Constructions of feebly secure cryptographic primitives Olga - PowerPoint PPT Presentation

Constructions of feebly secure cryptographic primitives Olga Melanich Steklov Institute of Mathematics at St. Petersburg 3.10.2009 1 / 12

Basic definitions Notation B n , m = { f : B n → B m } , where B = { 0 , 1 } . 2 / 12

Basic definitions Notation B n , m = { f : B n → B m } , where B = { 0 , 1 } . Definition Circuit complexity of a function f is the smallest number of gates in a circuit computing f (such circuit is called an optimal circuit for f ) C ( f ) = c : ∀ x c ( x )= f ( x ) C ( c ) . min 2 / 12

Basic definitions Notation B n , m = { f : B n → B m } , where B = { 0 , 1 } . Definition Circuit complexity of a function f is the smallest number of gates in a circuit computing f (such circuit is called an optimal circuit for f ) C ( f ) = c : ∀ x c ( x )= f ( x ) C ( c ) . min Definition f n ∈ B n , m , injective. The measure of feeble one-wayness M F ( f n ) = C ( f − 1 ) C ( f n ) . n 2 / 12

Basic definitions Notation B n , m = { f : B n → B m } , where B = { 0 , 1 } . Definition Circuit complexity of a function f is the smallest number of gates in a circuit computing f (such circuit is called an optimal circuit for f ) C ( f ) = c : ∀ x c ( x )= f ( x ) C ( c ) . min Definition f n ∈ B n , m , injective. The measure of feeble one-wayness M F ( f n ) = C ( f − 1 ) C ( f n ) . n Definition { f n } is feebly one-way of order k if lim inf n →∞ C ( f n ) = ∞ and lim inf n →∞ M F ( f n ) = k , with k ∈ ( 1 , ∞ ] . 2 / 12

Hiltgen’s function of order 3/2 f n (( x 1 , ... x n )) = ( y 1 , ... y n ) , where y i = x i ⊕ x i + 1 1 ≤ i < n y i = x 1 ⊕ x ⌈ n / 2 ⌉ ⊕ x n i = n . 3 / 12

Hiltgen’s function of order 3/2 f n (( x 1 , ... x n )) = ( y 1 , ... y n ) , where y i = x i ⊕ x i + 1 1 ≤ i < n y i = x 1 ⊕ x ⌈ n / 2 ⌉ ⊕ x n i = n . f − 1 (( y 1 , ... y n )) = ( x 1 , ... x n ) , n where x i = ( y 1 ⊕ · · · ⊕ y i − 1 ) ⊕ ( y ⌈ n / 2 ⌉ ⊕ · · · ⊕ y n − 1 ) ⊕ y n 1 ≤ i ≤ ⌈ n / 2 ⌉ x i = ( y 1 ⊕ · · · ⊕ y ⌈ n / 2 ⌉− 1 ) ⊕ ( y i ⊕ · · · ⊕ y n − 1 ) ⊕ y n ⌈ n / 2 ⌉ ≤ i ≤ n . 3 / 12

Hiltgen’s function of order 3/2 f n (( x 1 , ... x n )) = ( y 1 , ... y n ) , where y i = x i ⊕ x i + 1 1 ≤ i < n y i = x 1 ⊕ x ⌈ n / 2 ⌉ ⊕ x n i = n . f − 1 (( y 1 , ... y n )) = ( x 1 , ... x n ) , n where x i = ( y 1 ⊕ · · · ⊕ y i − 1 ) ⊕ ( y ⌈ n / 2 ⌉ ⊕ · · · ⊕ y n − 1 ) ⊕ y n 1 ≤ i ≤ ⌈ n / 2 ⌉ x i = ( y 1 ⊕ · · · ⊕ y ⌈ n / 2 ⌉− 1 ) ⊕ ( y i ⊕ · · · ⊕ y n − 1 ) ⊕ y n ⌈ n / 2 ⌉ ≤ i ≤ n . Theorem For all n > 5 , the functions f n satisfy C ( f n ) = n + 1 and C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n 3 / 12

Hiltgen’s function of order 3/2 f n (( x 1 , ... x n )) = ( y 1 , ... y n ) , where y i = x i ⊕ x i + 1 1 ≤ i < n y i = x 1 ⊕ x ⌈ n / 2 ⌉ ⊕ x n i = n . f − 1 (( y 1 , ... y n )) = ( x 1 , ... x n ) , n where x i = ( y 1 ⊕ · · · ⊕ y i − 1 ) ⊕ ( y ⌈ n / 2 ⌉ ⊕ · · · ⊕ y n − 1 ) ⊕ y n 1 ≤ i ≤ ⌈ n / 2 ⌉ x i = ( y 1 ⊕ · · · ⊕ y ⌈ n / 2 ⌉− 1 ) ⊕ ( y i ⊕ · · · ⊕ y n − 1 ) ⊕ y n ⌈ n / 2 ⌉ ≤ i ≤ n . Theorem For all n > 5 , the functions f n satisfy C ( f n ) = n + 1 and C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n Corollary { f n } is feebly one-way of order 3 / 2 . 3 / 12

Methods 1 Gate elimination. 2 Lower bounds (Lamagna and Savage). Theorem If f ∈ B n depends non-idly on each of its n variables, then C ( f ) ≥ n − 1 . Theorem Let f = { f ( 0 ) , . . . , f ( m ) } ∈ B n , m . If the m component functions f ( i ) are pairwise different and if they satisfy C ( f ( i ) ) ≥ c ≥ 1 , then C ( f ) ≥ c + m − 1 . 4 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 3 C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 3 C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n C ( x i ) ≥ ⌈ n / 2 ⌉ − 1. 1 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 3 C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n C ( x i ) ≥ ⌈ n / 2 ⌉ − 1. 1 C ( f − 1 ) ≥ ( ⌈ n / 2 ⌉ − 1 ) + n − 1 = ⌊ 3 2 ( n − 1 ) ⌋ . 2 n 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 3 C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n C ( x i ) ≥ ⌈ n / 2 ⌉ − 1. 1 C ( f − 1 ) ≥ ( ⌈ n / 2 ⌉ − 1 ) + n − 1 = ⌊ 3 2 ( n − 1 ) ⌋ . 2 n ⇒ C ( f − 1 ) ≤ ⌊ 3 x i = y i ⊕ x i + 1 , i � = n = 2 ( n − 1 ) ⌋ . 3 n 5 / 12

Hiltgen’s function of order 3/2 Proof. 1 C ( f n ) ≤ n + 1. 2 C ( f n ) ≥ n + 1. Consider S 1 = { x 1 , x ⌈ n / 2 ⌉ , x n } , S 2 = { x 1 , . . . , x n } \ S 1 . 1 Set x i = 0 ∀ x i ∈ S 2 . We eliminate at least n − 1 gates. 2 C ( y n ) = 2. 3 3 C ( f − 1 ) = ⌊ 3 2 ( n − 1 ) ⌋ . n C ( x i ) ≥ ⌈ n / 2 ⌉ − 1. 1 C ( f − 1 ) ≥ ( ⌈ n / 2 ⌉ − 1 ) + n − 1 = ⌊ 3 2 ( n − 1 ) ⌋ . 2 n ⇒ C ( f − 1 ) ≤ ⌊ 3 x i = y i ⊕ x i + 1 , i � = n = 2 ( n − 1 ) ⌋ . 3 n Remark Hiltgen improved this family of permutations and got order 2. 5 / 12

Perspectives Linear constructions: ≤ n − 1 gates per one bit of output. f − 1 is also linear. f is linear = ⇒ 6 / 12

Perspectives Linear constructions: ≤ n − 1 gates per one bit of output. f − 1 is also linear. f is linear = ⇒ Nonlinear constructions are necessary! 6 / 12

Non-linear function of order 2 = ( x 1 ⊕ x 2 ) x n ⊕ x n − 1 y 1 y 2 = ( x 1 ⊕ x 2 ) x n ⊕ x 2 y 3 = x 1 ⊕ x 3 = x 3 ⊕ x 4 y 4 · · · y n − 1 = x n − 2 ⊕ x n − 1 = x n y n 7 / 12

Non-linear function of order 2 = ( x 1 ⊕ x 2 ) x n ⊕ x n − 1 y 1 y 2 = ( x 1 ⊕ x 2 ) x n ⊕ x 2 y 3 = x 1 ⊕ x 3 = x 3 ⊕ x 4 y 4 · · · y n − 1 = x n − 2 ⊕ x n − 1 = x n y n x n = y n x 2 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 2 x n − 1 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 1 x n − 2 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 1 ⊕ y n − 1 x n − 3 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 1 ⊕ y n − 1 ⊕ y n − 2 · · · x 3 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 1 ⊕ y n − 1 ⊕ . . . ⊕ y 4 x 1 = ( y 1 ⊕ . . . ⊕ y n − 1 ) y n ⊕ y 1 ⊕ y n − 1 ⊕ . . . ⊕ y 3 7 / 12

Non-linear function of order 2 Theorem { f n } is feebly one-way of order 2 . 8 / 12

Non-linear function of order 2 Theorem { f n } is feebly one-way of order 2 . Proof. 1 n − 1 ≤ C ( f n ) ≤ n + 1. 8 / 12

Non-linear function of order 2 Theorem { f n } is feebly one-way of order 2 . Proof. 1 n − 1 ≤ C ( f n ) ≤ n + 1. 2 2 n − 3 ≤ C ( f − 1 ) ≤ 2 n − 2. n 8 / 12

Non-linear function of order 2 Theorem { f n } is feebly one-way of order 2 . Proof. 1 n − 1 ≤ C ( f n ) ≤ n + 1. 2 2 n − 3 ≤ C ( f − 1 ) ≤ 2 n − 2. n 2 n − 3 n + 1 ≤ M F ( f n ) ≤ 2 n − 2 n − 1 . 3 8 / 12

Average case complexity Notation C α ( f ) – the minimal size of a circuit that correctly computes a function f ∈ B n , m on more than α n of its inputs ( α ∈ ( 0 , 1 ) ). 9 / 12

Average case complexity Notation C α ( f ) – the minimal size of a circuit that correctly computes a function f ∈ B n , m on more than α n of its inputs ( α ∈ ( 0 , 1 ) ). Theorem C 3 / 4 ( f − 1 ) ≥ 2 n − 4 . n 9 / 12