found the first successful attack on the Elliptic Curve Discrete Log Problem (whose assumed intractability forms the basis of ECC) that applies to an important class of curves (those with “low embedding degree”). In the 1990s Scott designed the Elliptic Curve Digital Signature Algorithm (ECDSA) and worked hard to get it standardized and deployed. The ECDSA has stood the test of time and today is widely used in applications ranging from smartphones to Bitcoin.

Scott had a delightful sense of humor and sense of fun. After the movie “Sneakers” came out in 1992, he and I were discussing whether it might stimulate more public interest in cryptography. Scott thought it would be cool for the IACR to give Robert Redford, the star of the film, a special award at the next Crypto meeting. Scott was on the IACR Board, but when he proposed it, other Board members thought it would be undignified for a high-brow academic conference to give such an award, and they rejected the idea.

Scott was also generous—to students, colleagues, and philanthropic causes. He and his wife Sherry Shannon-Vanstone have made large annual donations to support the Kovalevskaia Grants for Mexican women mathematicians, a joint project of the Kovalevskaia Fund and the Mexican Mathematical Society.

Scott was an inspiration to those who knew him.

1.3 Esther Lamken

Scott’s first love in mathematics was combinatorial design theory. He wrote his thesis in 1974 on the structure of \((r,\lambda )\)-designs. This was an exciting time to be in design theory; the Kirkman Schoolgirl Problem and the Room square problem (both from the 1850s) had recently been solved. It was the beginning of a period of tremendous growth in design theory and Scott contributed greatly to this growth with over 130 papers in design theory and related areas of coding theory. He made fundamental contributions to several areas of design theory, and his early results included work on mutually orthogonal Latin squares, \((r,\lambda )\)-designs, balanced tournament designs, and Howell designs. He was a master of combinatorial constructions and recursions and one of the first to use computers and combinatorial searches for designs. Direct constructions (often rooted in algebraic constructions and geometry) combined with combinatorial recursions allowed him to completely settle several existence problems.

One of Scott’s most important contributions in design theory was his work on designs with orthogonal resolutions. Scott’s interest in coding theory had led him to investigate equidistant permutation arrays which can be thought of as error correcting codes. In [10], Scott (with Deza and Mullin) showed that doubly resolvable balanced incomplete block designs could be used to construct EPAs. This began a fruitful investigation on designs with orthogonal resolutions; a few early noteworthy papers are [11, 16, 27, 31, 41, 42, 45, 46, 51]. With the smallest case (Room squares) settled, Scott turned his attention to larger block sizes. Scott had an amazing talent for discovering and seeing structure in finite geometries and he discovered new connections between finite projective and affine geometries and designs with orthogonal resolutions. With Ryoh Fuji-Hara (his first PhD student), he did a considerable amount of work on orthogonal resolutions of lines in geometries. They constructed the first infinite classes of doubly resolvable BIBDs for prime power block sizes. Scott spent a great deal of time and effort on the existence of DR(v, 3, 1)-BIBDs which he called Kirkman squares. He encouraged many of us to work on this difficult problem, a generalization of both the Room square and Kirkman Schoolgirl problems. His ideas played an important role when we (Colbourn, Lamken, Ling, Mills) finally settled the problem in 2002. His work on designs with orthogonal resolutions was unique and demonstrated his ability to find new connections between designs, finite geometries, and coding theory. I was Scott’s second PhD student, and Scott and I did a lot of work together on designs with orthogonal resolutions and on special types of balanced tournament designs. We determined the spectrum for both factored BTDs and partitioned BTDs and discovered new connections to other designs; see [121] for an early survey. As I work on existence questions for designs with orthogonal resolutions and generalized BTDs and Kirkman squares, I am often reminded of Scott’s ideas and creativity in design theory.

I was fortunate to be Scott’s student; he was a wonderful advisor, mentor, collaborator, and friend. He was always enthusiastic and generous with his ideas and time. We met quite frequently to discuss research. I still remember a phone call I got from him as a grad student. It was Saturday and he called to tell me how much he liked the material I’d just given him and to tell me the ideas it had given him for new research. It was characteristic of Scott—thoughtful, generous, and inspiring! When I remember Scott these days, I think back to all those afternoons spent happily discussing research over coffee and I treasure those times.

1.4 Peter Landrock

The first time I really became aware of Scott’s contributions in cryptography was in 1992, when we both ran for presidency of the IACR. I won by a few votes—not because I was a better cryptographer, on the contrary, I was relatively new to the field—but because I had the good fortune of serving as the general chair of Eurocrypt ’90 in Aarhus, Denmark, which had gone very well, and I simply won because of that.

With a strong mathematical background, I had been somewhat disappointed with the lack of quality of mathematics in some of the articles that had been accepted in some of the Eurocrypt conferences back then. But this soon changed as a number of excellent mathematicians, as Scott, were drawn to the field, and I was particularly delighted to learn that the person I had been running against was a first-rate mathematician.

But what impressed me most at the time with Scott—and continued to impress me—was that he was one of the few persons who had managed to build an impressive company in the areas of applied cryptography, Certicom—and yet to continue serious research in pure mathematics in parallel. It was exactly the commercial potential that had fascinated me when I started teaching that subject around the time Certicom was founded. Scott immediately grasped the potential of elliptic curves in secure communication, and went for it. His work on elliptic curves over characteristic 2 finite fields with Gord Agnew and Ron Mullin quickly made Certicom a highly respected company, which more than anything was based on Scott’s insight into elliptic curves, his evangelism on the subject, and his active participation in the company.

I started Cryptomathic the year after Certicom was founded with my students Ivan Damgård and Jørgen Brandt, and during the 1990s a common interest and respect for each other’s commercial efforts developed between Scott and me, to the extent that at Eurocrypt 2000 in Belgium we were very close to announcing that Certicom had acquired Cryptomathic. But in spite of this not happening, our friendship continued right until the sad day where Scott passed away much too early. Even though we would always begin our conversations on commercial aspects of our companies when we met, we would most of the time switch to mathematical problems instead after a short while.

1.5 Ron Mullin

Early one afternoon in 1972, a young man whom I had not met, walked into my office and said “Sir, I want to be your graduate student.” I talked to him for a while and said to myself “I definitely want this young man to be my graduate student”, and so began my lifelong friendship and many years of collaboration with Scott Vanstone.

Scott wrote an outstanding dissertation and graduated with his Ph.D. in 1974, and soon became well-known for his work in design theory. One strong indicator of this fact is the story of his second graduate student, Esther Lamken. Although Scott was at Waterloo, Esther’s degree is from the University of Michigan! Esther began as a strong doctoral student at Michigan who was interested in design theory. The faculty there knew of Scott by reputation and decided that it was in Esther’s best interest to work under Scott while writing her dissertation. Esther’s thesis bordered on being encyclopedic, and their collaboration continued for many decades.

Working with Scott was always fun. In particular I enjoyed working with him (and others) on optimal normal bases. A normal basis in \({\mathbb F}= {\mathbb F}_{q ^n}\) is a basis of the form \(B=(\alpha , \alpha ^q, \ldots ,\alpha ^{q^{n-1}})\), that is, a set of algebraic conjugates of some element in \({\mathbb F}\). It has long been noted that raising a field element represented by coordinates with respect to this basis to the qth power is equivalent to a cyclic shift. This is particularly interesting when the ground field is \({\mathbb F}_2\) because of the square-and-multiply algorithm used for exponentiation. Squaring becomes straightforward, but the multiplication has to be dealt with. The bilinear form representing the product of two elements in such a representation tends to have a large number of nonzero terms as n grows. We called this number the complexity of the basis since it is a good indicator of the difficulty of implementing the calculation in either hardware or software. Tables of the minimum complexity of all normal bases in \({\mathbb F}_{2^n}\) for the first few values of n showed that the complexity could be as small as \(2n-1\) (which is easily shown to be minimal, and which we called optimal), but these were relatively rare. Our task was to determine the pattern for optimal bases and prove that it held for finite fields of all characteristics [116]. We found sufficient conditions by providing constructions. The results provided algorithms for efficient exponentiation in \({\mathbb F}_{2^n}\) for relatively large values of n. That the sufficient conditions we found were also necessary was subsequently shown by S. Gao in his doctoral thesis. For an example of their proposed use in current cryptography see, for example, “Whirlwind, a new cryptographic hash function” by P. Baretto, V. Nikov, S. Nikova, V. Rijmen and E. Tischhauser, Designs, Codes and Cryptography 56, (2010) 141–162.

Scott was an outstandingly brilliant mathematician who had great insight and foresight and nowhere is this shown better than by his work in elliptic curve cryptography (ECC). He took the idea of using elliptic curve groups for cryptographic purposes when many were extremely skeptical, and made ECC into what it is today, the most efficient and secure of all public-key algorithms.

He was a great mentor to his graduate students, easy to work with, and generous with his ideas. This was also the case when he worked with colleagues. But the same can be said about his relations with people in general. He made long-standing friends easily with his warmth, his sense of humour, his great generosity, and his ability to relate to others. His friends numbered in the hundreds, and he delighted in them. He was truly an exceptional human being. Words are inadequate to express the contributions that he made.

He was a great friend and a great man who is very sorely missed by so many.

1.6 Scott Vanstone’s Ph.D. students

  1. (1)

    Ryoh Fuji-Hara

  2. (2)

    Esther Lamken (co-supervised with Andreas Blass)

  3. (3)

    Donald Curran

  4. (4)

    Paul van Oorschot

  5. (5)

    Steve Furino

  6. (6)

    Alfred Menezes

  7. (7)

    Minghua Qu

  8. (8)

    Robert Zuccherato

  9. (9)

    Robert Lambert (co-supervised with Ian Blake)

  10. (10)

    Charles Lam (co-supervised with Guang Gong)

  11. (11)

    John Proos

  12. (12)

    Ken Giuliani (co-supervised with Guang Gong)

  13. (13)

    Berkant Ustaoğlu (co-supervised with Alfred Menezes)