eliminating variables in boolean equation systems
play

Eliminating variables in Boolean equation systems Bjrn Mller Greve 1 - PowerPoint PPT Presentation

Aug 10, 2023 •168 likes •1.21k views

Eliminating variables in Boolean equation systems Bjrn Mller Greve 1 , 2 avard Raddum 2 Gunnar Flystad 3 yvind Ytrehus 2 H 1 Norwegian Defence Research Establishment 2 Simula@UiB 3 Dept. of Mathematics, UiB July 5, 2017 Introduction and

  1. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The Elimination Theorem Theorem If G ( F ) is a Gr¨ obner basis for the ideal I ( F ) with respect to the (lex) order x 1 > x 2 > · · · > x n , then G k ( F ) = G ( F ) ∩ B [ k + 1 , n ] obner basis of the k ’th elimination ideal I k ( F ) . is a Gr¨ Computes the full elimination ideal Preserves all ”exact” solutions of the original system 1. We have to compute the full Gr¨ obner basis before elimination. 2. Eliminates one monomial at the time. 3. Gr¨ obner bases are hard to compute → high complexity (All possible degrees) Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 2 / 18

  2. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  3. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  4. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  5. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  6. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  7. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  8. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Symmetric cryptography • Defined over the binary field GF (2) → block encryption algorithms E K ( P ) = C takes a fixed length plaintext P and a secret key K as inputs, and produces a ciphertext C . • Divides the data into blocks of fixed size, and then encrypting each block separately. The encryption usually consists of iterating a round function , consisting of suitable linear and nonlinear transformations • A known plaintext attack: Assume both P and C are known. Objective: Extract the secret key K . Boolean functions in cryptography Ciphers defined over GF (2) can always be described as a system of Boolean equations of degree 2 → introduce enough auxiliary variables → Solving this system of equations w.r.t K : Algebraic cryptanalysis. • The bits of the cipher states during encryption can always be described as polynomials in the user-selected key! • Over multiple rounds in a block cipher algorithm, the degree of the polynomials in only user-selected key bits grow fast, making the equations hard to solve. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 3 / 18

  9. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  10. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  11. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  12. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  13. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  14. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The block cipher problem If we start with a description of a block cipher as a system of equations of degree 2 using “many” variables, is it possible to efficiently eliminate all the auxiliary variables, such that we end up with some low-degree equations in which the only variables are the bits of K ? NB! We are guaranteed that the correct key K is one solution to this system, but restricting the degree means that we get many false keys as well. How to solve equations after elimination 1. The general method: Enumerating the possible solutions to the final system and ”lifting” these through the intermediate systems to filter out false solutions. 2. The block cipher method: Repeating the process of variable elimination using other known plaintext/ciphertext pairs and build up a low-degree system of equations in only user-selected key variables that has K as a unique solution. 3. Low degree system ↔ solve by re-linearization if we have enough polynomials ↔ repeat elimination until by brute force is possible. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 4 / 18

  15. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  16. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  17. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  18. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  19. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  20. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  21. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Our contribution • Trade-off: The ability to control the degree vs the ability to stay close to the elimination ideal I ∩ B [ k + 1 , n ] . • Minimize complexity ↔ Only consider polynomials of degree ≤ 3 ↔ F = { f 1 , . . . , f c } , G = { g 1 , . . . , g q } , f i ’s have degree 3 and the g i ’s degrees 2 . • Objective: Find as many polynomials in the ideal I ( F, G ) of degree ≤ 3 as we can ↔ Try to produce degree 3 or less in only key variables when applied to block ciphers. Eliminating variables while keeping degree ≤ 3 → introduce false solutions. • L = { 1 , x 1 , . . . , x n } → � L � → vector space spanned by the Boolean polynomials. • Eliminate variables from the vector space � F ∪ LG � ↔ LG = { lg where l ∈ L and g ∈ G } . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 5 / 18

  22. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  23. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  24. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  25. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  26. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  27. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  28. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  29. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  30. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The monomial orders A. Monomials containing x 1 are largest: Split variable Gauss eliminate monomials containing x 1 from the sets F and G producing � F x 1 , G x 1 � and � F x 1 , G x 1 � = � F, G � ∩ B [2 , n ] . B. Monomials of degree 3 are largest: Split deg 2 / 3 • � F ∪ LG � may contain more quadratic polynomials than just G . • Produce a larger set of quadratic polynomials G (2) by Gaussian elimination on degree 3 monomials in order to try to produce some polynomials of degree 2. 3 -normal forms : Normalizing cubics with respect to quadratics • Eliminate particular monomials containing x 1 from F using G as basis. • A polynomial f ∈ B is said to be in normal form f Norm with respect to G , if no monomial in f is divisible by the leading term of any polynomial in G → Achieve f Norm by successively subtracting multiples of the polynomials in G . • The effect of this procedure is that there is a rather large set of monomials containing x 1 that can not appear in the cubic polynomials output at the end. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 6 / 18

  31. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What is the alternative to Gr¨ obner bases? • Resultants: Eliminate one variable from all monomials containing the targeted variable at the time. • Let f = a 0 x 1 + a 1 and g = b 0 x 1 + b 1 be two polynomials in B , where the a j and b j are in B [2 , n ] . If f and g are quadratic, then a 0 and b 0 will be linear, a 1 and b 1 will (in general) be quadratic. • The 2 × 2 Sylvester matrix of f and g with respect to x 1 � � a 0 b 0 Syl( f, g, x 1 ) = a 1 b 1 • The resultant of f and g with respect to x 1 is a polynomial in B [2 , n ] : Res( f, g, x 1 ) = det(Syl( f, g, x 1 )) = a 0 b 1 + a 1 b 0 = b 0 f + a 0 g . Also Res( f, g, x 1 ) ⊂ I ′ = ( f, g ) ∩ B [2 , n ] . Good news 2 × 2 determinants are easy to compute, and cubic polynomials can be handled by a computer. Also the size of n we encounter in cryptanalysis of block ciphers are within tolerances. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 7 / 18

  32. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What is the alternative to Gr¨ obner bases? • Resultants: Eliminate one variable from all monomials containing the targeted variable at the time. • Let f = a 0 x 1 + a 1 and g = b 0 x 1 + b 1 be two polynomials in B , where the a j and b j are in B [2 , n ] . If f and g are quadratic, then a 0 and b 0 will be linear, a 1 and b 1 will (in general) be quadratic. • The 2 × 2 Sylvester matrix of f and g with respect to x 1 � � a 0 b 0 Syl( f, g, x 1 ) = a 1 b 1 • The resultant of f and g with respect to x 1 is a polynomial in B [2 , n ] : Res( f, g, x 1 ) = det(Syl( f, g, x 1 )) = a 0 b 1 + a 1 b 0 = b 0 f + a 0 g . Also Res( f, g, x 1 ) ⊂ I ′ = ( f, g ) ∩ B [2 , n ] . Good news 2 × 2 determinants are easy to compute, and cubic polynomials can be handled by a computer. Also the size of n we encounter in cryptanalysis of block ciphers are within tolerances. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 7 / 18

  33. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What is the alternative to Gr¨ obner bases? • Resultants: Eliminate one variable from all monomials containing the targeted variable at the time. • Let f = a 0 x 1 + a 1 and g = b 0 x 1 + b 1 be two polynomials in B , where the a j and b j are in B [2 , n ] . If f and g are quadratic, then a 0 and b 0 will be linear, a 1 and b 1 will (in general) be quadratic. • The 2 × 2 Sylvester matrix of f and g with respect to x 1 � � a 0 b 0 Syl( f, g, x 1 ) = a 1 b 1 • The resultant of f and g with respect to x 1 is a polynomial in B [2 , n ] : Res( f, g, x 1 ) = det(Syl( f, g, x 1 )) = a 0 b 1 + a 1 b 0 = b 0 f + a 0 g . Also Res( f, g, x 1 ) ⊂ I ′ = ( f, g ) ∩ B [2 , n ] . Good news 2 × 2 determinants are easy to compute, and cubic polynomials can be handled by a computer. Also the size of n we encounter in cryptanalysis of block ciphers are within tolerances. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 7 / 18

  34. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What is the alternative to Gr¨ obner bases? • Resultants: Eliminate one variable from all monomials containing the targeted variable at the time. • Let f = a 0 x 1 + a 1 and g = b 0 x 1 + b 1 be two polynomials in B , where the a j and b j are in B [2 , n ] . If f and g are quadratic, then a 0 and b 0 will be linear, a 1 and b 1 will (in general) be quadratic. • The 2 × 2 Sylvester matrix of f and g with respect to x 1 � � a 0 b 0 Syl( f, g, x 1 ) = a 1 b 1 • The resultant of f and g with respect to x 1 is a polynomial in B [2 , n ] : Res( f, g, x 1 ) = det(Syl( f, g, x 1 )) = a 0 b 1 + a 1 b 0 = b 0 f + a 0 g . Also Res( f, g, x 1 ) ⊂ I ′ = ( f, g ) ∩ B [2 , n ] . Good news 2 × 2 determinants are easy to compute, and cubic polynomials can be handled by a computer. Also the size of n we encounter in cryptanalysis of block ciphers are within tolerances. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 7 / 18

  35. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What is the alternative to Gr¨ obner bases? • Resultants: Eliminate one variable from all monomials containing the targeted variable at the time. • Let f = a 0 x 1 + a 1 and g = b 0 x 1 + b 1 be two polynomials in B , where the a j and b j are in B [2 , n ] . If f and g are quadratic, then a 0 and b 0 will be linear, a 1 and b 1 will (in general) be quadratic. • The 2 × 2 Sylvester matrix of f and g with respect to x 1 � � a 0 b 0 Syl( f, g, x 1 ) = a 1 b 1 • The resultant of f and g with respect to x 1 is a polynomial in B [2 , n ] : Res( f, g, x 1 ) = det(Syl( f, g, x 1 )) = a 0 b 1 + a 1 b 0 = b 0 f + a 0 g . Also Res( f, g, x 1 ) ⊂ I ′ = ( f, g ) ∩ B [2 , n ] . Good news 2 × 2 determinants are easy to compute, and cubic polynomials can be handled by a computer. Also the size of n we encounter in cryptanalysis of block ciphers are within tolerances. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 7 / 18

  36. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Coefficient constraints and Resultant ideals For I ( F ) = ( f 1 , . . . , f s ) where each f i written as f i = a i x 1 + b i : • Res 2 ( F ) = (Res( f i , f j ; x 1 ) | 1 ≤ i < j ≤ s ) . • Co 2 ( F ) = ( b 1 ( a 1 + 1) , b 2 ( a 2 + 1) , . . . , b s ( a s + 1)) . Theorem Let F = { f 1 , . . . , f s } be a set of Boolean polynomials in B [1 , n ] . Then I ( F ) ∩ B [2 , n ] = Res 2 ( F ) + Co 2 ( F ) . Note: IF f i have degree d ↔ deg(Res 2 ( F ) + Co 2 ( F )) = 2 d − 1 . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 8 / 18

  37. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Coefficient constraints and Resultant ideals For I ( F ) = ( f 1 , . . . , f s ) where each f i written as f i = a i x 1 + b i : • Res 2 ( F ) = (Res( f i , f j ; x 1 ) | 1 ≤ i < j ≤ s ) . • Co 2 ( F ) = ( b 1 ( a 1 + 1) , b 2 ( a 2 + 1) , . . . , b s ( a s + 1)) . Theorem Let F = { f 1 , . . . , f s } be a set of Boolean polynomials in B [1 , n ] . Then I ( F ) ∩ B [2 , n ] = Res 2 ( F ) + Co 2 ( F ) . Note: IF f i have degree d ↔ deg(Res 2 ( F ) + Co 2 ( F )) = 2 d − 1 . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 8 / 18

  38. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Coefficient constraints and Resultant ideals For I ( F ) = ( f 1 , . . . , f s ) where each f i written as f i = a i x 1 + b i : • Res 2 ( F ) = (Res( f i , f j ; x 1 ) | 1 ≤ i < j ≤ s ) . • Co 2 ( F ) = ( b 1 ( a 1 + 1) , b 2 ( a 2 + 1) , . . . , b s ( a s + 1)) . Theorem Let F = { f 1 , . . . , f s } be a set of Boolean polynomials in B [1 , n ] . Then I ( F ) ∩ B [2 , n ] = Res 2 ( F ) + Co 2 ( F ) . Note: IF f i have degree d ↔ deg(Res 2 ( F ) + Co 2 ( F )) = 2 d − 1 . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 8 / 18

  39. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The LG- elim algorithm • Replace F with F ∪ L · G . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 and F 3 into F 2 x 1 , F 3 x 1 , F 2 x 1 F 3 x 1 by Gaussian elimination on monomials containing x 1 . • Return F 2 x 1 F 3 x 1 . • Repeat for F j and G j in smaller and smaller Boolean rings B [ j, n ] . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 9 / 18

  40. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The LG- elim algorithm • Replace F with F ∪ L · G . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 and F 3 into F 2 x 1 , F 3 x 1 , F 2 x 1 F 3 x 1 by Gaussian elimination on monomials containing x 1 . • Return F 2 x 1 F 3 x 1 . • Repeat for F j and G j in smaller and smaller Boolean rings B [ j, n ] . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 9 / 18

  41. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The LG- elim algorithm • Replace F with F ∪ L · G . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 and F 3 into F 2 x 1 , F 3 x 1 , F 2 x 1 F 3 x 1 by Gaussian elimination on monomials containing x 1 . • Return F 2 x 1 F 3 x 1 . • Repeat for F j and G j in smaller and smaller Boolean rings B [ j, n ] . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 9 / 18

  42. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The LG- elim algorithm • Replace F with F ∪ L · G . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 and F 3 into F 2 x 1 , F 3 x 1 , F 2 x 1 F 3 x 1 by Gaussian elimination on monomials containing x 1 . • Return F 2 x 1 F 3 x 1 . • Repeat for F j and G j in smaller and smaller Boolean rings B [ j, n ] . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 9 / 18

  43. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The LG- elim algorithm • Replace F with F ∪ L · G . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 and F 3 into F 2 x 1 , F 3 x 1 , F 2 x 1 F 3 x 1 by Gaussian elimination on monomials containing x 1 . • Return F 2 x 1 F 3 x 1 . • Repeat for F j and G j in smaller and smaller Boolean rings B [ j, n ] . Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 9 / 18

  44. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  45. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  46. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  47. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  48. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  49. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  50. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  51. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  52. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  53. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  54. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Main elimination algorithm: Eliminate • Split G into G x 1 , G x 1 ⊂ B [2 , n ] by Gaussian elimination on monomials containing x 1 • If G x 1 or G x 1 changed in last iteration, then • Replace F with ( x 1 + 1) G x 1 ∪ x 1 G x 1 ∪ F producing more cubic polynomials. • Normalize F with respect to G x 1 to eliminate particular monomials containing x 1 . • Produce more degree 3 relations from resultants and coefficient constraints w.r.t x 1 of G x 1 and add to F . • Gauss eliminate w.r.t degree to produce F 2 , F 3 from F . • Split F 2 into F 2 x 1 , F 2 x 1 by Gaussian elimination on monomials containing x 1 . • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • G x 1 ← G x 1 ∪ F 2 x 1 , G x 1 changes if F 2 x 1 � = ∅ , causing new iteration • Split F 3 into F 3 x 1 , F 3 x 1 by Gaussian elimination on monomials containing x 1 and Return F 3 x 1 , G x 1 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 10 / 18

  55. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Remarks and Complexity • In general we have � F ∪ LG � ∩ B [2 , n ] ⊆ � F 3 x 1 ∪ L 2 G x 1 � even if we look for more quadratic polynomials in the LG-algorithm. • � n − 1 and � n − 1 � � is the tight upper bound on the number of monomials and ≤ 3 ≤ 2 polynomials which can occur in F and G , respectively. • Space complexity of the algorithm is storing O ( n 6 ) monomials. • The time complexity is dominated by the linear algebra done in SplitDeg2/3 and SplitVariable. In the worst case, we have input size O ( n 3 ) in both polynomials and monomials, so the matrices constructed are of size O ( n 3 ) × O ( n 3 ) . This leads to O ( n 9 ) for the Gaussian reduction. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 11 / 18

  56. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Remarks and Complexity • In general we have � F ∪ LG � ∩ B [2 , n ] ⊆ � F 3 x 1 ∪ L 2 G x 1 � even if we look for more quadratic polynomials in the LG-algorithm. • � n − 1 and � n − 1 � � is the tight upper bound on the number of monomials and ≤ 3 ≤ 2 polynomials which can occur in F and G , respectively. • Space complexity of the algorithm is storing O ( n 6 ) monomials. • The time complexity is dominated by the linear algebra done in SplitDeg2/3 and SplitVariable. In the worst case, we have input size O ( n 3 ) in both polynomials and monomials, so the matrices constructed are of size O ( n 3 ) × O ( n 3 ) . This leads to O ( n 9 ) for the Gaussian reduction. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 11 / 18

  57. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Remarks and Complexity • In general we have � F ∪ LG � ∩ B [2 , n ] ⊆ � F 3 x 1 ∪ L 2 G x 1 � even if we look for more quadratic polynomials in the LG-algorithm. • � n − 1 and � n − 1 � � is the tight upper bound on the number of monomials and ≤ 3 ≤ 2 polynomials which can occur in F and G , respectively. • Space complexity of the algorithm is storing O ( n 6 ) monomials. • The time complexity is dominated by the linear algebra done in SplitDeg2/3 and SplitVariable. In the worst case, we have input size O ( n 3 ) in both polynomials and monomials, so the matrices constructed are of size O ( n 3 ) × O ( n 3 ) . This leads to O ( n 9 ) for the Gaussian reduction. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 11 / 18

  58. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Remarks and Complexity • In general we have � F ∪ LG � ∩ B [2 , n ] ⊆ � F 3 x 1 ∪ L 2 G x 1 � even if we look for more quadratic polynomials in the LG-algorithm. • � n − 1 and � n − 1 � � is the tight upper bound on the number of monomials and ≤ 3 ≤ 2 polynomials which can occur in F and G , respectively. • Space complexity of the algorithm is storing O ( n 6 ) monomials. • The time complexity is dominated by the linear algebra done in SplitDeg2/3 and SplitVariable. In the worst case, we have input size O ( n 3 ) in both polynomials and monomials, so the matrices constructed are of size O ( n 3 ) × O ( n 3 ) . This leads to O ( n 9 ) for the Gaussian reduction. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 11 / 18

  59. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Remarks and Complexity • In general we have � F ∪ LG � ∩ B [2 , n ] ⊆ � F 3 x 1 ∪ L 2 G x 1 � even if we look for more quadratic polynomials in the LG-algorithm. • � n − 1 and � n − 1 � � is the tight upper bound on the number of monomials and ≤ 3 ≤ 2 polynomials which can occur in F and G , respectively. • Space complexity of the algorithm is storing O ( n 6 ) monomials. • The time complexity is dominated by the linear algebra done in SplitDeg2/3 and SplitVariable. In the worst case, we have input size O ( n 3 ) in both polynomials and monomials, so the matrices constructed are of size O ( n 3 ) × O ( n 3 ) . This leads to O ( n 9 ) for the Gaussian reduction. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 11 / 18

  60. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The (Reduced) LowMC cipher • Uses a 3 × 3 S-box → 14 quadratic polynomials describe S-box → S-boxes do not cover the whole state → part of the cipher block is not affected by the S-box layer. • Cipher parameters used: Block size: 24 bits, Key size: 32 bits, 1 S-box per round, 12 / 13 rounds. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 12 / 18

  61. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The (Reduced) LowMC cipher • Uses a 3 × 3 S-box → 14 quadratic polynomials describe S-box → S-boxes do not cover the whole state → part of the cipher block is not affected by the S-box layer. • Cipher parameters used: Block size: 24 bits, Key size: 32 bits, 1 S-box per round, 12 / 13 rounds. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 12 / 18

  62. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The (Reduced) LowMC cipher • Uses a 3 × 3 S-box → 14 quadratic polynomials describe S-box → S-boxes do not cover the whole state → part of the cipher block is not affected by the S-box layer. • Cipher parameters used: Block size: 24 bits, Key size: 32 bits, 1 S-box per round, 12 / 13 rounds. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 12 / 18

  63. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The (Reduced) LowMC cipher • Uses a 3 × 3 S-box → 14 quadratic polynomials describe S-box → S-boxes do not cover the whole state → part of the cipher block is not affected by the S-box layer. • Cipher parameters used: Block size: 24 bits, Key size: 32 bits, 1 S-box per round, 12 / 13 rounds. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 12 / 18

  64. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  65. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  66. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  67. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  68. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  69. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  70. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all variables x i for i ≥ 32 → Find some polynomials of degree at most 3 , only in x 0 , . . . , x 31 . • 12 rounds: 44 variables, F = ∅ , | G | = 168 . • LG − elim : Produces 1-2 cubic polynomial(s) only in key variables. Memory requirement: Store 7560 polynomials from G · L . • eliminate : Produce same polynomials as LG − elim . Size of F never above 2000 polynomials ↔ eliminate has less space complexity than LG − elim . Running time: Roughly the same. • 15 different systems using different p/c-pairs → 20 cubic polynomials in only key bits → Seems that we can produce many independent polynomials from different p/c-pairs. Other results • Checking for linear dependencies among 20 cubic polynomials we produced five linear polynomials in only key bits ↔ Need much fewer polynomials than expected to find the values of x 0 , . . . , x 31 . • 13 rounds: 47 variables, F = ∅ , | G | = 182 . For the 13-round systems we tried, neither LG − elim or eliminate found any cubic polynomials in only key variables → Only up to 12 rounds may be attacked using techniques. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 13 / 18

  71. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The toy cipher • Uses four 4 × 4 S-boxes (the same S-box as used in PRINCE) → Use same key in every round. • Cipher parameters used: Block size: 16 -bit, key size: 16 -bit → Used a 4-round version of Cipher. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 14 / 18

  72. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The toy cipher • Uses four 4 × 4 S-boxes (the same S-box as used in PRINCE) → Use same key in every round. • Cipher parameters used: Block size: 16 -bit, key size: 16 -bit → Used a 4-round version of Cipher. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 14 / 18

  73. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The toy cipher • Uses four 4 × 4 S-boxes (the same S-box as used in PRINCE) → Use same key in every round. • Cipher parameters used: Block size: 16 -bit, key size: 16 -bit → Used a 4-round version of Cipher. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 14 / 18

  74. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  75. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  76. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  77. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  78. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  79. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  80. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Experimental results • Eliminate all non-key variables x 16 , . . . , x 63 from the system → Find some polynomials of degree at most 3 only in x 0 , . . . , x 15 . • 4 rounds: 64 variables, F = ∅ , | G | = 336 • None of LG − elim or eliminate were able to find any cubic polynomial in only key variables. . Information loss • Running LG − elim/eliminate → Throw away polynomials giving constraints on the solution space Introduce false solutions. • F = ∅ and G = ∅ → all solutions are valid → ”Lost all information about the possible solutions to the original equation system”. • Measure how fast the information about the solutions we seek disappear for the toy cipher. • With only a 16-bit key it is possible to do exhaustive search → Check which key values that fit in any of the equation systems we get after eliminating some variables. Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 15 / 18

  81. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The information loss experiment • Eliminate variables distributed evenly throughout the system → Check how many keys fits in the given system after each elimination → Gives information on how much information the system has about the unknown secret key. • The amount of information a system S has about the key: i ( S ) = 16 − log 2 ( # of keys that fit in S ) . S v is the system after eliminating v variables. • For the plaintext/ciphertext pair we used there were three keys that fit in the initial system ↔ i ( S 0 ) ≈ 14 . 42 . • What is the rate of information loss during elimination? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 16 / 18

  82. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The information loss experiment • Eliminate variables distributed evenly throughout the system → Check how many keys fits in the given system after each elimination → Gives information on how much information the system has about the unknown secret key. • The amount of information a system S has about the key: i ( S ) = 16 − log 2 ( # of keys that fit in S ) . S v is the system after eliminating v variables. • For the plaintext/ciphertext pair we used there were three keys that fit in the initial system ↔ i ( S 0 ) ≈ 14 . 42 . • What is the rate of information loss during elimination? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 16 / 18

  83. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The information loss experiment • Eliminate variables distributed evenly throughout the system → Check how many keys fits in the given system after each elimination → Gives information on how much information the system has about the unknown secret key. • The amount of information a system S has about the key: i ( S ) = 16 − log 2 ( # of keys that fit in S ) . S v is the system after eliminating v variables. • For the plaintext/ciphertext pair we used there were three keys that fit in the initial system ↔ i ( S 0 ) ≈ 14 . 42 . • What is the rate of information loss during elimination? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 16 / 18

  84. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The information loss experiment • Eliminate variables distributed evenly throughout the system → Check how many keys fits in the given system after each elimination → Gives information on how much information the system has about the unknown secret key. • The amount of information a system S has about the key: i ( S ) = 16 − log 2 ( # of keys that fit in S ) . S v is the system after eliminating v variables. • For the plaintext/ciphertext pair we used there were three keys that fit in the initial system ↔ i ( S 0 ) ≈ 14 . 42 . • What is the rate of information loss during elimination? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 16 / 18

  85. Introduction and motivation Elimination techniques Elimination algorithms Experimental results The information loss experiment • Eliminate variables distributed evenly throughout the system → Check how many keys fits in the given system after each elimination → Gives information on how much information the system has about the unknown secret key. • The amount of information a system S has about the key: i ( S ) = 16 − log 2 ( # of keys that fit in S ) . S v is the system after eliminating v variables. • For the plaintext/ciphertext pair we used there were three keys that fit in the initial system ↔ i ( S 0 ) ≈ 14 . 42 . • What is the rate of information loss during elimination? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 16 / 18

  86. Introduction and motivation Elimination techniques Elimination algorithms Experimental results Figure: i ( S v ) for 0 ≤ v ≤ 31 Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 17 / 18

  87. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What this tells us • For the Toy cipher it is possible to construct a cubic equation system, with the same information on the key, with only k + ( n − k ) / 2 variables where k is the number of key bits → Trade-off between degree and number of variables needed to describe a cipher. • I.e: For the toy cipher, increasing the degree by one allows to cut the number of non-key variables in half to describe the same cipher. Open questions • Attacks on other ciphers? When does the algorithm work and not? • Generalizations of elimination algorithm? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 18 / 18

  88. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What this tells us • For the Toy cipher it is possible to construct a cubic equation system, with the same information on the key, with only k + ( n − k ) / 2 variables where k is the number of key bits → Trade-off between degree and number of variables needed to describe a cipher. • I.e: For the toy cipher, increasing the degree by one allows to cut the number of non-key variables in half to describe the same cipher. Open questions • Attacks on other ciphers? When does the algorithm work and not? • Generalizations of elimination algorithm? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 18 / 18

  89. Introduction and motivation Elimination techniques Elimination algorithms Experimental results What this tells us • For the Toy cipher it is possible to construct a cubic equation system, with the same information on the key, with only k + ( n − k ) / 2 variables where k is the number of key bits → Trade-off between degree and number of variables needed to describe a cipher. • I.e: For the toy cipher, increasing the degree by one allows to cut the number of non-key variables in half to describe the same cipher. Open questions • Attacks on other ciphers? When does the algorithm work and not? • Generalizations of elimination algorithm? Eliminating variables in Boolean equation systems | B. Greve, H.Raddum, G.Fløystad, Ø.Ytrehus 18 / 18

Recommend

Re-linearization and elimination of variables in Boolean equation systems Bjrn Mller Greve 1 ,

Re-linearization and elimination of variables in Boolean equation systems Bjrn Mller Greve 1 ,

Re-linearization and elimination of variables in Boolean equation systems Bjrn Mller Greve 1 , 2 avard Raddum 2 yvind Ytrehus 2 H 1 Norwegian Defence Research Establishment 2 Simula@UiB 4 September, 2017 Introduction previous work

834 views • 66 slides
Boolean Functions Boolean Expressions Let B = { 0 , 1 } . 1 ... true, 0 ... false Let x 1 , x 2 ,

Boolean Functions Boolean Expressions Let B = { 0 , 1 } . 1 ... true, 0 ... false Let x 1 , x 2 ,

Boolean Functions Boolean Expressions Let B = { 0 , 1 } . 1 ... true, 0 ... false Let x 1 , x 2 , . . . , x n be boolean variables. Boolean Function of Arity n Semantics and Verification 2005 Abstract Syntax for Boolean Expressions ( x ranges

382 views • 4 slides
Satisfiability Sat and 3sat Consider a set of boolean variables x 1 , x 2 , . . . x n . Sat :

Satisfiability Sat and 3sat Consider a set of boolean variables x 1 , x 2 , . . . x n . Sat :

CS500 CS500 Satisfiability Sat and 3sat Consider a set of boolean variables x 1 , x 2 , . . . x n . Sat : Instance: A CNF formula . A literal is either a boolean variable x i or its negation x i . Question: Is there a truth assignment to the

332 views • 4 slides
1 Characters Boolean A char variable stores a single character A boolean value represents

1 Characters Boolean A char variable stores a single character A boolean value represents

CSC 2014 Java Bootcamp Lecture 2 Variables, Expressions, I/O &amp; Control VARIABLES &amp; EXPRESSIONS 2 Variables Variable Initialization A variable is a name for a location in memory A variable can be given an initial value in the

105 views • 10 slides
Advanced Algorithms k -SAT n Boolean variables: x 1 , x 2 ,..., x n

Advanced Algorithms k -SAT n Boolean variables: x 1 , x 2 ,..., x n

Advanced Algorithms k -SAT n Boolean variables: x 1 , x 2 ,..., x n {true,false} conjunctive normal form: k -CNF = C 1 C 2 C m Is satisfiable? m clauses: C 1 , C 2 ,..., C m

1.02k views • 42 slides
Normal Forms for CFGs Eliminating Useless Variables Removing Epsilon Removing Unit

Normal Forms for CFGs Eliminating Useless Variables Removing Epsilon Removing Unit

Normal Forms for CFGs Eliminating Useless Variables Removing Epsilon Removing Unit Productions Chomsky Normal Form 1 Variables That Derive Nothing Consider: S -&gt; AB, A -&gt; aA | a, B -&gt; AB Although A derives all strings of

543 views • 36 slides
Truth and Logic Brief Introduction to Boolean Variables INFO-1301, Quantitative Reasoning 1

Truth and Logic Brief Introduction to Boolean Variables INFO-1301, Quantitative Reasoning 1

Truth and Logic Brief Introduction to Boolean Variables INFO-1301, Quantitative Reasoning 1 University of Colorado Boulder February 13, 2017 Prof. Michael Paul Prof. William Aspray Overview This lecture will introduce boolean

494 views • 24 slides
W4231: Analysis of Algorithms Boolean Formulae 11/23/99 A Boolean formula is an expression that

W4231: Analysis of Algorithms Boolean Formulae 11/23/99 A Boolean formula is an expression that

W4231: Analysis of Algorithms Boolean Formulae 11/23/99 A Boolean formula is an expression that we can build starting from Boolean variables x 1 , . . . , x n , . . . and then using (AND) NP-completeness of 3SAT, Minimum Vertex

230 views • 5 slides
boolean variables Comparing objects, like Strings Do NOT use == to test equality A

boolean variables Comparing objects, like Strings Do NOT use == to test equality A

boolean variables Comparing objects, like Strings Do NOT use == to test equality A primitive type to store true or false That just compares references! For example, e.g., boolean done = false; String s1 = dog; String

395 views • 4 slides
Propositional models Start with a fixed number of boolean variables called the vocabulary : e.g. a

Propositional models Start with a fixed number of boolean variables called the vocabulary : e.g. a

1/22/2010 Propositional models Start with a fixed number of boolean variables called the vocabulary : e.g. a , b , c . Each boolean Historical models of computation variable represents a proposition, for example &quot;today it is raining&quot;.

416 views • 6 slides
Variables &amp; References Variables with primitive types: Primitive types Lower

Variables &amp; References Variables with primitive types: Primitive types Lower

Variables &amp; References Variables with primitive types: Primitive types Lower case names int, float, double, boolean, Declare variables: &lt;type name&gt; &lt;variableName&gt;; Memory will be allocated to

399 views • 12 slides
Many Variables and Constraints Equation vs. inequality constraints Budget line (equation): P x x +

Many Variables and Constraints Equation vs. inequality constraints Budget line (equation): P x x +

ECO 305 FALL 2003 September 18 Many Variables and Constraints Equation vs. inequality constraints Budget line (equation): P x x + P y y = I Inequality budget constraint: P x x + P y y I At optimum ( x , y ) , constraint is

152 views • 4 slides
Boolean Algebra &amp; Logic Gates M. Sachdev, Dept. of Electrical &amp; Computer Engineering

Boolean Algebra &amp; Logic Gates M. Sachdev, Dept. of Electrical &amp; Computer Engineering

ECE 223 Digital Circuits and Systems Boolean Algebra &amp; Logic Gates M. Sachdev, Dept. of Electrical &amp; Computer Engineering University of Waterloo 1 Binary (Boolean) Logic Deals with binary variables and binary logic functions

387 views • 13 slides
Introduction to Programming Python Lab 6: Relational Operators and Boolean Variables PythonLab6

Introduction to Programming Python Lab 6: Relational Operators and Boolean Variables PythonLab6

Introduction to Programming Python Lab 6: Relational Operators and Boolean Variables PythonLab6 lecture slides.ppt 1 5 November 2019 or Ping Brennan (p.brennan@bbk.ac.uk) 21 February 2020 Getting Started Create a new folder in your

535 views • 17 slides
Solving the Equation The Variables for Womens Success in Engineering and Computing U.S.

Solving the Equation The Variables for Womens Success in Engineering and Computing U.S.

Solving the Equation The Variables for Womens Success in Engineering and Computing U.S. population ages 20- 24 and engineering bachelors degrees awarded, by race / ethnicity and gender, 2013 Note: Underrepresented minority (URM) includes

188 views • 15 slides
Dummy Endogenous Variables in a Simultaneous Equation System Econometrica, Vol. 46, No. 4 (Jul.,

Dummy Endogenous Variables in a Simultaneous Equation System Econometrica, Vol. 46, No. 4 (Jul.,

Dummy Endogenous Variables in a Simultaneous Equation System Econometrica, Vol. 46, No. 4 (Jul., 1978), 931-959. James J. Heckman Econ 312, Spring 2019 Heckman 5/29/2019 1. A GENERAL MODEL FOR THE TWO EQUATION CASE Heckman Dummy Endogenous

764 views • 22 slides
Definitions Boolean set: B 0 , 1 Boolean constants: 0, 1 Boolean variable: x 0

Definitions Boolean set: B 0 , 1 Boolean constants: 0, 1 Boolean variable: x 0

Computer Architecture applied computer science 03.01 Boolean algebra urbino worldwide campus 03 Logic networks 03.01 Boolean algebra Definitions Boolean

489 views • 6 slides
Boolean Logic Guan-Shieng Huang Oct. 4, 2006 0-0 Boolean Expressions X = { x 1 ,

Boolean Logic Guan-Shieng Huang Oct. 4, 2006 0-0 Boolean Expressions X = { x 1 ,

Boolean Logic Guan-Shieng Huang Oct. 4, 2006 0-0 Boolean Expressions X = { x 1 , x 2 , . . . } a countably infinite variables, each can be true or false . Logical connectivities: : logical or; : logical and; :

517 views • 17 slides
CSEE 3827: Fundamentals of Computer Systems Boolean Logic &amp; Boolean Algebra Agenda (M&amp;K

CSEE 3827: Fundamentals of Computer Systems Boolean Logic &amp; Boolean Algebra Agenda (M&amp;K

CSEE 3827: Fundamentals of Computer Systems Boolean Logic &amp; Boolean Algebra Agenda (M&amp;K 2.1-2.2, 2.8-2.9) Terminology Boolean algebra Logic gates Circuit fabrication NAND, NOR DUAL XOR 2 Terminology

733 views • 28 slides
Dealing with Artificially Dichotomized Variables in Meta-Analytic Structural Equation Modeling

Dealing with Artificially Dichotomized Variables in Meta-Analytic Structural Equation Modeling

Dealing with Artificially Dichotomized Variables in Meta-Analytic Structural Equation Modeling Hannelies de Jonge, Suzanne Jak, &amp; Kees Jan Kan University of Amsterdam H.deJonge@uva.nl Psychoco 2020: International Workshop on Psychometric

514 views • 15 slides
FourierSAT: A Fourier Expansion-Based Algebraic Framework for Solving Hybrid Boolean Constraints

FourierSAT: A Fourier Expansion-Based Algebraic Framework for Solving Hybrid Boolean Constraints

FourierSAT: A Fourier Expansion-Based Algebraic Framework for Solving Hybrid Boolean Constraints 1 Background: SATisfiability Problem Variables: Connectives: Literals: Formula: Model: an assignment with -1/1s of variables

445 views • 26 slides
Modelling of the Digital Systems What are the digital systems (circuits)? Digital systems

Modelling of the Digital Systems What are the digital systems (circuits)? Digital systems

Modelling of the Digital Systems What are the digital systems (circuits)? Digital systems are based on binary representation 0 or 1 Performing function of the Boolean logic Required circuits Boolean operators (inv, nand, nor, or, and)

535 views • 40 slides
1 Mux Representation of Boolean Functions MUX circuit to implement logic 1 0 x1 x2 x3

1 Mux Representation of Boolean Functions MUX circuit to implement logic 1 0 x1 x2 x3

ECE 474A/57A Computer-Aided Logic Design Lecture 11 Binary Decision Diagrams (BDDs) ECE 474a/575a 1 of 31 Susan Lysecky Boolean Logic Functions Representations Function can be represented in different ways Truth table, equation, K-map,

457 views • 12 slides
The IPAT Equation The IPAT Equation The IPAT Equation The IPAT

The IPAT Equation The IPAT Equation The IPAT Equation The IPAT

The IPAT Equation The IPAT Equation The IPAT Equation The IPAT Equation References Ehrlich, P.R. and J.P. Holdren, 1972. Critique: One Dimensional Ecology. Bulletin of the Atomic Scientists 28(5): 16, 18-27.

619 views • 18 slides

More recommend