Easing Coppersmith Methods using Analytic Combinatorics: - PowerPoint PPT Presentation

Easing Coppersmith Methods using Analytic Combinatorics: Applications to Public-Key Cryptography with Weak Pseudorandomness Fabrice Benhamouda , Céline Chevalier, Adrian Thillard, and Damien Vergnaud École normale supérieure, CNRS, INRIA, PSL, Université Panthéon-Assas, ANSSI, Paris, France R E S E A R C H U N I V E R S I T Y PKC 2016, Taipei, Taiwan

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; small roots of bivariate polynomials [Cop96a]; Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; e.g., decrypt RSA with known plaintext MSB β : ( 2 k · β + x ) e mod N = c with | x | ≤ 2 k small roots of bivariate polynomials [Cop96a]; Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; e.g., decrypt RSA with known plaintext MSB β : ( 2 k · β + x ) e mod N = c with | x | ≤ 2 k extension of small plaintext: x e mod N = c ; small roots of bivariate polynomials [Cop96a]; Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; e.g., decrypt RSA with known plaintext MSB β : ( 2 k · β + x ) e mod N = c with | x | ≤ 2 k extension of small plaintext: x e mod N = c ; small roots of bivariate polynomials [Cop96a]; e.g., factorizing with known primes MSB: ( 2 k · α + x ) · ( 2 k · β + y ) = N with | x | , | y | ≤ 2 k Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; e.g., decrypt RSA with known plaintext MSB β : ( 2 k · β + x ) e mod N = c with | x | ≤ 2 k extension of small plaintext: x e mod N = c ; small roots of bivariate polynomials [Cop96a]; e.g., factorizing with known primes MSB: ( 2 k · α + x ) · ( 2 k · β + y ) = N with | x | , | y | ≤ 2 k Further extensions: more variables [HG97, BM05, JM06]; multiple polynomials and moduli [MR08, MR09, Rit10]. Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Quick History Introduced by Coppersmith in 1996 to find: small roots of univariate modular polynomials [Cop96b]; e.g., decrypt RSA with known plaintext MSB β : ( 2 k · β + x ) e mod N = c with | x | ≤ 2 k extension of small plaintext: x e mod N = c ; small roots of bivariate polynomials [Cop96a]; e.g., factorizing with known primes MSB: ( 2 k · α + x ) · ( 2 k · β + y ) = N with | x | , | y | ≤ 2 k Further extensions: more variables [HG97, BM05, JM06]; multiple polynomials and moduli [MR08, MR09][Rit10]. Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 2 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Goal Solve:  f 1 ( x 1 , . . . , x n ) = 0 mod N 1   .  . .   f s ( x 1 , . . . , x n ) = 0 mod N s  with | x 1 | ≤ X 1 | x n | ≤ X n . . . Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 3 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Goal Solve:  f 1 ( x 1 , . . . , x n ) = 0 mod N 1   .  . .   f s ( x 1 , . . . , x n ) = 0 mod N s  with | x 1 | ≤ X 1 | x n | ≤ X n . . . Question: which bounds X 1 , . . . , X n work? Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 3 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Overview 1 Construction of polynomials ˜ f i , j such that: mod N k i , j ˜ f i , j ( x 1 , . . . , x n ) = 0 i for any original solution ( x 1 , . . . , x n ) . Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 4 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Overview 1 Construction of polynomials ˜ f i , j such that: mod N k i , j ˜ f i , j ( x 1 , . . . , x n ) = 0 i for any original solution ( x 1 , . . . , x n ) . 2 Use LLL to find an integer system:  g 1 ( x 1 , . . . , x n ) = 0   .  . .   g n ( x 1 , . . . , x n ) = 0  such that: any original solution is satisfied; 1 it has only a finite number of solutions. 2 Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 4 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Overview 1 Construction of polynomials ˜ f i , j such that: mod N k i , j ˜ f i , j ( x 1 , . . . , x n ) = 0 i for any original solution ( x 1 , . . . , x n ) . 2 Use LLL to find an integer system:  g 1 ( x 1 , . . . , x n ) = 0   .  . .   g n ( x 1 , . . . , x n ) = 0  such that: any original solution is satisfied; 1 it has only a finite number of solutions. 2 3 Solve the system (using Groebner basis). Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 4 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Condition and Combinatorics Success condition = combinatorial condition on the number of polynomials ˜ f i , j the number of monomials in ˜ f i , j the moduli N k i , j i the bounds X i Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 5 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Condition and Combinatorics Success condition = combinatorial condition on the number of polynomials ˜ f i , j the number of monomials in ˜ f i , j the moduli N k i , j i the bounds X i Complexity: idem Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 5 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Condition and Combinatorics Success condition = combinatorial condition on the number of polynomials ˜ f i , j the number of monomials in ˜ f i , j the moduli N k i , j i the bounds X i Complexity: idem Difficult to compute when s and n non-constant Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 5 / 18

Introduction Analytic Combinatorics Application Coppersmith Methods Condition and Combinatorics Success condition = combinatorial condition on the number of polynomials ˜ f i , j the number of monomials in ˜ f i , j the moduli N k i , j i the bounds X i Complexity: idem Difficult to compute when s and n non-constant Our solution Use analytic combinatorics! Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 5 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 w 1 Output Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 w 1 Output Update Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 w 1 Output Update v 2 Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 w 1 Output Update v 2 w 2 Output Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output Update v 1 w 1 Output Update v 2 w 2 Output . . . Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18

Introduction Analytic Combinatorics Application Pseudorandom Generator (PRG) v 0 w 0 Output ≈ $ Update v 1 w 1 Output ≈ $ Update v 2 w 2 Output ≈ $ . . . Fabrice Benhamouda (ENS) Coppersmith and Analytic Combinatorics PKC 2016 6 / 18