Cryptanalysis of the Legendre PRF and Generalizations W. Beullens 1 - PowerPoint PPT Presentation

Cryptanalysis of the Legendre PRF and Generalizations W. Beullens 1 T. Beyne 1 A. Udovenko 2 G. Vitto 2 1 imec-COSIC, ESAT, KULeuven 2 SnT, University of Luxembourg November 13, 2020 COSIC

Legendre symbol Early 1900s: equidistribution results p k p k Damgård (1990) conjectures pseudorandomness of Jacobsthal (1906) and Davenport (1931) 2 p ◮ Legendre symbol of a ∈ F p (prime p > 2 ):  if a = b 2 for some b ∈ F × 1 � a �  p ,  = 0 if a = 0 ,   − 1 otherwise .

Legendre symbol Jacobsthal (1906) and Davenport (1931) p p 2 p ◮ Legendre symbol of a ∈ F p (prime p > 2 ):  if a = b 2 for some b ∈ F × 1 � a �  p ,  = 0 if a = 0 ,   − 1 otherwise . ◮ Early 1900s: equidistribution results ◮ Damgård (1990) conjectures pseudorandomness of � k � � k + 1 � , , . . .

Legendre PRF p – Ethereum 2.0 proof-of-custody – LegRoast signatures Beullens et al. (2020) 3 ◮ Pseudorandom function proposed by Grassi et al. (2016): � x + k � L k ( x ) = ∈ {− 1 , 0 , 1 } ◮ MPC-friendly ◮ Applications

Cryptanalysis of the Legendre PRF Bounties announced this work � https://legendreprf.org/ Overview 09/10 4 20/08 Khovratovich (2019) 24/07 � O ( p / M ) Challenges announced ( M = 2 20 ) � O ( p / M 2 ) √ p .) 4 (Time complexities for M <

Cryptanalysis of the Legendre PRF Bounties announced this work � https://legendreprf.org/ Overview 09/10 4 20/08 Khovratovich (2019) 24/07 � O ( p / M ) Challenges announced ( M = 2 20 ) � O ( p / M 2 ) √ p .) 4 (Time complexities for M <

Cryptanalysis of the Legendre PRF 14/10 log p improvement by Kaluđerović et al. (2020) 84-bit challenge solved 30/11 this work 74-bit challenge solved 21/10 Overview 64-bit challenge solved � https://legendreprf.org/ 09/10 Bounties announced 20/08 Khovratovich (2019) 24/07 4 � O ( p / M ) Challenges announced ( M = 2 20 ) � O ( p / M 2 ) √ p .) 4 (Time complexities for M <

Observation: L k x 1. Query L k M of the form L k a L k a Cryptanalysis of the Legendre PRF m 2. Extract M m sequences m ○ Sample L c if m until collision . log p then probably c k a Cost: M p M operations M memory . . . Khovratovich (2019) m L k x m . . . a . . . m . . . . . 5 ◮ Notation: L k ( x + [ m ]) = ( L k ( x ) , L k ( x + 1) , . . . , L k ( x + m − 1))

Cryptanalysis of the Legendre PRF . . . . . Khovratovich (2019) . . . . 5 . . . a . . . ◮ Notation: L k ( x + [ m ]) = ( L k ( x ) , L k ( x + 1) , . . . , L k ( x + m − 1)) ◮ Observation: L k ( x + [ m ]) = L 0 ( k + x + [ m ]) 1. Query L k ([ M ]) 2. Extract M − m sequences of the form L k ( a + [ m ]) L k ( a + [ m ]) ○ Sample L 0 ( c + [ m ]) until collision if m = Ω( log p ) then probably c = k + a Cost: � O ( M + p / M ) operations � O ( M ) memory

Cryptanalysis of the Legendre PRF . . . . . Khovratovich (2019) . . . . 5 . . . a . . . ◮ Notation: L k ( x + [ m ]) = ( L k ( x ) , L k ( x + 1) , . . . , L k ( x + m − 1)) ◮ Observation: L k ( x + [ m ]) = L 0 ( k + x + [ m ]) 1. Query L k ([ M ]) 2. Extract M − m sequences of the form L k ( a + [ m ]) L k ( a + [ m ]) ○ Sample L 0 ( c + [ m ]) until collision if m = Ω( log p ) then probably c = k + a Cost: � O ( M + p / M ) operations � O ( M ) memory

1. Query L k M of the form L k b a b L k b a b Cryptanalysis of the Legendre PRF until collision . 2. Extract M m sequences m ○ Sample L c m if m . log p then probably c k a b Cost: M p M operations M memory . . . a b p p p = Our attack: idea . . . . . . . . 6 . m . ◮ Multiplicativity of the Legendre symbol: � ab � � a � � b � = ⇒ L 0 ( b ) L k / b ( a / b +[ m ]) = L k ( a + b [ m ])

Cryptanalysis of the Legendre PRF . . . . . . . . . . Our attack: idea . . . . p . p p 6 = ◮ Multiplicativity of the Legendre symbol: � ab � � a � � b � = ⇒ L 0 ( b ) L k / b ( a / b +[ m ]) = L k ( a + b [ m ]) 1. Query L k ([ M ]) 2. Extract ∼ M 2 / m sequences of the form L k / b ( a / b + [ m ]) L k / b ( a / b + [ m ]) a , b ○ Sample L 0 ( c + [ m ]) until collision if m = Ω( log p ) then probably c = ( k + a )/ b O ( M 2 + p / M 2 ) operations Cost: � O ( M 2 ) memory

Cryptanalysis of the Legendre PRF . . . . . . . . . . Our attack: idea . . . . p . p p 6 = ◮ Multiplicativity of the Legendre symbol: � ab � � a � � b � = ⇒ L 0 ( b ) L k / b ( a / b +[ m ]) = L k ( a + b [ m ]) 1. Query L k ([ M ]) 2. Extract ∼ M 2 / m sequences of the form L k / b ( a / b + [ m ]) L k / b ( a / b + [ m ]) a , b ○ Sample L 0 ( c + [ m ]) until collision if m = Ω( log p ) then probably c = ( k + a )/ b O ( M 2 + p / M 2 ) operations Cost: � O ( M 2 ) memory

Cryptanalysis of the Legendre PRF b log p memory M time p log p M M Cost: – Only store sequences with a Our attack: optimizations Cost dominated by sequence extraction and table lookups – Amortizes Legendre symbol computation Advantages: Caveat : sequences in the table are not random 7 ◮ Use consecutive samples in offmine phase: 1. Compute L 0 ( c + [ w ]) for some w > m 2. Extract ∼ w 2 / m sequences of the form L 0 ( c / d + [ m ])

Cryptanalysis of the Legendre PRF Our attack: optimizations – Amortizes Legendre symbol computation 7 ◮ Use consecutive samples in offmine phase: 1. Compute L 0 ( c + [ w ]) for some w > m 2. Extract ∼ w 2 / m sequences of the form L 0 ( c / d + [ m ]) ◮ Caveat : sequences in the table are not random ◮ Advantages: → Cost dominated by sequence extraction and table lookups – Only store sequences with | a | < | b | ◮ Cost: O ( M 2 + p log 2 p / M 2 ) time O ( M 2 / log p ) memory

Cryptanalysis of the Legendre PRF Our attack: implementation results � https://github.com/cryptolu/LegendrePRF 128 GB of RAM 3 1500 3 1.5 8 Memory / thread (GB) Time (core-hours) p ◮ First M = 2 20 consecutive PRF outputs L k ([ M ]) were given ◮ Bottleneck: table lookups ( 0 . 08 µ s ) 2 40 − 87 < 0.001 < 1 2 64 − 59 2 74 − 35 ◮ Dell C6420 server; two Intel Xeon Gold 6132 CPUs (2.6 GHz)

Generalizations of the Legendre PRF Overview First analysis by Khovratovich (2019) Damgård (1990) 9 ◮ Higher-degree Legendre PRF ◮ Jacobi symbols ◮ Power-residue symbols

Generalizations of the Legendre PRF p d – Weak keys (next slides) p d p – Kaluđerović et al. (2020): using sequence extraction p d p – This work: time – Khovratovich (2019): Higher-degree Legendre PRF ): Attacks ( d p 10 ◮ Degree- 1 Legendre PRF: � x + k � L k ( x ) = k ∈ F p ,

Generalizations of the Legendre PRF p d – Weak keys (next slides) p d p – Kaluđerović et al. (2020): using sequence extraction p d p – This work: time – Khovratovich (2019): Higher-degree Legendre PRF ): Attacks ( d p p 10 ◮ Degree- d Legendre PRF: � x d + k d − 1 x d − 1 + . . . + k 1 x + k 0 � L k ( x ) = k ∈ F d ,

Generalizations of the Legendre PRF p – Weak keys (next slides) Higher-degree Legendre PRF p 10 ◮ Degree- d Legendre PRF: � x d + k d − 1 x d − 1 + . . . + k 1 x + k 0 � L k ( x ) = k ∈ F d , ◮ Attacks ( d ≥ 2 ): – Khovratovich (2019): � O ( p d − 1 ) time O ( p 2 + p d − 2 ) using sequence extraction – This work: � O ( p 3 + p d − 3 ) – Kaluđerović et al. (2020): �

Generalizations of the Legendre PRF Higher-degree Legendre PRF x Security? 11 ◮ Example: x d + k d − 1 x d − 1 + . . . + k 1 x + k 0 = � d i =1 ( x − α i ) with α 1 , . . . , α d ∈ F p distinct · · · L α 1 L α 2 L α 3 L α d ×

Generalizations of the Legendre PRF Higher-degree Legendre PRF Security? x 11 ◮ Example: x d + k d − 1 x d − 1 + . . . + k 1 x + k 0 = � d i =1 ( x − α i ) with α 1 , . . . , α d ∈ F p distinct · · · L α 1 L α 2 L α 3 L α d × � � O ( p ⌈ d /2 ⌉ ) attack

Generalizations of the Legendre PRF p Higher-degree Legendre PRF 12 ◮ Weak key when x d + k d − 1 x d − 1 + . . . + k 1 x + k 0 is reducible ◮ Worst case: two factors of equal degree L k ( x ) = L k 1 ( x ) L k 2 ( x ) with k 1 , k 2 ∈ F d /2 ◮ Attack: fjnd collision between L k ([ m ]) L k 1 ([ m ]) and L k 2 ([ m ]) 30 Fraction of keys 20% 25 attack complexity 50% 20 70% 90% 15 100% 10 5 0 0 5 10 15 20 25 30 degree

Generalizations of the Legendre PRF p 3. Apply the Chinese Remainder Theorem 2. Use attack on Legendre PRF to obtain k mod p 1. Use attack on Legendre PRF to obtain k mod q Attack: q x k p q p p k q px k k Jacobi PRF pq px k Observation q p pq 13 ◮ Let p , q > 2 be primes. Jacobi symbol of a ∈ Z /( pq ) Z : � a � � a � � a � =

Generalizations of the Legendre PRF pq 3. Apply the Chinese Remainder Theorem 2. Use attack on Legendre PRF to obtain k mod p 1. Use attack on Legendre PRF to obtain k mod q q q p q p Jacobi PRF 13 p q pq ◮ Let p , q > 2 be primes. Jacobi symbol of a ∈ Z /( pq ) Z : � a � � a � � a � = ◮ Observation � k + px � � k � � k + px � � k � � p � � k / p + x � = = ◮ Attack: