Attacks on the Mersenne-based AJPS cryptosystem...Choose f;g 2R such that jfj= jgj= w and g...

Attacks on the Mersenne-based AJPS cryptosystem

Koen de Boer 1, L. Ducas 1, S. Jeffery 1,2, R. de Wolf 1,2,3

1Centrum Wiskunde en Informatica, Amsterdam

2QuSoft, Amsterdam

3University of Amsterdam

April 9, 2018

April 9, PQCrypto, Fort Lauderdale, Florida 1 / 15

Overview

Aggarwal, Joux, Prakash, Santha [AJPS17]

Propose potentially quantum-safe public-keycryptosystem based on Mersenne numbers andNTRU [HPS98].

Consider but dismiss Meet-in-the-Middle andlattice attacks.

Hope that ‘brute force’ is the optimal attack.

May ’17

Overview

May ’17

Overview

May ’17

Overview

May ’17

Beunardeau, Connolly, Geraud, Naccache [BCGN17]

Describe an experimental lattice-reduction attack.

Jun ’17

Overview

May ’17

Jun ’17

Our contribution

Meet-in-the-Middle attack

Analysis of the lattice-attack of Beunardeau et al.

Dec ’17

Overview

May ’17

Jun ’17

Our contribution

Analysis of the lattice-attack of Beunardeau et al.Dec ’17

Overview

May ’17

Jun ’17

Our contribution

Meet-in-the-Middle attack ← this talk

Analysis of the lattice-attack of Beunardeau et al.Dec ’17

Table of Contents

1 The Mersenne-number based AJPS-cryptosystem

2 Meet-in-the-Middle attack on the AJPS cryptosystemExample: Subset-sum problemMITM in the AJPS-cryptosystem

The AJPS cryptosystem

Set R = Z/NZ, where N = 2n − 1 with n prime.

Each element in R can be uniquely identified by its binaryrepresentation in {0, 1}n\{1n}.For a ∈ R, set |a| := the Hamming weight of the binaryrepresentation of a.

Set w = b√n/2c.

Choose f , g ∈ R such that |f | = |g | = w and g invertible.

Set h = f /g . Public key is h and secret key g .

Each element in R can be uniquely identified by its binaryrepresentation in {0, 1}n\{1n}.

For a ∈ R, set |a| := the Hamming weight of the binaryrepresentation of a.

a ∈ R bin. rep. |a|0 0...000 01 0...001 12 0...010 13 0...011 2...

......

2n − 2 1...110 n − 1

Set w = b√n/2c.

a ∈ R bin. rep. |a|0 0...000 01 0...001 12 0...010 13 0...011 2...

......

2n − 2 1...110 n − 1

Set w = b√n/2c.

a ∈ R bin. rep. |a|0 0...000 01 0...001 12 0...010 13 0...011 2...

......

2n − 2 1...110 n − 1

Set w = b√n/2c.

f = , g =

Set w = b√n/2c.

f = , g =

h = fg =

Set w = b√n/2c.

The Mersenne Low Hamming Ratio Problem

Given h ∈ R, which is quotient of two elements of low Hamming wt.

Find f , g ∈ R with |f | = |g | = w such that h = f /g .

Set w = b√n/2c.

Brute force attack: Guess a g ∈ R with |g | = w , check whether |gh| = w .time:

Table of Contents

1 The Mersenne-number based AJPS-cryptosystem

2 Meet-in-the-Middle attack on the AJPS cryptosystemExample: Subset-sum problemMITM in the AJPS-cryptosystem

Improved time complexity, at the cost of greater space complexity.

MITM in the subset-sum problem

Subset-sum problem

Given z1, . . . , zn ∈ ZFind I ⊆ {1, . . . , n} such that

∑i∈I zi = 0.

For all I1 ⊆ {1, . . . , n/2}, store I1 in the bucket L[∑

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

Check whether the bucket L[−∑

i∈I2zi]

is non-empty.

If it is, output I2 and a I1 ∈ L[−∑

i∈I2zi].

z1 6z2 2z3 −1z4 10z5 9z6 −5

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

6 {1}8 {1, 2}

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

6 {1}8 {1, 2}7 {1, 2, 3}

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

-1 {3}1 {2, 3}2 {2}5 {1, 3}6 {1}7 {1, 2, 3}8 {1, 2}

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

-1 {3}1 {2, 3}2 {2}5 {1, 3}6 {1}7 {1, 2, 3}8 {1, 2}

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

-1 {3}1 {2, 3}2 {2}5 {1, 3}6 {1}7 {1, 2, 3}8 {1, 2}

−∑

i∈{4} zi = −10

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z4 −5

i L[i ]

-1 {3}1 {2, 3}2 {2}5 {1, 3}6 {1}7 {1, 2, 3}8 {1, 2}

−∑

i∈{4} zi = −10−∑

i∈{5} zi = −9

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1

z4 10z5 9z6 −5

i L[i ]

-1 {3}1 {2, 3}2 {2}5 {1, 3}6 {1}7 {1, 2, 3}8 {1, 2}

−∑

i∈{4} zi = −10−∑

i∈{5} zi = −9−

∑∑∑i∈{6} zi = 5

Subset-sum problem

∑i∈I zi = 0.

i∈I1 zi].

For every I2 ⊆ {n/2 + 1, . . . , n} do

i∈I2zi]

is non-empty.

i∈I2zi].

z1 6z2 2z3 −1z4 10z5 9z6 −5

Output: {1, 3} ∪ {6}

MITM in the AJPS-cryptosystem

Split g = g1 + g2. (hg = f )

Then hg1 = −hg2 + f

Heuristically, assume −hg2 is random.

Then ∆Hamm(−hg2, hg1) ≤ 2w + c√w with error probability ≤ e−c/8.

Informally: −hg2 ≈ hg1.

Split g = g1 + g2. (hg = f )

−hg2f

Split g = g1 + g2. (hg = f )

−hg2f

hg1Heuristically, assume −hg2 is random.

Split g = g1 + g2. (hg = f )

−hg2f

Split g = g1 + g2. (hg = f )

−hg2f

Split a possible g = g1 + g2 in two parts, where g1 ∈ {0, 1}n/2 × 0n/2

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g1, store {g1} into the bucket L[hg1].

For all g2, do

Find t ≈ −hg2, such that L[t] is non-empty.If such t exists, pick g1 ∈ L[t] and output g1 + g2.

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g2, do

Hash Table L:Key Bucket

hg1→ {g1}hg ′1 → {g ′1}

......

. . . . . .

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g2, do

hg1→ {g1}hg ′1 → {g ′1}

......

. . . . . .

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g2, do

Find t ≈ −hg2, such that L[t] is non-empty.

If such t exists, pick g1 ∈ L[t] and output g1 + g2.

hg1→ {g1}hg ′1 → {g ′1}

......

. . . . . .

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g2, do

hg1→ {g1}hg ′1 → {g ′1}

......

. . . . . .

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g2, do

hg1→ {g1}hg ′1 → {g ′1}

......

Problem: There are many t ≈ −hg2, andmost of the buckets L[t] are empty

Locality Sensitive Hashing

hg1 = −hg2 + f

−hg2f

Construct the ‘hash’ function H : {0, 1}n → {0, 1}k , sendingbn · · · b1 7→ bk+i · · · bi .

Hope: H(hg1) = H(−hg2)

hg1 = −hg2 + f

−hg2f

hg1 = −hg2 + f

−hg2f

hg1 = −hg2 + f

−hg2f

and g2 ∈ 0n/2 × {0, 1}n/2.

For all g1, {g1} into the bucket L[H(hg1)].For all g2 do

Check whether L[H(−hg2)] is non-empty.If so, then check if some g1 ∈ L[H(−hg2)] satisfies |h(g1 + g2)| = w .If so, output g1 + g2.

and g2 ∈ 0n/2 × {0, 1}n/2.For all g1, {g1} into the bucket L[H(hg1)].

For all g2 do

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

and g2 ∈ 0n/2 × {0, 1}n/2.For all g1, {g1} into the bucket L[H(hg1)].

For all g2 do

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

and g2 ∈ 0n/2 × {0, 1}n/2.For all g1, {g1} into the bucket L[H(hg1)].For all g2 do

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

Check whether L[H(−hg2)] is non-empty.

If so, then check if some g1 ∈ L[H(−hg2)] satisfies |h(g1 + g2)| = w .If so, output g1 + g2.

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

Check whether L[H(−hg2)] is non-empty.If so, then check if some g1 ∈ L[H(−hg2)] satisfies |h(g1 + g2)| = w .

If so, output g1 + g2.

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

H(hg1)→ {g ′1, g ′′1 , g1, . . .}H(hg ′′′1 )→ {g ′′′1 , . . .}

......

Difficulties:

‘false positives’: non-close elements in the bucket‘false negatives’: close element in ‘wrong’ bucket

Difficulties:

‘false positives’: non-close elements in the bucket

‘false negatives’: close element in ‘wrong’ bucket

Difficulties:

Solution: Choose the block size of H to be log2(n/2w/2

). Repeat algorithm

over randomized H.

Difficulties:

). Repeat algorithm

over randomized H. Using a combinatorial heuristic, this works.

Difficulties:

). Repeat algorithm

over randomized H. Using a combinatorial heuristic, this works.

This algorithm breaks the AJPS system in time(n/2w/2

)≈ n

√n/8

Overview

Attack Authors Running time

Classical Quantum

Brute force AJPS n√n4 n

Meet in the Middle Our work n√n8 n

Lattice attack BCGN 2√n ? 2

√n/2 ?

Our analysis 2.01√n 2.01

√n/2

Overview

Classical Quantum

√n/2 ?

√n/2

Overview

Classical Quantum

√n/2 ?

√n/2

Overview

Classical Quantum

√n/2 ?

√n/2

Overview

Classical Quantum

√n/2 ?

√n/2

Open Questions

We analyzed the lattice attack of Beunardeau et al. overrandomly chosen keys.

Are there specific ‘weak’ keys for this lattice attack?

Aggarwal et al. improved their cryptosystem [AJPS17], allowing toencrypt more bits.What is the security of this improved system?

Open Questions

We analyzed the lattice attack of Beunardeau et al. overrandomly chosen keys.Are there specific ‘weak’ keys for this lattice attack?

Open Questions

Aggarwal et al. improved their cryptosystem [AJPS17], allowing toencrypt more bits.

What is the security of this improved system?

Open Questions

Main lesson

Collisions don’t need to be exact to apply aMeet-in-the-Middle attack

Main lesson

Collisions don’t need to be exact to apply aMeet-in-the-Middle attack

References

D. Aggarwal et al. A New Public-Key Cryptosystem viaMersenne Numbers. Cryptology ePrint Archive, Report2017/481. http://eprint.iacr.org/2017/481. 2017.

A. Ambainis. “Quantum Search with Variable Times”. In:Theory of Computing Systems 47.3 (2010), pp. 786–807.issn: 1433-0490. doi: 10.1007/s00224-009-9219-1.

M. Beunardeau et al. “On the Hardness of the Mersenne LowHamming Ratio Assumption”. In: Progress in Cryptology –LATINCRYPT 2017. Available athttp://eprint.iacr.org/2017/522. 2017.

J. Hoffstein, J. Pipher, and J. H. Silverman. “NTRU: Aring-based public key cryptosystem”. In: InternationalAlgorithmic Number Theory Symposium. Springer. 1998,pp. 267–288.

Attacks on the Mersenne-based AJPS cryptosystem...Choose f;g 2R such that jfj= jgj= w and g...

Documents

Marin Mersenne 1588 1648 Marin Mersenne 1588 1648 Marin Mersenne was a French monk who is best known for his role as a clearing house for correspondence

Bachelor’s Thesis: Su x Tree Based Palindrome Detection...palindrome with respect to gap length gif Ais the reverse of B(and vice versa) and jGj g. If jGj>0 the palindrome will be

Programming Project · PDF fileProgramming Project ... pi.html ... • For serial codes – Mersenne twister – GSL

Fermat and Mersenne Numbers

Mersenne Primes and GIMPS

Pier Francesco Roggero, Michele Nardelli, Francesco Di Noto - "The New Mersenne Prime Numbers"

Chapter 3 Introducing Groupsfrederique/lecture3ws.pdfA group Gcan be nite (jGj

Exploiting Decryption Failures in Mersenne Number ...Definition 2.1 (Mersenne Low Hamming Combination (LHC) As-sumption). Let 2n −1 be a Mersenne prime and ωan integer such that

Mersenne Translator of Bacon? - PDCNET.ORG · Mersenne Translator of Bacon? Claudio Buccolini ... scientiarum published in Paris in 1624,7 refuted by ... from Bacon’s Novum organum

Scetticismo e matematica nella Vérité des sciences di Mersenne · 8 Claudio Buccolini aBstraCt: La proposta epistemologica presentata da Marin Mersenne nella Vérité des sciences

Polya Enumeration Theorempi.math.cornell.edu/~apatotski/IHS2015/Lecture 10.pdf · 2015-12-11 · N(n) = 1 jGj X g2G nc(g) What is the number of necklaces with 4 beads of two colors?

Biblical Canon Research jgj

JGJ 80-2016 p 备案号J

01 JGJ 79-2002 Groud Treatment of Building

The Monochord according to Marin Mersenne · The Monochord according to Marin Mersenne Bits, ... “all the science of Music ... Boethius the first has no musical understanding and

JGJ! -+3 · 2013-04-25 · JGJ! -+3 . Title: Microsoft Word - Doc1.doc Author: ahmed Created Date: 6/18/2012 1:13:17 PM

The Search and Seizure of Digital Evidence by JGJ NORTJÉ

Û6 ^JoJl · 2018-01-08 · ôi«¡ajfcoJIJgJ¡«J|jg^^lîc¿JlisJIs^jÁoJI¿líJillâ g) vüboJI !4)¿-o j*o3 30A ¿SlsJJJ] »S»4) vSiJU U)«jli ÛU¿ I^J-o

free printable preschool farm book - slapdashmom.com...s"8/;g=w; =j; =a81= #8 g jn=81% 1nnj==7;wn ;=81g 11;#7 n; =ggj# "s;s" n 7l#8 ; n# 8 jn g#f 1gg jgj#8sn j n 11 j 1#gjs gj ssg

Discussed 2 G t complex'Emingai.ie IIiudx eyc2 y Imczs · 2020. 9. 3. · Discussed 2 Complex Number G t R2 complex'Emingai.ie z II eyc2 y iudx Imczs Jgj 2zE y Zzi useful for additionand